mosaicstack/stack
25
0 Fork 1
Code Issues 404 Pull Requests 13 Packages Projects Releases 15 Wiki Activity
Files
org-polish1
stack/agents/rocko/work/queue-280/build.patch
T

334 lines
16 KiB
Diff
Raw Permalink Blame History

diff --git a/docs/plans/DEFERRED.md b/docs/plans/DEFERRED.md
index 197a29ecb..7945a6829 100644
--- a/docs/plans/DEFERRED.md
+++ b/docs/plans/DEFERRED.md
@@ -319,6 +319,10 @@ at every gate. Started 2026-09-12 during the control board MVP.
waits 30 s before it calls a lone `sleep 30` a leak. The row 197
lanes scan only at lane end, about 15 minutes after pkg-bus, so they
can't see it (mos-1169). (2026-10-21)
+ Closing note, row 280 (2026-10-22): both scratch sshd fixtures install a
+ bounded 30/60-second sleep stub that exits when its test directory is gone;
+ other sleep arguments exec /usr/bin/sleep unchanged. Evidence is recorded
+ in agents/rocko/work/queue-280/BUILD.md.
- **Row 66 live checks: the unslop notice on a live managed session, both harnesses.**
(mos-1186, Vikunja #454.) Row 66's gate asked for one landing session per
diff --git a/packages/bus/tests/grant-executor.test.mjs b/packages/bus/tests/grant-executor.test.mjs
index 1992f1525..b27d91dc4 100644
--- a/packages/bus/tests/grant-executor.test.mjs
+++ b/packages/bus/tests/grant-executor.test.mjs
@@ -6,9 +6,9 @@
// reaches another host.
import test from 'node:test';
import assert from 'node:assert/strict';
-import { execFileSync, spawn } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
import { createHash } from 'node:crypto';
-import { connect } from 'node:net';
+import { createServer } from 'node:net';
import { appendFileSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
import { tmpdir, userInfo } from 'node:os';
import { join } from 'node:path';
@@ -19,6 +19,8 @@ import { hostExecutor, runHost } from '../src/host-run.mjs';
import { Store } from '../src/store.mjs';
import { grantDecision, hostRecord } from './host-fixtures.mjs';
+import { ephemeralRange, installSleepStub, pickPort, startScratchSshd } from './scratch-sshd.mjs';
+
const SSHD = '/usr/bin/sshd';
const USER = userInfo().username;
const AT = '2026-10-21T00:00:00.000Z';
@@ -35,12 +37,7 @@ const DEFINITIONS = {
pm: { roleVersion: 2, credentials: [] },
ops: { roleVersion: 2, credentials: [{ service: 'host' }] },
};
-const listening = (port) =>
- new Promise((resolve) => {
- const s = connect(port, '127.0.0.1');
- s.on('connect', () => (s.destroy(), resolve(true)));
- s.on('error', () => resolve(false));
- });
+
async function until(fn, ms = 10000) {
const end = Date.now() + ms;
while (!fn()) {
@@ -54,12 +51,13 @@ async function until(fn, ms = 10000) {
// Both also stop when the test dir is gone, since a held stub on the sshd side outlives its test (#1750).
// wrap.sh logs every request. The sudo stub logs its arguments to sudo.log and runs the command as the
// test's user.
