| 1 | //go:build unix |
| 2 | |
| 3 | package hostbox |
| 4 | |
| 5 | import ( |
| 6 | "context" |
| 7 | "database/sql" |
| 8 | "errors" |
| 9 | "os" |
| 10 | "path/filepath" |
| 11 | "testing" |
| 12 | |
| 13 | "github.com/carlosframework/platform/internal/hostclaim" |
| 14 | "github.com/carlosframework/platform/internal/hostguard" |
| 15 | "github.com/carlosframework/platform/internal/registry" |
| 16 | ) |
| 17 | |
| 18 | // sourceRows is relocationReconciler with Task 10b's production hooks: the |
| 19 | // host guard's admission fence (AdmissionFenceClosed) and the registry |
| 20 | // hold write (RegistryHoldRow), over a registry holding the source's ready |
| 21 | // row, owned by the installation the guard has active. |
| 22 | func sourceRows(t *testing.T) (Reconciler, RecordSelection, *registry.Registry, hostguard.Guard) { |
| 23 | t.Helper() |
| 24 | r, selected, _, guard := relocationReconciler(t) |
| 25 | reg, err := registry.Open(filepath.Join(t.TempDir(), "registry.db")) |
| 26 | if err != nil { |
| 27 | t.Fatal(err) |
| 28 | } |
| 29 | t.Cleanup(func() { reg.Close() }) |
| 30 | captured, err := hostguard.Capture(guard.DataDir, selected.Host) |
| 31 | if err != nil { |
| 32 | t.Fatal(err) |
| 33 | } |
| 34 | owner := registry.ClaimOwnership{ClaimIncarnation: captured.Incarnation, ClaimStamp: captured.Stamp, ClaimOwner: "owner-1", ClaimRowID: "row-1"} |
| 35 | if err := reg.Upsert(registry.Route{Host: selected.Host, Status: "ready", Socket: "/run/shop.sock", ClaimOwnership: owner}); err != nil { |
| 36 | t.Fatal(err) |
| 37 | } |
| 38 | r.FenceClosed, r.HoldRow = AdmissionFenceClosed(guard), RegistryHoldRow(reg) |
| 39 | return r, selected, reg, guard |
| 40 | } |
| 41 | |
| 42 | // closeSourceFence is root beginning the source's stop for the op: the |
| 43 | // durable admission fence in the guard record (BeginFence). |
| 44 | func closeSourceFence(t *testing.T, r Reconciler, selected RecordSelection, guard hostguard.Guard) { |
| 45 | t.Helper() |
| 46 | ctx := context.Background() |
| 47 | captured, err := hostguard.Capture(guard.DataDir, selected.Host) |
| 48 | if err != nil { |
| 49 | t.Fatal(err) |
| 50 | } |
| 51 | obs, err := hostclaim.Read(ctx, r.Claims, selected.Host) |
| 52 | if err != nil { |
| 53 | t.Fatal(err) |
| 54 | } |
| 55 | target := hostguard.FenceTarget{FenceID: "fence-1", Host: selected.Host, Incarnation: captured.Incarnation, Stamp: captured.Stamp, Session: obs.Claim.Holder.Session, |
| 56 | Op: "rel-1", Phase: hostclaim.PhaseReleasing, Box: "box", Enrollment: "enrollment-1", BootID: "boot", ControllerID: "ctl", ClaimETag: obs.ETag, DirectoryRevision: "4"} |
| 57 | if _, err := guard.BeginFence(ctx, target); err != nil { |
| 58 | t.Fatal(err) |
| 59 | } |
| 60 | } |
| 61 | |
| 62 | func rowOf(t *testing.T, reg *registry.Registry, host string) *registry.Route { |
| 63 | t.Helper() |
| 64 | row, err := reg.Get(host) |
| 65 | if err != nil { |
| 66 | t.Fatal(err) |
| 67 | } |
| 68 | return row |
| 69 | } |
| 70 | |
| 71 | // Task 10b test 1 (R5-3): during releasing the source's row is unchanged |
