| 1 | //go:build linux |
| 2 | |
| 3 | package activator |
| 4 | |
| 5 | import ( |
| 6 | "context" |
| 7 | "os" |
| 8 | "path/filepath" |
| 9 | "testing" |
| 10 | ) |
| 11 | |
| 12 | // PurgeSeedLocal is the import rollback's local removal (preflight M12): |
| 13 | // Plan 4's purge, so it covers the seed fetch leftovers (a copy of the |
| 14 | // customer database) and goes through instancefs. It leaves anything else |
| 15 | // in the directory, is idempotent, and is done for a directory that is |
| 16 | // not there. |
| 17 | func TestPurgeSeedLocalRemovesTheDatabaseAndEverythingThatStandsInForIt(t *testing.T) { |
| 18 | dir := filepath.Join(t.TempDir(), "instances", "shop") |
| 19 | if err := os.MkdirAll(dir, 0o700); err != nil { |
| 20 | t.Fatal(err) |
| 21 | } |
| 22 | db := filepath.Join(dir, "a.shop.example.com.db") |
| 23 | gone := []string{db, db + "-wal", db + "-shm", db + SeedMarkerSuffix, |
| 24 | filepath.Join(dir, ".seed-sd_aaaaaaaaaaaaaaaaaaaaaaaaaa.tmp")} |
| 25 | for _, p := range gone { |
| 26 | if err := os.WriteFile(p, []byte("x"), 0o600); err != nil { |
| 27 | t.Fatal(err) |
| 28 | } |
| 29 | } |
| 30 | for _, d := range []string{db + "-litestream", filepath.Join(dir, ".activator-a.shop.example.com.db-litestream")} { |
| 31 | if err := os.MkdirAll(filepath.Join(d, "generations"), 0o700); err != nil { |
| 32 | t.Fatal(err) |
| 33 | } |
| 34 | gone = append(gone, d) |
| 35 | } |
| 36 | kept := filepath.Join(dir, "uploads") |
| 37 | if err := os.WriteFile(kept, []byte("keep"), 0o600); err != nil { |
| 38 | t.Fatal(err) |
| 39 | } |
| 40 | for i := 0; i < 2; i++ { |
| 41 | if err := PurgeSeedLocal(db); err != nil { |
| 42 | t.Fatalf("run %d: %v", i, err) |
| 43 | } |
| 44 | } |
| 45 | for _, p := range gone { |
| 46 | if _, err := os.Lstat(p); !os.IsNotExist(err) { |
| 47 | t.Errorf("%s survived", p) |
| 48 | } |
| 49 | } |
| 50 | if _, err := os.Stat(kept); err != nil { |
| 51 | t.Fatalf("an unrelated file went: %v", err) |
| 52 | } |
| 53 | if err := PurgeSeedLocal(filepath.Join(t.TempDir(), "missing", "a.shop.example.com.db")); err != nil { |
| 54 | t.Fatalf("a missing directory: %v", err) |
| 55 | } |
| 56 | for _, bad := range []string{"a.shop.example.com.db", "/data/instances/x/../a.db", "/data/instances/x/"} { |
| 57 | if err := PurgeSeedLocal(bad); err == nil { |
| 58 | t.Errorf("%q: no error", bad) |
| 59 | } |
| 60 | } |
| 61 | } |
| 62 | |
| 63 | // A symlink at the database's name is removed as a link; its target stays. |
| 64 | func TestPurgeSeedLocalNeverFollowsASymlink(t *testing.T) { |
| 65 | root := t.TempDir() |
| 66 | dir := filepath.Join(root, "instance") |
| 67 | if err := os.MkdirAll(dir, 0o700); err != nil { |
| 68 | t.Fatal(err) |
| 69 | } |
| 70 | target := filepath.Join(root, "elsewhere.db") |
| 71 | if err := os.WriteFile(target, []byte("someone else's"), 0o600); err != nil { |
| 72 | t.Fatal(err) |
| 73 | } |
| 74 | db := filepath.Join(dir, "a.shop.example.com.db") |
| 75 | if err := os.Symlink(target, db); err != nil { |
| 76 | t.Fatal(err) |
| 77 | } |
| 78 | if err := PurgeSeedLocal(db); err != nil { |
| 79 | t.Fatal(err) |
| 80 | } |
| 81 | if _, err := os.Lstat(db); !os.IsNotExist(err) { |
| 82 | t.Fatal("the link survived") |
| 83 | } |
| 84 | if b, err := os.ReadFile(target); err != nil || string(b) != "someone else's" { |
| 85 | t.Fatalf("the link's target was touched: %q %v", b, err) |
| 86 | } |
| 87 | } |
| 88 | |
| 89 | // Fix round 1, I1, the activator half: an aborted import's database left at |
| 90 | // a host's nested path is what a later plain instance at the host wakes |
| 91 | // on. After PurgeSeedLocal the wake finds no file and comes up fresh. Left |