-async function sshd(t, dir) {
+async function sshd(t, dir, options) {
if (!existsSync(SSHD)) throw new Error(`${SSHD} is missing: the executor tests need it and fail, never skip`);
keygen(join(dir, 'hostkey'));
keygen(join(dir, 'installer'));
writeFileSync(join(dir, 'authorized_keys'), readFileSync(join(dir, 'installer.pub')), { mode: 0o600 });
mkdirSync(join(dir, 'fake'));
+ installSleepStub(dir);
const stub = (name, body) => writeFileSync(join(dir, 'fake', name), `#!/bin/sh\nD='${dir}'\n${body}\n`, { mode: 0o755 });
stub('list', '[ -e "$D/fail-list" ] && exit 1\n[ -e "$D/granted" ] && grep " mosaic-[0-9a-f]*$" "$D/granted"\nexit 0');
stub(
@@ -76,26 +74,42 @@ async function sshd(t, dir) {
`#!/bin/sh\nprintf '%s\\n' "$SSH_ORIGINAL_COMMAND" >> '${dir}/requests.log'\nPATH=${dir}/fake:/usr/bin:/bin; export PATH\nexec /bin/sh -c "$SSH_ORIGINAL_COMMAND"\n`,
{ mode: 0o755 },
);
- for (let attempt = 0; attempt < 5; attempt++) {
- const port = 20000 + Math.floor(Math.random() * 20000);
- writeFileSync(
- join(dir, 'sshd_config'),
- [`Port ${port}`, 'ListenAddress 127.0.0.1', `HostKey ${dir}/hostkey`, `AuthorizedKeysFile ${dir}/authorized_keys ${dir}/granted`,
- `PidFile ${dir}/sshd.pid`, 'UsePAM no', 'StrictModes no', 'PasswordAuthentication no', 'KbdInteractiveAuthentication no',
- `ForceCommand ${dir}/wrap.sh`, ''].join('\n'),
- );
- const daemon = spawn(SSHD, ['-D', '-f', join(dir, 'sshd_config'), '-E', join(dir, 'sshd.log')], { stdio: 'ignore' });
- t.after(() => daemon.kill('SIGKILL'));
- const deadline = Date.now() + 3000;
- while (Date.now() < deadline && daemon.exitCode === null) {
- if (await listening(port)) return port;
- await sleep(30);
- }
- daemon.kill('SIGKILL');
- }
- throw new Error('scratch sshd did not start');
+ return startScratchSshd(t, dir, [
+ 'ListenAddress 127.0.0.1', `HostKey ${dir}/hostkey`,
+ `AuthorizedKeysFile ${dir}/authorized_keys ${dir}/granted`, `PidFile ${dir}/sshd.pid`,
+ 'UsePAM no', 'StrictModes no', 'PasswordAuthentication no', 'KbdInteractiveAuthentication no',
+ `ForceCommand ${dir}/wrap.sh`,
+ ], options);
}
+
+test('row 280: an occupied TCP port is attempted, refused, and retried with our sshd', async t => {
+ const dir = mkdtempSync(join(tmpdir(), 'sshd280-'));
+ t.after(() => rmSync(dir, { recursive: true, force: true }));
+ const server = createServer(socket => socket.end());
+ await new Promise((resolve, reject) => {
+ server.once('error', reject);
+ server.listen(0, '127.0.0.1', resolve);
+ });
+ t.after(() => new Promise(resolve => server.close(resolve)));
+ const occupied = server.address().port;
+ const port = await sshd(t, dir, { firstPort: occupied });
+ assert.match(readFileSync(join(dir, 'sshd-0.conf'), 'utf8'), new RegExp(`^Port ${occupied}\\n`));
+ assert.equal(readFileSync(join(dir, 'sshd-0.log'), 'utf8').includes(`Server listening on 127.0.0.1 port ${occupied}.`), false);
+ assert.notEqual(port, occupied);
+ assert.ok([1, 2, 3, 4].some(n => existsSync(join(dir, `sshd-${n}.log`)) &&
+ readFileSync(join(dir, `sshd-${n}.log`), 'utf8').includes(`Server listening on 127.0.0.1 port ${port}.`)));