| 72 | // until this box's admission fence for the host closes; reconcile then |
| 73 | // holds it for the op in "relocating", a status the edge never serves, |
| 74 | // with every other column as it was, its claim ownership included. A dry |
| 75 | // run writes nothing, an unreadable fence is an error with the row left |
| 76 | // as it was, never "open", and with no hold-only local check (CheckHeld) |
| 77 | // nothing is held. |
| 78 | func TestReconcileHoldsTheSourcesRowAtItsFencesClose(t *testing.T) { |
| 79 | r, selected, reg, guard := sourceRows(t) |
| 80 | ctx := context.Background() |
| 81 | obs := relocate(t, r, selected.Host, hostclaim.PhaseReleasing) |
| 82 | before := *rowOf(t, reg, selected.Host) |
| 83 | writes := 0 |
| 84 | for _, dry := range []bool{true, false} { |
| 85 | sel := selected |
| 86 | sel.DryRun = dry |
| 87 | if err := r.Install(ctx, sel, func() error { writes++; return nil }); !errors.Is(err, ErrChanged) { |
| 88 | t.Fatalf("the source before its fence closed (dry run %v): %v", dry, err) |
| 89 | } |
| 90 | } |
| 91 | if got := rowOf(t, reg, selected.Host); writes != 0 || *got != before { |
| 92 | t.Fatalf("before the fence closed: writes %d row %+v (want %+v)", writes, got, before) |
| 93 | } |
| 94 | if now, err := hostclaim.Read(ctx, r.Claims, selected.Host); err != nil || now.ETag != obs.ETag { |
| 95 | t.Fatalf("the claim was written before the fence closed: %v", err) |
| 96 | } |
| 97 | // An unreadable fence is an error, never "open": the row stays. |
| 98 | record := filepath.Join(guard.DataDir, "hostguard", selected.Host+".json") |
| 99 | if err := os.Rename(record, record+".away"); err != nil { |
| 100 | t.Fatal(err) |
| 101 | } |
| 102 | if err := r.Install(ctx, selected, func() error { writes++; return nil }); err == nil || errors.Is(err, ErrChanged) { |
| 103 | t.Fatalf("an unreadable fence: %v (want the read's error)", err) |
| 104 | } |
| 105 | if err := os.Rename(record+".away", record); err != nil { |
| 106 | t.Fatal(err) |
| 107 | } |
| 108 | if got := rowOf(t, reg, selected.Host); writes != 0 || *got != before { |
| 109 | t.Fatalf("an unreadable fence changed the row: %+v", got) |
| 110 | } |
| 111 | closeSourceFence(t, r, selected, guard) |
| 112 | dry := selected |
| 113 | dry.DryRun = true |
| 114 | if err := r.Install(ctx, dry, func() error { writes++; return nil }); err != nil { |
| 115 | t.Fatalf("the fenced source's dry run: %v", err) |
| 116 | } |
| 117 | if got := rowOf(t, reg, selected.Host); *got != before { |
| 118 | t.Fatalf("a dry run held the row: %+v", got) |
| 119 | } |
| 120 | // The hold-only path's local check is required: without it nothing |
| 121 | // is held. |
| 122 | checkHeld := r.CheckHeld |
| 123 | r.CheckHeld = nil |
| 124 | if err := r.Install(ctx, selected, func() error { writes++; return nil }); !errors.Is(err, ErrUnsupported) { |
| 125 | t.Fatalf("no hold-only check: %v", err) |
| 126 | } |
| 127 | if got := rowOf(t, reg, selected.Host); *got != before { |
| 128 | t.Fatalf("a hold without its local check: %+v", got) |
| 129 | } |
| 130 | r.CheckHeld = checkHeld |
