Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test: assume priv ports start at 1024 if it can't be changed #46536

Merged
merged 3 commits into from
Mar 2, 2023

Conversation

KrayzeeKev
Copy link
Contributor

An update to test/parallel/test-cluster-bind-privileged-port.js checks the lowest privileged port to ensure 42 is privileged This only works on kernels > 4.1. On older kernels, this is locked at 1024 so the check is not needed.

Fixes: #45838

An update to test/parallel/test-cluster-bind-privileged-port.js
checks the lowest privileged port to ensure 42 is privileged
This only works on kernels > 4.1. On older kernels, this is
locked at 1024 so the check is not needed.

Fixes: nodejs#45838
@nodejs-github-bot nodejs-github-bot added needs-ci PRs that need a full CI run. test Issues and PRs related to the tests. labels Feb 7, 2023
Comment on lines 30 to 36
const procFileName = '/proc/sys/net/ipv4/ip_unprivileged_port_start';
// Does not exist for Kernel < 4.1 where answer is 1024. So only test limit if limit exists
if (statSync(procFileName, { throwIfNoEntry: false })) {
const unprivilegedPortStart = parseInt(readFileSync(procFileName));
if (unprivilegedPortStart <= 42) {
common.skip('Port 42 is unprivileged');
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a TOCTOU pattern. While mostly academic in this context, node users sometimes copy "best practices" from the test suite so I'd rather not merge this code as-is. Open the file and handle the error when it's not there.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. While the TOCTOU race condition can never occur here, your reasoning is all sound. I'll replace it with a try block. Just dislike empty catch blocks but we'll throw a comment in there.
Done.

if (unprivilegedPortStart <= 42) {
common.skip('Port 42 is unprivileged');
try {
const sysctlOutput = execSync('sysctl net.ipv4.ip_unprivileged_port_start').toString();
Copy link
Member

@lpinca lpinca Feb 8, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This basically reverts f69e84c. Can't you simply handle the error thrown by readFileSync('/proc/sys/net/ipv4/ip_unprivileged_port_start') when the file does not exist?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, that is so embarrassing. I am doing this in v19 and v18 (the one I'm actually trying to deploy). Went back to the old one. Ignore this. Will fix in next few hours. ARGGHHH

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, fixed. Needed more coffee. Working in 3 places (v19 source, v18 source, my build).

if (unprivilegedPortStart <= 42) {
common.skip('Port 42 is unprivileged');
try {
const unprivilegedPortStart = parseInt(readFileSync('/proc/sys/net/ipv4/ip_unprivileged_port_start'));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a nit that you are free to ignore. I would put only readFileSync() in the try...catch.

let unprivilegedPortStart:

try {
  unprivilegedPortStart = readFileSync('/proc/sys/net/ipv4/ip_unprivileged_port_start');
} catch {
  // Do nothing.
}

if (parseInt(unprivilegedPortStart) <= 42) {
  common.skip('Port 42 is unprivileged');
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I considered that (and even wrote it). The above I dislike a bit because parseInt returns NaN and Nan <=42 which means it'll work but it's very obscure. First thing you think is "isn't this broken"? So you probably want a "unprivilegedPortStart = 1024;" in the catch which is what the scenario REALLY is when the readFileSync fails.

BUT The entire test of minimum ports, etc is irrelevant when that read fails. That indicates the ability to change the minimum doesn't exist hence even considering it is irrelevant.

So I went with "if the read fails, this entire block of code is irrelevant".

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could be explicit and do

if (unprivilegedPortStart !== undefined && parseInt(unprivilegedPortStart) <= 42) {
  common.skip('Port 42 is unprivileged');
}

My reasoning is that only things that are expected to throws errors should be in the try block to avoid hiding unexpected exception.

Anyway, it is only a nit. It is ok as is.

@Trott Trott added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Feb 23, 2023
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Feb 23, 2023
@nodejs-github-bot
Copy link
Collaborator

@nodejs-github-bot
Copy link
Collaborator

@aduh95 aduh95 added commit-queue Add this label to land a pull request using GitHub Actions. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. labels Mar 2, 2023
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 2, 2023
@nodejs-github-bot nodejs-github-bot merged commit 024e648 into nodejs:main Mar 2, 2023
@nodejs-github-bot
Copy link
Collaborator

Landed in 024e648

targos pushed a commit that referenced this pull request Mar 13, 2023
An update to test/parallel/test-cluster-bind-privileged-port.js
checks the lowest privileged port to ensure 42 is privileged
This only works on kernels > 4.1. On older kernels, this is
locked at 1024 so the check is not needed.

Fixes: #45838
PR-URL: #46536
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
targos pushed a commit that referenced this pull request Mar 14, 2023
An update to test/parallel/test-cluster-bind-privileged-port.js
checks the lowest privileged port to ensure 42 is privileged
This only works on kernels > 4.1. On older kernels, this is
locked at 1024 so the check is not needed.

Fixes: #45838
PR-URL: #46536
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
danielleadams pushed a commit that referenced this pull request Apr 11, 2023
An update to test/parallel/test-cluster-bind-privileged-port.js
checks the lowest privileged port to ensure 42 is privileged
This only works on kernels > 4.1. On older kernels, this is
locked at 1024 so the check is not needed.

Fixes: #45838
PR-URL: #46536
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. needs-ci PRs that need a full CI run. test Issues and PRs related to the tests.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

test: check net.ipv4.ip_unprivileged_port_start in parallel/test-cluster-bind-privileged-port
6 participants