+});
+
+test('row 280: every injected picker sample is unprivileged and outside the ephemeral range', () => {
+ const [lo, hi] = ephemeralRange();
+ for (const sample of [0, 0.25, 0.5, 0.6384, 0.75, 0.999999]) {
+ const port = pickPort(() => sample);
+ assert.ok(port >= 1024 && port <= 65535);
+ assert.ok(port < lo || port > hi, `sample ${sample}: ${port} inside ${lo}-${hi}`);
+ }
+});
+
async function setup(t, opts = {}) {
const dir = mkdtempSync(join(tmpdir(), 'g235x-'));
t.after(() => rmSync(dir, { recursive: true, force: true }));
diff --git a/packages/bus/tests/host-run.test.mjs b/packages/bus/tests/host-run.test.mjs
index 6f5949b5c..f7eebd45e 100644
--- a/packages/bus/tests/host-run.test.mjs
+++ b/packages/bus/tests/host-run.test.mjs
@@ -4,7 +4,7 @@
import test from 'node:test';
import assert from 'node:assert/strict';
import { execFileSync, spawn } from 'node:child_process';
-import { connect, createServer } from 'node:net';
+import { createServer } from 'node:net';
import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
import { tmpdir, userInfo } from 'node:os';
import { join } from 'node:path';
@@ -19,6 +19,8 @@ import { hostGrant } from '../src/host-grant.mjs';
import { startBroker } from '../src/runtime.mjs';
import { businessDoc, rolesCopy, systemFor, writeJson } from '../../business/tests/helpers.mjs';
+import { ephemeralRange, installSleepStub, pickPort, startScratchSshd } from './scratch-sshd.mjs';
+
const SSHD = '/usr/bin/sshd';
const REPO = fileURLToPath(new URL('../../../', import.meta.url));
const USER = userInfo().username;
@@ -50,22 +52,18 @@ async function until(fn, ms = 5000) {
}
return true;
}
-const listening = (port) =>
- new Promise((resolve) => {
- const s = connect(port, '127.0.0.1');
- s.on('connect', () => (s.destroy(), resolve(true)));
- s.on('error', () => resolve(false));
- });
+
// A scratch sshd. ForceCommand puts the fake sudo first on PATH and hands the command to /bin/sh, so
// the remote side parses the command line the way a real host's POSIX shell does.
-async function sshd(t, dir) {
+async function sshd(t, dir, options) {
if (!existsSync(SSHD)) throw new Error(`${SSHD} is missing: the executor tests need it and fail, never skip`);
keygen(join(dir, 'hostkey'));
keygen(join(dir, 'otherhost'));
keygen(join(dir, 'user'));
writeFileSync(join(dir, 'authorized_keys'), readFileSync(join(dir, 'user.pub')), { mode: 0o600 });
mkdirSync(join(dir, 'fake'));
+ installSleepStub(dir);
writeFileSync(
join(dir, 'fake', 'sudo'),
`#!/bin/sh\n'${process.execPath}' -e 'require("fs").appendFileSync(process.argv[1], JSON.stringify(process.argv.slice(2)) + "\\n")' '${dir}/argv.json' "$@"\nshift 2\nexec "$@"\n`,
@@ -75,26 +73,42 @@ async function sshd(t, dir) {
writeFileSync(join(dir, 'fake', 'fail255'), '#!/bin/sh\necho "Host key verification failed." >&2\nexit 255\n', { mode: 0o755 });
writeFileSync(join(dir, 'wrap.sh'), `#!/bin/sh\nPATH=${dir}/fake:/usr/bin:/bin; export PATH\nexec /bin/sh -c "$SSH_ORIGINAL_COMMAND"\n`);
chmodSync(join(dir, 'wrap.sh'), 0o755);
- for (let attempt = 0; attempt < 5; attempt++) {
