mirror of
https://github.com/Cacti/spine.git
synced 2026-11-02 10:07:07 +09:00
develop
6
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Thomas Vincent
|
898d8c692c |
fix(privileges): drop root before input and retain owned ICMP sockets (#639)
Open and own the required ICMP sockets before permanently dropping setuid root, then parse input without elevated identity. Close-on-exec socket ownership, shared IPv4/IPv6 dispatch and fault-injected identity/capability calls are covered. The owned fixture tests check deny/allow behavior without contacting external devices. Step 2/14 of the complete C17/native-correctness series. Base: the preceding series branch; merge/review in order so this PR shows only its own step. Earlier validation, before this review follow-up, in isolated copied snapshots on Linux arm64: - Clean GCC build and make check: 13 passed, 1 existing prerequisite skips, 0 failures. - ASan/UBSan: 12 passed, 2 existing privilege/allocator-interposition prerequisite skips, 0 failures; no sanitizer findings. - Production source/profile integrity verification against disposable MariaDB and loopback SNMP fixtures passed. - Release archive extracted into a separate source tree and built/tested out of tree; fuzz checks passed. Earlier local profiles retain source hashes for the copied validation tree; GitHub checks validate the published commit. No production database/device, host installation or live privilege change is part of validation. Existing prerequisite skips were retained; no test or finding was suppressed to obtain a pass. Series navigation: [Series index](https://github.com/Cacti/spine/pull/638); [previous step](https://github.com/Cacti/spine/pull/638). [Next step](https://github.com/Cacti/spine/pull/640). Review follow-up (2026-10-09): Restacked on the corrected preceding branches. The SNMP status fix is introduced in #638, the reindex/completion fixes in #640, and focused regression coverage in #650. Restacked tip validation: isolated Linux arm64 build and make check passed (18 passed, 1 setuid prerequisite skip, no failures). GitHub checks validate the updated published commits; earlier profile/archive/sanitizer evidence above belongs to the previous revisions. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> |
||
|
Thomas Vincent
|
3065c6fc23 |
refactor(core): add bounded native interfaces and polling contracts (#638)
Introduce bounded native interfaces and grouped runtime state, then link regression and fault contracts against the real poller implementations. The contracts capture CLI/configuration input, availability combinations, SNMP request/response ownership, script framing, reindexing, output persistence, worker completion and shutdown. This foundational change is larger because the shared interfaces and their existing production contracts must move together; later changes have separate review boundaries. Step 1/14 of the complete C17/native-correctness series. Base: develop. Earlier validation, before this review follow-up, in isolated copied snapshots on Linux arm64: - Clean GCC build and make check: 13 passed, 0 existing prerequisite skips, 0 failures. - ASan/UBSan: 12 passed, 1 existing privilege/allocator-interposition prerequisite skips, 0 failures; no sanitizer findings. - Production source/profile integrity verification against disposable MariaDB and loopback SNMP fixtures passed. - Release archive extracted into a separate source tree and built/tested out of tree; fuzz checks passed. Earlier local profiles retain source hashes for the copied validation tree; GitHub checks validate the published commit. No production database/device, host installation or live privilege change is part of validation. Existing prerequisite skips were retained; no test or finding was suppressed to obtain a pass. The worker contracts publish owned heap state and release it only after joining workers and restoring the runtime table. Coverage counters use atomic updates; cppcheck receives an explicit model of the fatal exit contract. Fixture images use public mirrors to avoid shared Docker Hub pull limits. Series navigation: review and merge in order. Every PR targets the preceding branch so its diff contains one step. 1. [refactor(core): add bounded native interfaces and polling contracts](https://github.com/Cacti/spine/pull/638) 2. [fix(privileges): drop