122 lines
5.4 KiB
Go
122 lines
5.4 KiB
Go
package backup
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// R-1214: the second-drive copy runs in a memory-capped container ONLY for paths the controller and the Docker daemon
|
|
// see identically (/mnt/…); every other path, a box with no readable image, and a container that cannot start keep the
|
|
// plain in-process rsync; an rsync failure inside the container is an error, never a silent second copy.
|
|
// RED-PROOF: with the tier2CappedPath guard removed, TestR1214_APathOutsideMntNeverGoesToDocker fails (the copy of a
|
|
// controller-volume path would go to the container, where it is an EMPTY folder and `--delete` empties the copy);
|
|
// with the capped branch removed, TestR1214_MntPathsAreCopiedCapped fails — both seen failing 2026-10-22.
|
|
type cappedRec struct{ calls [][]string }
|
|
|
|
func withSeams(t *testing.T, root string, img string, run func(args []string) ([]byte, int, error)) *cappedRec {
|
|
t.Helper()
|
|
rec := &cappedRec{}
|
|
oldRoot, oldImg, oldRun, oldLog, oldDocker := tier2CappedRoot, tier2SelfImage, tier2RunCapped, tier2Logf, tier2Docker
|
|
// The copy's lifecycle commands (rm -f by name) never reach Docker from a test (they would act on the host).
|
|
tier2Docker = func(context.Context, ...string) ([]byte, error) { return nil, nil }
|
|
tier2RetryOff = true
|
|
tier2CappedRoot = root
|
|
tier2SelfImage = func() string { return img }
|
|
tier2RunCapped = func(_ context.Context, args []string) ([]byte, int, error) {
|
|
rec.calls = append(rec.calls, args)
|
|
return run(args)
|
|
}
|
|
tier2Logf = func(string, ...any) {}
|
|
t.Cleanup(func() {
|
|
tier2CappedRoot, tier2SelfImage, tier2RunCapped, tier2Logf, tier2Docker = oldRoot, oldImg, oldRun, oldLog, oldDocker
|
|
tier2RetryOff = false
|
|
})
|
|
return rec
|
|
}
|
|
|
|
func TestR1214_MntPathsAreCopiedCapped(t *testing.T) {
|
|
root := t.TempDir() + "/"
|
|
src, dst := filepath.Join(root, "drive1", "unit"), filepath.Join(root, "drive2", "unit")
|
|
os.MkdirAll(src, 0755)
|
|
rec := withSeams(t, root, "gitea.dooplex.hu/admin/felhom-controller:9.9.9", func([]string) ([]byte, int, error) { return nil, 0, nil })
|
|
if err := rsyncMirror(src, dst); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(rec.calls) != 1 {
|
|
t.Fatalf("docker calls = %d, want 1", len(rec.calls))
|
|
}
|
|
got := strings.Join(rec.calls[0], " ")
|
|
for _, want := range []string{"run --rm", "--memory 512m", "--memory-swap 512m", "--network none", "--pull never", "--no-healthcheck",
|
|
"--mount type=bind,src=" + src + ",dst=" + src + ",readonly", "--mount type=bind,src=" + dst + ",dst=" + dst + " ",
|
|
"--entrypoint rsync gitea.dooplex.hu/admin/felhom-controller:9.9.9 -a --delete " + src + "/ " + dst + "/"} {
|
|
if !strings.Contains(got, want) {
|
|
t.Fatalf("the capped copy lacks %q:\n%s", want, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestR1214_APathOutsideMntNeverGoesToDocker(t *testing.T) {
|
|
root := t.TempDir() + "/"
|
|
other := t.TempDir() // a path the daemon would see differently (the controller's own data volume)
|
|
src, dst := filepath.Join(other, "unit"), filepath.Join(root, "drive2", "unit")
|
|
os.MkdirAll(src, 0755)
|
|
os.WriteFile(filepath.Join(src, "photo.jpg"), []byte("x"), 0644)
|
|
rec := withSeams(t, root, "img", func([]string) ([]byte, int, error) { return nil, 0, nil })
|
|
if err := rsyncMirror(src, dst); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(rec.calls) != 0 {
|
|
t.Fatalf("a path outside %s went to the container: %v", root, rec.calls)
|
|
}
|
|
if _, err := os.Stat(filepath.Join(dst, "photo.jpg")); err != nil {
|
|
t.Fatal("the plain copy did not run")
|
|
}
|
|
}
|
|
|
|
func TestR1214_ANotStartedContainerFallsBackAnRsyncErrorDoesNot(t *testing.T) {
|
|
root := t.TempDir() + "/"
|
|
src, dst := filepath.Join(root, "a", "unit"), filepath.Join(root, "b", "unit")
|
|
os.MkdirAll(src, 0755)
|
|
os.WriteFile(filepath.Join(src, "f"), []byte("x"), 0644)
|
|
withSeams(t, root, "img", func([]string) ([]byte, int, error) { return []byte("no such image"), 125, errors.New("exit 125") })
|
|
if err := rsyncMirror(src, dst); err != nil {
|
|
t.Fatalf("a container that cannot start must fall back to the plain copy: %v", err)
|
|
}
|
|
if _, err := os.Stat(filepath.Join(dst, "f")); err != nil {
|
|
t.Fatal("the fallback copy did not run")
|
|
}
|
|
withSeams(t, root, "img", func([]string) ([]byte, int, error) { return []byte("rsync error"), 23, errors.New("exit 23") })
|
|
if err := rsyncMirror(src, dst); err == nil {
|
|
t.Fatal("an rsync failure inside the container must be an error")
|
|
}
|
|
withSeams(t, root, "", func([]string) ([]byte, int, error) { t.Fatal("no image → no container"); return nil, 0, nil })
|
|
if err := rsyncMirror(src, dst); err != nil {
|
|
t.Fatalf("no readable image → the plain copy: %v", err)
|
|
}
|
|
}
|
|
|
|
// A symlink under the capped root that points elsewhere must never reach the container (the daemon would resolve it
|
|
// somewhere else, and `--delete` would mirror that over the copy) — the security review's case.
|
|
// RED-PROOF: with the EvalSymlinks check removed, this fails — seen failing 2026-10-22.
|
|
func TestR1214_ASymlinkedPathNeverGoesToDocker(t *testing.T) {
|
|
root := t.TempDir() + "/"
|
|
elsewhere := t.TempDir()
|
|
os.WriteFile(filepath.Join(elsewhere, "f"), []byte("x"), 0644)
|
|
link := filepath.Join(root, "drive1", "unit")
|
|
os.MkdirAll(filepath.Dir(link), 0755)
|
|
if err := os.Symlink(elsewhere, link); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
rec := withSeams(t, root, "img", func([]string) ([]byte, int, error) { return nil, 0, nil })
|
|
if err := rsyncMirror(link, filepath.Join(root, "drive2", "unit")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(rec.calls) != 0 {
|
|
t.Fatalf("a symlinked path went to the container: %v", rec.calls)
|
|
}
|
|
}
|