- const port = 20000 + Math.floor(Math.random() * 20000);
- writeFileSync(
- join(dir, 'sshd_config'),
- [`Port ${port}`, 'ListenAddress 127.0.0.1', `HostKey ${dir}/hostkey`, `AuthorizedKeysFile ${dir}/authorized_keys`,
- `PidFile ${dir}/sshd.pid`, 'UsePAM no', 'StrictModes no', 'PasswordAuthentication no', 'KbdInteractiveAuthentication no',
- `ForceCommand ${dir}/wrap.sh`, ''].join('\n'),
- );
- const daemon = spawn(SSHD, ['-D', '-f', join(dir, 'sshd_config'), '-E', join(dir, 'sshd.log')], { stdio: 'ignore' });
- t.after(() => daemon.kill('SIGKILL'));
- const deadline = Date.now() + 3000;
- while (Date.now() < deadline && daemon.exitCode === null) {
- if (await listening(port)) return port;
- await sleep(30);
- }
- daemon.kill('SIGKILL');
- }
- throw new Error('scratch sshd did not start');
+ return startScratchSshd(t, dir, [
+ 'ListenAddress 127.0.0.1', `HostKey ${dir}/hostkey`,
+ `AuthorizedKeysFile ${dir}/authorized_keys`, `PidFile ${dir}/sshd.pid`,
+ 'UsePAM no', 'StrictModes no', 'PasswordAuthentication no', 'KbdInteractiveAuthentication no',
+ `ForceCommand ${dir}/wrap.sh`,
+ ], options);
}
+
+test('row 280: an occupied TCP port is attempted, refused, and retried with our sshd', async t => {
+ const dir = mkdtempSync(join(tmpdir(), 'sshd280-'));
+ t.after(() => rmSync(dir, { recursive: true, force: true }));
+ const server = createServer(socket => socket.end());
+ await new Promise((resolve, reject) => {
+ server.once('error', reject);
+ server.listen(0, '127.0.0.1', resolve);
+ });
+ t.after(() => new Promise(resolve => server.close(resolve)));
+ const occupied = server.address().port;
+ const port = await sshd(t, dir, { firstPort: occupied });
+ assert.match(readFileSync(join(dir, 'sshd-0.conf'), 'utf8'), new RegExp(`^Port ${occupied}\\n`));
+ assert.equal(readFileSync(join(dir, 'sshd-0.log'), 'utf8').includes(`Server listening on 127.0.0.1 port ${occupied}.`), false);
+ assert.notEqual(port, occupied);
+ assert.ok([1, 2, 3, 4].some(n => existsSync(join(dir, `sshd-${n}.log`)) &&
+ readFileSync(join(dir, `sshd-${n}.log`), 'utf8').includes(`Server listening on 127.0.0.1 port ${port}.`)));
+});
+
+test('row 280: every injected picker sample is unprivileged and outside the ephemeral range', () => {
+ const [lo, hi] = ephemeralRange();
+ for (const sample of [0, 0.25, 0.5, 0.6384, 0.75, 0.999999]) {
+ const port = pickPort(() => sample);
+ assert.ok(port >= 1024 && port <= 65535);
+ assert.ok(port < lo || port > hi, `sample ${sample}: ${port} inside ${lo}-${hi}`);
+ }
+});
+
const GRANT = [['true'], ['false'], ['echo'], ['sleep'], ['head'], ['cat'], ['systemctl', 'status']];
async function hostFixture(t, { commands = GRANT, reviewerHosts, wrongHostKey = false, coderWeb2 = false } = {}) {
const dir = mkdtempSync(join(tmpdir(), 'h210-'));
diff --git a/packages/bus/tests/scratch-sshd.mjs b/packages/bus/tests/scratch-sshd.mjs
new file mode 100644
index 000000000..2dde26de3
--- /dev/null
+++ b/packages/bus/tests/scratch-sshd.mjs
@@ -0,0 +1,88 @@
+// Row 280: fixture-only sshd startup. A TCP connect alone does not prove ownership.
