09c1011b

test: pin the reserved port range and the vfkit socket limit to real numbers

a73x 2026-08-23 11:12

Commit message

test: pin the reserved port range and the vfkit socket limit to real numbers

Every exposure test measures ports relative to MinAllocatedHostPort, so
at 80 the allocator hands out privileged ports and the suite is green;
one allocation now has to land between literal 1024 and 32767, where a
host can actually bind without colliding with the kernel's ephemeral
range. vfkit's maxSocketPath restates macOS's sockaddr_un.sun_path, so
Preflight is now driven at 103 bytes (must pass) and 104 (must refuse)
rather than asked whether it agrees with itself.

internal/agent/vfkit/vfkit_test.go

+	assert.NoError(t, p.Preflight(context.Background()))
+	// The shipped default is /var/lib/eitri-agent; a VM's socket under it is
+	// 68 bytes, so the guard must not be so tight that normal use trips it.
+	assert.Less(t, len("/var/lib/eitri-agent/vms/"+strings.Repeat("0", vmIDLen)+"/vfkit.sock"), sunPathBytes,
+		"the shipped default --state-dir must leave room for a VM's control socket inside sockaddr_un")
+}
+// sunPathBytes is macOS's sockaddr_un.sun_path, terminator included. It is a
+// literal here because it is the OS's number, not eitri's: maxSocketPath only
+// restates it, so a Preflight boundary asserted against maxSocketPath moves
+// whenever the constant does while the real bind keeps failing at 104.
+const sunPathBytes = 104
+// provWithSocketPathLen builds a Provisioner whose state directory is padded so
+// that a VM's control socket path is exactly want bytes long.
+func provWithSocketPathLen(t *testing.T, want int) *Provisioner {
+	t.Helper()
+	root, err := os.MkdirTemp("", "e")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+	probe, err := state.Open(root)
+	require.NoError(t, err)
+	base := len(New(probe, "vfkit", nil).sockPath(strings.Repeat("0", vmIDLen)))
+	pad := want - base - 1 // -1 for the separator filepath.Join adds
+	require.Positive(t, pad, "TMPDIR is already longer than the target path; run with a shorter TMPDIR")
+	dir := filepath.Join(root, strings.Repeat("d", pad))
+	require.NoError(t, os.MkdirAll(dir, 0o700))
+	st, err := state.Open(dir)
+	require.NoError(t, err)
+	p := New(st, "vfkit", nil)
+	p.lookPath = func(file string) (string, error) { return file, nil }
+	require.Len(t, p.sockPath(strings.Repeat("0", vmIDLen)), want, "harness must hit the target length exactly")
+	return p
+}
+// TestPreflightAcceptsTheLongestSocketPathThatBinds and its sibling below pin
+// the guard on the byte, from both sides. Between them they hold maxSocketPath
+// to macOS's number rather than to whatever it currently says.
+func TestPreflightAcceptsTheLongestSocketPathThatBinds(t *testing.T) {
+	p := provWithSocketPathLen(t, sunPathBytes-1)
+	assert.NoError(t, p.Preflight(context.Background()),
+		"103 bytes plus the NUL terminator is exactly sockaddr_un.sun_path (104), so this path binds — refusing it turns a "+
+			"working --state-dir away and sends an operator hunting for a shorter one that was never needed")
+}
+func TestPreflightRefusesASocketPathOneByteOverSunPath(t *testing.T) {
+	p := provWithSocketPathLen(t, sunPathBytes)
+	err := p.Preflight(context.Background())
+	require.Error(t, err,
+		"104 bytes does not fit sockaddr_un.sun_path, which is 104 INCLUDING the terminator: macOS refuses the bind, and "+
+			"raising maxSocketPath does not raise sun_path — it only moves the refusal to vfkit, after the image download, "+
+			"as a sentence about URIs")
+	assert.True(t, isPermanent(err), "a state directory does not get shorter on retry")
+	assert.Contains(t, err.Error(), "--state-dir", "the refusal must name the fix")
+// fakeRunner records the commands it is asked to run and answers from a script

internal/server/store/exposures_test.go

+	assert.NotEmpty(t, e.ID)
+// TestReservedRangeSitsWhereAHostCanBind pins the two numbers the reserved
+// range is built from, against literals rather than against themselves: every
+// other exposure test measures ports relative to MinAllocatedHostPort, so the
+// base is free to move anywhere and the suite stays green.
+func TestReservedRangeSitsWhereAHostCanBind(t *testing.T) {
+	s := newStore(t)
+	h := enrollHost(t, s)
+	vm := makeExposureVM(t, s, h, "web-1")
+	e, err := s.CreateExposure(vm.ID, 8080, 0, "tcp")
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, e.HostPort, int64(1024),
+		"an auto-allocated host port must land above the privileged range: below 1024 the agent's bind needs root and "+
+			"lands on ports the host's own sshd, DNS or web server already own, so eitri would hand a tenant's guest the "+
+			"host's front door and the bind would fail — or worse, succeed first")
+	assert.LessOrEqual(t, e.HostPort, int64(32767),
+		"and below 32768, where Linux's default ip_local_port_range begins: a reserved port inside the kernel's ephemeral "+
+			"range is one the kernel will also hand to an outbound socket, so the exposure's listener fails to bind "+
+			"intermittently, on a schedule nobody can reproduce")
+	assert.LessOrEqual(t, int64(MaxAllocatedHostPort), int64(32767),
+		"the top of the reserved range answers to the same kernel: 30000-32767 is the documented span (docs/mcp.md), and "+
+			"it stops one short of the ephemeral floor")
+}
+func TestCreateExposureAllocatesTheLowestFreePort(t *testing.T) {
+	s := newStore(t)
+	h := enrollHost(t, s)