| 131 | if err := r.Install(ctx, selected, func() error { writes++; return nil }); err != nil { |
| 132 | t.Fatalf("the fenced source's hold: %v", err) |
| 133 | } |
| 134 | got := rowOf(t, reg, selected.Host) |
| 135 | if writes != 0 || got.Status != "relocating" || got.HoldOp != "rel-1" || !registry.IsHold(got.Status) { |
| 136 | t.Fatalf("after the fence closed: writes %d row %+v", writes, got) |
| 137 | } |
| 138 | unheld := *got |
| 139 | unheld.Status, unheld.HoldOp = before.Status, before.HoldOp |
| 140 | if unheld != before { |
| 141 | t.Fatalf("the hold changed more than status and hold_op: %+v (was %+v)", got, before) |
| 142 | } |
| 143 | } |
| 144 | |
| 145 | // Task 10b test 2: the hold write never takes a row another op holds, a |
| 146 | // replay changes nothing, a missing row is not minted, and an unreadable |
| 147 | // row is an error, never "held". Through the reconciler, a fenced source |
| 148 | // whose row another op holds is refused with the row as it was. |
| 149 | func TestReconcileSourceHoldNeverTakesAnotherOpsRow(t *testing.T) { |
| 150 | r, selected, reg, guard := sourceRows(t) |
| 151 | ctx := context.Background() |
| 152 | hold := RegistryHoldRow(reg) |
| 153 | relocate(t, r, selected.Host, hostclaim.PhaseReleasing) |
| 154 | closeSourceFence(t, r, selected, guard) |
| 155 | |
| 156 | if ok, err := reg.SetHoldIf(selected.Host, "moving", "mv-9", ""); err != nil || !ok { |
| 157 | t.Fatalf("another op's hold: %v %v", ok, err) |
| 158 | } |
| 159 | other := *rowOf(t, reg, selected.Host) |
| 160 | if err := hold(ctx, selected.Host, "rel-1"); !errors.Is(err, ErrChanged) { |
| 161 | t.Fatalf("another op's row: %v", err) |
| 162 | } |
| 163 | if err := r.Install(ctx, selected, func() error { return nil }); !errors.Is(err, ErrChanged) { |
| 164 | t.Fatalf("reconcile over another op's row: %v", err) |
| 165 | } |
| 166 | if got := rowOf(t, reg, selected.Host); *got != other { |
| 167 | t.Fatalf("another op's row was taken: %+v (was %+v)", got, other) |
| 168 | } |
| 169 | if ok, err := reg.ReleaseHold(selected.Host, "mv-9"); err != nil || !ok { |
| 170 | t.Fatalf("release the other op's hold: %v %v", ok, err) |
| 171 | } |
| 172 | |
| 173 | if err := r.Install(ctx, selected, func() error { return nil }); err != nil { |
| 174 | t.Fatalf("the hold: %v", err) |
| 175 | } |
| 176 | held := *rowOf(t, reg, selected.Host) |
| 177 | for i := 0; i < 2; i++ { |
| 178 | if err := hold(ctx, selected.Host, "rel-1"); err != nil { |
| 179 | t.Fatalf("a replay of the write: %v", err) |
| 180 | } |
| 181 | if err := r.Install(ctx, selected, func() error { return nil }); err != nil { |
| 182 | t.Fatalf("a replay through reconcile: %v", err) |
| 183 | } |
| 184 | if got := rowOf(t, reg, selected.Host); *got != held { |
| 185 | t.Fatalf("a replay changed the row: %+v (was %+v)", got, held) |
| 186 | } |
| 187 | } |
| 188 | |
| 189 | if err := hold(ctx, "absent.example", "rel-1"); !errors.Is(err, ErrChanged) { |
| 190 | t.Fatalf("no row: %v", err) |
| 191 | } |
| 192 | if got := rowOf(t, reg, "absent.example"); got != nil { |
| 193 | t.Fatalf("the hold minted a row: %+v", got) |
| 194 | } |
