mathiasandClaude Opus 5.5
b6f7dac46e
Option 1 of #157, slice 2. readExcerpt (brain_context), api.ReadNote (brain_get / read-after-write) and notes.ReadScoped (brain_read) read the Syncthing-shared brain by path. Under a symlink swap race each leaked an outside file hundreds of thousands of times in 1.5s, including brain_read, whose Lstat check was raced by the reopen-by-name; a FIFO blocked os.ReadFile. - All three read through brainfs (os.Root, regular files only, non-blocking open, type check on the handle). - brainfs.ReadRegularMax checks a size limit on the opened handle; notes keeps its ErrTooLarge. - New internal/brainfs/brainfstest: the shared swap-race harness (symlink and held-writer FIFO swappers, awaited before TempDir cleanup; AssertNoLeak / AssertNoHang) for this and later slices. Tests red first: each reader under a symlink-swap race and a held-writer FIFO race, plus static checks. Flipped: readExcerpt back to os.ReadFile is red. Refs #157 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
103 lines
2.9 KiB
Go
103 lines
2.9 KiB
Go
// Package brainfstest is the shared harness for hyperguild#157's behavioural
|
|
// confinement tests: it keeps swapping a regular note, a symlink to an
|
|
// outside file, or a FIFO (with a writer held open) into a path while a
|
|
// reader under test loops. A reader is confined if no sentinel byte ever
|
|
// reaches its output and it never hangs.
|
|
package brainfstest
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync"
|
|
"sync/atomic"
|
|
"syscall"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// Sentinel marks the outside file's contents.
|
|
const Sentinel = "zqbrainfssentinelonefiftyseven"
|
|
|
|
// Outside writes a file outside any brain dir containing Sentinel.
|
|
func Outside(t *testing.T) string {
|
|
t.Helper()
|
|
p := filepath.Join(t.TempDir(), "secret.md")
|
|
if err := os.WriteFile(p, []byte("# secret\n\n"+Sentinel), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return p
|
|
}
|
|
|
|
// StartSwap renames, in a loop, a regular note (content inside) and either
|
|
// a symlink to outside or a FIFO into path, until the test ends. FIFOs get a
|
|
// writer held open until the swapper exits, so a reader that skips the
|
|
// handle check parks forever instead of reading EOF. The swapper is stopped
|
|
// and awaited before t.TempDir cleanup.
|
|
func StartSwap(t *testing.T, path, inside, outside string, fifo bool) {
|
|
t.Helper()
|
|
var stop atomic.Bool
|
|
var wg sync.WaitGroup
|
|
wg.Add(1)
|
|
go func() {
|
|
defer wg.Done()
|
|
tmp := path + ".swap"
|
|
var writers []*os.File
|
|
defer func() {
|
|
for _, w := range writers {
|
|
_ = w.Close()
|
|
}
|
|
}()
|
|
for i := 0; !stop.Load(); i++ {
|
|
_ = os.Remove(tmp)
|
|
switch {
|
|
case i%2 == 0:
|
|
_ = os.WriteFile(tmp, []byte(inside), 0o644)
|
|
case fifo:
|
|
if err := syscall.Mkfifo(tmp, 0o644); err == nil {
|
|
if w, err := os.OpenFile(tmp, os.O_RDWR, 0); err == nil {
|
|
writers = append(writers, w)
|
|
}
|
|
}
|
|
default:
|
|
_ = os.Symlink(outside, tmp)
|
|
}
|
|
_ = os.Rename(tmp, path)
|
|
}
|
|
}()
|
|
t.Cleanup(func() { stop.Store(true); wg.Wait() })
|
|
}
|
|
|
|
// AssertNoLeak loops read for d while a symlink swapper runs on path, and
|
|
// fails if any output contains Sentinel.
|
|
func AssertNoLeak(t *testing.T, path, inside string, d time.Duration, read func() string) {
|
|
t.Helper()
|
|
StartSwap(t, path, inside, Outside(t), false)
|
|
leaks, iters := 0, 0
|
|
for deadline := time.Now().Add(d); time.Now().Before(deadline); iters++ {
|
|
leaks += strings.Count(read(), Sentinel)
|
|
}
|
|
if leaks > 0 {
|
|
t.Fatalf("outside file leaked %d times in %d iterations", leaks, iters)
|
|
}
|
|
}
|
|
|
|
// AssertNoHang loops read for d while a FIFO swapper (held writers) runs on
|
|
// path, and fails if a read does not return within timeout.
|
|
func AssertNoHang(t *testing.T, path, inside string, d, timeout time.Duration, read func()) {
|
|
t.Helper()
|
|
StartSwap(t, path, inside, Outside(t), true)
|
|
done := make(chan struct{})
|
|
go func() {
|
|
for deadline := time.Now().Add(d); time.Now().Before(deadline); {
|
|
read()
|
|
}
|
|
close(done)
|
|
}()
|
|
select {
|
|
case <-done:
|
|
case <-time.After(timeout):
|
|
t.Fatal("reader hung on a swapped-in FIFO with a writer held open")
|
|
}
|
|
}
|