root before input and retain owned ICMP sockets](https://github.com/Cacti/spine/pull/639) 3. [fix(poller): isolate worker failures and bound database reconnects](https://github.com/Cacti/spine/pull/640) 4. [fix(results): normalize output and unify SNMP batch persistence](https://github.com/Cacti/spine/pull/641) 5. [fix(runtime): bound probe retries and validate CLI and configuration](https://github.com/Cacti/spine/pull/642) 6. [build: select GNU C17 explicitly and probe hardening support](https://github.com/Cacti/spine/pull/643) 7. [fix(threads): size worker stacks and guard size arithmetic](https://github.com/Cacti/spine/pull/644) 8. [refactor(c17): simplify ownership guards and share test support](https://github.com/Cacti/spine/pull/645) 9. [refactor(core): extract configuration polling and runtime modules](https://github.com/Cacti/spine/pull/646) 10. [fix(boundaries): validate script slots and make cleanup portable](https://github.com/Cacti/spine/pull/647) 11. [refactor(layout): organize responsibilities and separate main from runtime](https://github.com/Cacti/spine/pull/648) 12. [docs(license): adopt SPDX notices and retain contributor credits](https://github.com/Cacti/spine/pull/649) 13. [test(runtime): measure all suites and cover protocol boundaries](https://github.com/Cacti/spine/pull/650) 14. [build(ci): validate connectors time width and native C17 modules](https://github.com/Cacti/spine/pull/651) Review follow-up (2026-10-09): Publish the decoded GET/GETNEXT status back to the host so availability checks observe exception and missing-response failures, while preserving the legacy transport-success behavior for agent PDU errors. Updated step 1 snapshot: isolated Linux arm64 build and make check passed (13 passed, no skips or failures). The restacked tip passes all five clang-tidy gate regression tests and real clang-tidy analysis (26 reviewed baseline findings, no new findings). Actionlint and matching DCO trailers pass. The setuid test also passes when run in the separate disposable root container. GitHub checks validate the updated published commits; earlier profile/archive/sanitizer evidence above belongs to the previous revisions. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> |
||
|
TheWitness
|
08e2ae0b42 |
fix: reap script/PHP children without blocking the poller, drop USING_TPOPEN (#633)
## What - `nft_pclose()` (`nft_popen.c`) and `php_terminate_and_reap()` (`php.c`) no longer escalate through a spin/sleep/SIGTERM/SIGKILL sequence. Each now does one bounded, non-blocking check (~20ms allowance for normal fork/exec/exit scheduling latency), kills anything still running, and hands it to the existing abandoned-pid sweep instead of waiting on it in the calling (polling) thread. - Removed the `USING_TPOPEN`/`--enable-popen` native-`popen()` fallback in `exec_poll()` (`poller.c`, `configure.ac`). It could not track or kill a timed-out child (no pid available from a real `popen()`), so a timeout there could only ever abandon the descriptor without terminating the process. - Extended `tests/regression/test_child_process_safety.sh` with structural guards against reintroducing the blocking spin/sleep escalation in either function. - Updated `tests/unit/test_linked.c`'s `nft_pclose()` coverage for the new, faster contract (the old test asserted a graceful-SIGTERM-then-wait exit code that the new design intentionally no longer provides). ## Why Investigating a reported poller slowdown surfaced that `nft_pclose()` (added by #614) could block a poller thread for up to ~5 seconds per script whose process hadn't exited by the time its pipe was closed, and `php_terminate_and_reap()` had the same shape (up to ~2s), reachable mid-poll-cycle via `php_fail_read()`, not just at shutdown. Separately, the `USING_TPOPEN` fallback's inability to kill a timed-out child was flagged as out of scope in #574. Tracked in #632; design principles written up in #630. ## What was tested - `./bootstrap && ./configure --enable-warnings && make -j` — clean build, no new warnings. - `make check` — all 11 suites pass (unit, regression, integration), including the extended `test_child_process_safety.sh` guard and the updated `test_linked` case. - `cppcheck --enable=all --std=c11` on the three changed `.c` files — no new errors (pre-existing style-only notes unrelated to this change). Signed-off-by: TheWitness <thewitness@cacti.net> |
||