| 195 | if err := reg.Close(); err != nil { |
| 196 | t.Fatal(err) |
| 197 | } |
| 198 | if err := hold(ctx, selected.Host, "rel-1"); err == nil || errors.Is(err, ErrChanged) { |
| 199 | t.Fatalf("an unreadable row: %v (want the read's error)", err) |
| 200 | } |
| 201 | } |
| 202 | |
| 203 | // RegistryHoldRow reads the row unheld, but another op holds it before |
| 204 | // the conditional write lands: SetHoldIf matches nothing and answers |
| 205 | // false. That is never a hold: the write is ErrChanged, the other op's |
| 206 | // hold is left as it is, and the next attempt, judging afresh, refuses |
| 207 | // the other op's row too. The concurrent writer is a trigger on the |
| 208 | // registry's own database that holds the row for "mv-9" as the hold |
| 209 | // write starts and abandons that write (RAISE(IGNORE)), so the write |
| 210 | // touches nothing and counts no change. |
| 211 | func TestRegistryHoldRowRefusesARowHeldBetweenTheReadAndTheWrite(t *testing.T) { |
| 212 | ctx := context.Background() |
| 213 | path := filepath.Join(t.TempDir(), "registry.db") |
| 214 | reg, err := registry.Open(path) |
| 215 | if err != nil { |
| 216 | t.Fatal(err) |
| 217 | } |
| 218 | t.Cleanup(func() { reg.Close() }) |
| 219 | owner := registry.ClaimOwnership{ClaimIncarnation: "inc-1", ClaimStamp: 7, ClaimOwner: "owner-1", ClaimRowID: "row-1"} |
| 220 | if err := reg.Upsert(registry.Route{Host: "shop.example", Status: "ready", Socket: "/run/shop.sock", ClaimOwnership: owner}); err != nil { |
| 221 | t.Fatal(err) |
| 222 | } |
| 223 | before := *rowOf(t, reg, "shop.example") |
| 224 | db, err := sql.Open("sqlite", path) |
| 225 | if err != nil { |
| 226 | t.Fatal(err) |
| 227 | } |
| 228 | t.Cleanup(func() { db.Close() }) |
| 229 | if _, err := db.Exec(`CREATE TRIGGER concurrent_hold BEFORE UPDATE OF status, hold_op ON routes |
| 230 | WHEN NEW.status = 'relocating' AND OLD.hold_op = '' |
| 231 | BEGIN |
| 232 | UPDATE routes SET status = 'moving', hold_op = 'mv-9' WHERE host = OLD.host; |
| 233 | SELECT RAISE(IGNORE); |
| 234 | END`); err != nil { |
| 235 | t.Fatal(err) |
| 236 | } |
| 237 | hold := RegistryHoldRow(reg) |
| 238 | if err := hold(ctx, "shop.example", "rel-1"); !errors.Is(err, ErrChanged) { |
| 239 | t.Fatalf("a row held between the read and the write: %v (want ErrChanged)", err) |
| 240 | } |
| 241 | got := rowOf(t, reg, "shop.example") |
| 242 | other := before |
| 243 | other.Status, other.HoldOp = "moving", "mv-9" |
| 244 | if got == nil || *got != other { |
| 245 | t.Fatalf("after the refused write: %+v (want the other op's hold %+v)", got, other) |
| 246 | } |
| 247 | if _, err := db.Exec(`DROP TRIGGER concurrent_hold`); err != nil { |
| 248 | t.Fatal(err) |
| 249 | } |
| 250 | if err := hold(ctx, "shop.example", "rel-1"); !errors.Is(err, ErrChanged) { |
| 251 | t.Fatalf("the next attempt over the other op's row: %v (want ErrChanged)", err) |
| 252 | } |
| 253 | if got := rowOf(t, reg, "shop.example"); got == nil || *got != other { |
| 254 | t.Fatalf("the next attempt took the other op's row: %+v", got) |
| 255 | } |
| 256 | } |
| 257 | |
amadan