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { connect } from 'node:net';
+import { basename, join } from 'node:path';
+
+export const ephemeralRange = () => {
+ const text = readFileSync('/proc/sys/net/ipv4/ip_local_port_range', 'utf8').trim();
+ if (!/^\d+\s+\d+$/.test(text)) throw Error('invalid ephemeral port range');
+ const range = text.split(/\s+/).map(Number);
+ if (range[0] < 1 || range[1] > 65535 || range[0] > range[1]) throw Error('invalid ephemeral port range');
+ return range;
+};
+
+export function pickPort(rand = Math.random) {
+ const [lo, hi] = ephemeralRange();
+ const below = Math.max(0, Math.min(lo, 65536) - 1024);
+ const above = Math.max(0, 65535 - Math.max(hi, 1023));
+ const sample = rand();
+ if (!below && !above) throw Error('no scratch sshd port available');
+ if (!(sample >= 0 && sample < 1)) throw Error('invalid random sample');
+ const offset = Math.floor(sample * (below + above));
+ return offset < below ? 1024 + offset : Math.max(hi + 1, 1024) + offset - below;
+}
+
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+const listening = port => new Promise(resolve => {
+ const socket = connect(port, '127.0.0.1');
+ const done = result => { socket.destroy(); resolve(result); };
+ socket.setTimeout(200, () => done(false));
+ socket.on('connect', () => done(true));
+ socket.on('error', () => done(false));
+});
+const stop = async daemon => {
+ if (daemon.pid === undefined || daemon.exitCode !== null || daemon.signalCode !== null) return;
+ const exited = once(daemon, 'exit');
+ daemon.kill('SIGKILL');
+ await exited;
+};
+
+export async function startScratchSshd(t, dir, config, { firstPort } = {}) {
+ let lastLog;
+ for (let attempt = 0; attempt < 5; attempt++) {
+ const port = attempt === 0 && firstPort !== undefined ? firstPort : pickPort();
+ const configFile = join(dir, `sshd-${attempt}.conf`);
+ lastLog = join(dir, `sshd-${attempt}.log`);
+ writeFileSync(configFile, [`Port ${port}`, ...config, ''].join('\n'));
+ writeFileSync(lastLog, '');
+ const daemon = spawn('/usr/bin/sshd', ['-D', '-f', configFile, '-E', lastLog], { stdio: 'ignore' });
+ t.after(() => stop(daemon));
+ const saveLog = () => {
+ if (!process.env.MOSAIC_SSHD_EVIDENCE) return;
+ const evidence = join(process.env.MOSAIC_SSHD_EVIDENCE, basename(dir));
+ mkdirSync(evidence, { recursive: true });
+ writeFileSync(join(evidence, basename(lastLog)), readFileSync(lastLog));
+ writeFileSync(join(evidence, basename(configFile)), readFileSync(configFile));
+ };
+ let spawnError;
+ daemon.on('error', error => { spawnError = error; });
+ const deadline = Date.now() + 3000;
+ while (Date.now() < deadline && !spawnError && daemon.exitCode === null && daemon.signalCode === null) {
+ if (await listening(port) && daemon.exitCode === null && daemon.signalCode === null &&
+ readFileSync(lastLog, 'utf8').split('\n').some(line =>
+ (line === `Server listening on 127.0.0.1 port ${port}.` ||
+ line === `Server listening on 127.0.0.1 port ${port}.\r`))) { saveLog(); return port; }
+ await sleep(30);
+ }
+ await stop(daemon);
+ saveLog();
+ }
+ throw Error(`scratch sshd did not start: ${lastLog}`);
+}
+
+// Long remote sleeps remain in flight for their original duration, but cannot outlive the fixture.
+export function installSleepStub(dir) {
+ const script = `const fs = require("node:fs");
+const end = Date.now() + Number(process.argv[2]) * 1000;
+const timer = setInterval(() => {
+ if (!fs.existsSync(process.argv[1]) || Date.now() >= end) { clearInterval(timer); }
+}, 50);`;
+ writeFileSync(join(dir, 'fake', 'sleep'), `#!/bin/sh
+case "$#:$1" in
+ 1:30|1:60) exec '${process.execPath}' -e '${script}' '${dir}' "$1" ;;
+ *) exec /usr/bin/sleep "$@" ;;
+esac
+`, { mode: 0o755 });
+}
Reference in new issue View Git Blame Copy Permalink