|
|
dbbccc5263 |
fix: extract core safety fixes from #597 (#621)
Extracted from #597 into a focused core correctness and memory-safety change. This checks startup allocations, bounds full log lines and query construction, frees settings result sets on NULL-row paths, caches the configured timestamp format, replaces advancing snprintf cursors with a bounded append contract, fixes remote batch boundary loss, and converts delimited hexadecimal OctetStrings without overflow. poller_output and remote status pushes use the cross-vendor VALUES() form until #590 supplies an independently detected main-server capability. Behavior worth calling out: - colon/dash-delimited hexadecimal values that were previously stored as zero now convert correctly - values wider than 64 bits become U and count as collection errors instead of producing undefined numeric conversion - remote batches flush before the boundary-triggering row and refuse truncated statements Verification on macOS arm64: - warning-enabled C99 configure/build - forced make -B check on the final tree: 6 pass, 1 expected skip - the skipped allocation-failure integration uses Linux LD_PRELOAD and runs in Linux CI - full VPATH make distcheck passed earlier in this branch - mandatory independent pre-push review: PASS Closes #564 Closes #565 Closes #566 Closes #567 Closes #588 Refs #590 Refs #597 --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Signed-off-by: TheWitness <copilot@users.noreply.github.com> Co-authored-by: TheWitness <copilot@users.noreply.github.com> Co-authored-by: TheWitness <thewitness@cacti.net> |
||
|
Thomas VincentandTheWitness
|
90da94b94f |
fix(process): unify subprocess ownership and child lifecycle safety (#614)
## Summary - make subprocess-registry detach atomic so exactly one closer owns each entry - make cancellation cleanup release only the detached node it owns - replace `vfork`/`execve` child setup with `posix_spawn` and explicit file actions - mark every pipe and stdio-collision duplicate close-on-exec - restore the child's default SIGPIPE disposition while preserving the parent's handling - bound TERM/KILL reaping and park unreaped children in a fixed-capacity sweep list - harden PHP script-server slot ownership, startup, restart, signal, descriptor, and cleanup paths - retire and restart failed or oversized reads so stale response tails cannot poison later data sources - revalidate every command retry and cap recovery handshakes at two seconds This folds the child-process lifecycle portion of #597 into the narrower ownership PR. It does not absorb unrelated poll-host, SQL, SNMP, ICMP, or build-infrastructure work. ## Review-driven corrections - close-on-exec is explicitly restored after `dup()` in both read and write stdio-collision branches - the source invariant check now uses portable POSIX character classes - direct tests cover duplicate flags, both collision branches, failure after pipe creation, abandoned-child sweeping, and capacity overflow - collision cleanup preserves current-child redirects even when an older registry entry occupies fd 0 or 1 - script children receive SIGTERM before SIGKILL and unreaped PHP children transfer to the bounded sweep registry - the Docker integration suite now starts a real PHP script server, verifies its startup protocol and database result, and checks that shutdown leaves no zombie PHP process ## Validation - Ubuntu 24.04 container with GCC and GNU ld: `make check`, 6/6 targets passed with no skips, including `test_php_runtime` - real PHP script-server Docker integration: 6/6 checks passed; exact value `42` reached `poller_output` and no zombie remained - macOS Homebrew dependency build passed - macOS `make check`: 5/5 available binaries passed; GNU `--wrap` runtime suite is Linux-only - PHP fixture syntax checked through mise PHP 8.3 - actionlint, shellcheck, and `git diff --check` passed Closes #610. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net> |
||
|
Thomas Vincent
|
0c481bc526 |
port: memory-safety fixes from Spine #544 to develop (#557)
Fresh develop-based port of applicable memory-safety, process-cleanup, SNMP, poller, and PHP transport fixes from #544. Obsolete release and CI history was excluded. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> |