| 92 | // there, its <db>.seed marker names a seed the plain row does not, so the |
| 93 | // wake purges it and comes up fresh all the same (final review F2b). |
| 94 | func TestAPlainWakeAfterPurgeSeedLocalFindsNoDatabase(t *testing.T) { |
| 95 | for _, purge := range []bool{false, true} { |
| 96 | b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{}) |
| 97 | if err := os.MkdirAll(filepath.Dir(rt.DBPath), 0o700); err != nil { |
| 98 | t.Fatal(err) |
| 99 | } |
| 100 | for _, f := range []string{rt.DBPath, rt.DBPath + "-wal", rt.DBPath + SeedMarkerSuffix} { |
| 101 | if err := os.WriteFile(f, []byte("an aborted import's data"), 0o600); err != nil { |
| 102 | t.Fatal(err) |
| 103 | } |
| 104 | } |
| 105 | if purge { |
| 106 | if err := PurgeSeedLocal(rt.DBPath); err != nil { |
| 107 | t.Fatal(err) |
| 108 | } |
| 109 | } |
| 110 | oldRestore := restoreReplica |
| 111 | restoreReplica = func(context.Context, string, string, string, string) (bool, error) { return false, nil } |
| 112 | fresh, err := b.Restore(context.Background(), rt) // a plain row: no seed column |
| 113 | restoreReplica = oldRestore |
| 114 | if err != nil || !fresh { |
| 115 | t.Fatalf("purge %v: fresh %v err %v", purge, fresh, err) |
| 116 | } |
| 117 | if _, err := os.Lstat(rt.DBPath); !os.IsNotExist(err) { |
| 118 | t.Fatalf("the wake found a database at %s", rt.DBPath) |
| 119 | } |
| 120 | } |
| 121 | } |
| 122 | |
| 123 | // Fix round 2: the marker beside a database is read through instancefs. |
| 124 | // It names a seed, or names none (absent, a symlink, a directory, no |
| 125 | // instance directory), or cannot be read (an error). |
| 126 | func TestReadSeedMarker(t *testing.T) { |
| 127 | dir := filepath.Join(t.TempDir(), "instance") |
| 128 | if err := os.MkdirAll(dir, 0o700); err != nil { |
| 129 | t.Fatal(err) |
| 130 | } |
| 131 | db := filepath.Join(dir, "a.shop.example.com.db") |
| 132 | marker := db + SeedMarkerSuffix |
| 133 | check := func(name, want string, wantErr bool) { |
| 134 | t.Helper() |
| 135 | got, err := ReadSeedMarker(db) |
| 136 | if got != want || (err != nil) != wantErr { |
| 137 | t.Fatalf("%s: %q, %v; want %q, error %v", name, got, err, want, wantErr) |
| 138 | } |
| 139 | } |
| 140 | check("no marker", "", false) |
| 141 | if err := os.WriteFile(marker, []byte("sd_aaaaaaaaaaaaaaaaaaaaaaaaaa\n"), 0o600); err != nil { |
| 142 | t.Fatal(err) |
| 143 | } |
| 144 | check("a marker", "sd_aaaaaaaaaaaaaaaaaaaaaaaaaa", false) |
| 145 | os.Remove(marker) |
| 146 | target := filepath.Join(t.TempDir(), "elsewhere") |
| 147 | os.WriteFile(target, []byte("sd_bbbbbbbbbbbbbbbbbbbbbbbbbb"), 0o600) |
| 148 | if err := os.Symlink(target, marker); err != nil { |
| 149 | t.Fatal(err) |
| 150 | } |
| 151 | check("a symlinked marker", "", false) |
| 152 | os.Remove(marker) |
| 153 | if err := os.Mkdir(marker, 0o700); err != nil { |
| 154 | t.Fatal(err) |
| 155 | } |
| 156 | check("a directory at the marker", "", false) |
| 157 | os.Remove(marker) |
| 158 | if got, err := ReadSeedMarker(filepath.Join(t.TempDir(), "gone", "a.db")); got != "" || err != nil { |
| 159 | t.Fatalf("no instance directory: %q %v", got, err) |
| 160 | } |
| 161 | if os.Getuid() != 0 { |
| 162 | if err := os.WriteFile(marker, []byte("sd_aaaaaaaaaaaaaaaaaaaaaaaaaa"), 0o600); err != nil { |
| 163 | t.Fatal(err) |
| 164 | } |
| 165 | if err := os.Chmod(dir, 0o000); err != nil { |
| 166 | t.Fatal(err) |
| 167 | } |
| 168 | t.Cleanup(func() { os.Chmod(dir, 0o700) }) |
| 169 | check("an unreadable directory", "", true) |
| 170 | } |
| 171 | if _, err := ReadSeedMarker("relative.db"); err == nil { |
| 172 | t.Fatal("a relative path read") |
| 173 | } |
| 174 | } |
| 175 | |
amadan