309 lines
15 KiB
Bash
309 lines
15 KiB
Bash
 
|
#!/usr/bin/env bash
|
||
|
|
## lsphp-info-probe.test.sh — regression test for the SIGPIPE-under-pipefail
|
||
|
|
## class of bug that shipped in cac-lsphp (trunk 9343a56) and silently turned
|
||
|
|
## $_SERVER path parity off on every shared-ols site whose host lost the race.
|
||
|
|
##
|
||
|
|
## THE BUG. entrypoint-lsphp.sh asked "is cac_path_parity loaded?" with
|
||
|
|
##
|
||
|
|
## printf '%s\n' "$LSPHP_INFO" | grep -q '^cac_path_parity support => enabled$'
|
||
|
|
##
|
||
|
|
## under `set -euo pipefail`. `grep -q` exits the instant it matches; printf is
|
||
|
|
## still pushing the remaining ~40 KB of `lsphp -i` into the pipe, takes
|
||
|
|
## SIGPIPE, and exits 141; pipefail prefers that over grep's 0. So the test read
|
||
|
|
## FALSE **because the extension was present** — present early enough in the
|
||
|
|
## output to stop the reader — and the container fell back to the degraded
|
||
|
|
## auto_prepend normaliser the extension exists to replace, while telling the
|
||
|
|
## operator the extension was "not loadable in this image".
|
||
|
|
##
|
||
|
|
## WHY THE EXISTING SUITE DID NOT CATCH IT. The .phpt suite and
|
||
|
|
## fpm-parity-check.sh both test the EXTENSION; nothing executed the
|
||
|
|
## ENTRYPOINT's branch logic, and the Dockerfile's own `lsphp -i | grep -q`
|
||
|
|
## build gate runs under `bash -c 'set -e'` with NO pipefail, so it reported the
|
||
|
|
## extension present in the very image whose entrypoint declared it missing.
|
||
|
|
##
|
||
|
|
## WHAT THIS ASSERTS.
|
||
|
|
## 1. behaviour — the SHIPPED probe helpers (extracted verbatim from
|
||
|
|
## entrypoint-lsphp.sh, never copied, so they cannot drift) return the
|
||
|
|
## right answer AND a clean exit status under `set -euo pipefail` with a
|
||
|
|
## realistic ~40 KB phpinfo body.
|
||
|
|
## 2. structure — no script in this repo that enables pipefail pipes into a
|
||
|
|
## reader that can exit before its writer finishes. This is the check that
|
||
|
|
## fails deterministically against trunk; assertion 1's *old* form is a
|
||
|
|
## RACE (measured 141 on 3 of 5 runs here, 5 of 5 on whp02, and 0 of 5
|
||
|
|
## under a different Docker daemon), so no behavioural assertion about the
|
||
|
|
## broken code could be trusted to fail on every machine. Section 4 runs
|
||
|
|
## the old form anyway and prints what it did, for the record.
|
||
|
|
##
|
||
|
|
## SCOPE LIMITS, stated rather than hidden. The structural scan is a text scan,
|
||
|
|
## so it under-reports in two known ways:
|
||
|
|
## - it reads one line at a time. The repo's only multi-line pipeline
|
||
|
|
## (ols-htaccess-watcher.sh's `inotifywait … |` / `while read`) is invisible
|
||
|
|
## to it and was reviewed by hand: that reader loops until EOF, i.e. until
|
||
|
|
## the writer has already gone, so it cannot produce this failure.
|
||
|
|
## - its quote stripping is flat, so a pipe nested inside a command
|
||
|
|
## substitution inside a quoted string (`echo "x ($(a | head -1))"`) is read
|
||
|
|
## as quoted text and skipped.
|
||
|
|
## It is a guard against reintroducing the shape, not a proof of its absence.
|
||
|
|
##
|
||
|
|
## Usage: scripts/tests/lsphp-info-probe.test.sh [REPO_ROOT]
|
||
|
|
## Exit: 0 all assertions passed, 1 an assertion FAILED, 2 the test could not run.
|
||
|
|
|
||
|
|
set -uo pipefail
|
||
|
|
|
||
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
|
ROOT="${1:-$(cd "$HERE/../.." && pwd)}"
|
||
|
|
ENTRYPOINT="$ROOT/scripts/entrypoint-lsphp.sh"
|
||
|
|
TMP="$(mktemp -d)"
|
||
|
|
trap 'rm -rf "$TMP"' EXIT
|
||
|
|
|
||
|
|
pass=0; fail=0
|
||
|
|
ok() { pass=$((pass+1)); echo " ok — $1"; }
|
||
|
|
bad() { fail=$((fail+1)); echo " FAIL — $1" >&2; }
|
||
|
|
die() { echo "HARNESS FAILURE: $*" >&2; exit 2; }
|
||
|
|
|
||
|
|
[ -f "$ENTRYPOINT" ] || die "no entrypoint at $ENTRYPOINT (pass REPO_ROOT as \$1)"
|
||
|
|
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
## 1. Extract the real probe helpers. Not a copy: whatever the shipped
|
||
|
|
## entrypoint says between the markers is what runs below, so a future edit
|
||
|
|
## that reintroduces a pipeline is tested, not narrated.
|
||
|
|
##
|
||
|
|
## A missing block is an assertion FAILURE, not a harness error, and it does
|
||
|
|
## not stop the run: against a pre-fix checkout the probes are still inline
|
||
|
|
## pipelines, and section 5 below is what names them. Bailing out here would
|
||
|
|
## have replaced that report with "could not run".
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
HAVE_HELPERS=yes
|
||
|
|
awk '/^## ---- CAC-TEST: probe helpers BEGIN ----$/{f=1} f{print} /^## ---- CAC-TEST: probe helpers END ----$/{exit}' \
|
||
|
|
"$ENTRYPOINT" > "$TMP/helpers.sh"
|
||
|
|
if [ -s "$TMP/helpers.sh" ]; then
|
||
|
|
for fn in lsphp_info_has_parity_ext lsphp_info_scan_dir lsphp_info_is_usable; do
|
||
|
|
if ! grep -q "^${fn}()" "$TMP/helpers.sh"; then
|
||
|
|
HAVE_HELPERS=no
|
||
|
|
bad "the probe-helper block in ${ENTRYPOINT#"$ROOT"/} defines no ${fn}()"
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
else
|
||
|
|
HAVE_HELPERS=no
|
||
|
|
bad "no probe-helper markers in ${ENTRYPOINT#"$ROOT"/} — either they were removed, or this is a pre-fix checkout where the probes are still inline pipelines (trunk 9343a56). Section 5 says which lines."
|
||
|
|
fi
|
||
|
|
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
## 2. Fixtures. Shaped like real `lsphp -i`: the two lines the probes look for
|
||
|
|
## sit near the TOP (that is what lets a reader stop early), with tens of KB
|
||
|
|
## of body after them. A fixture whose marker is near the end could not
|
||
|
|
## SIGPIPE at all and would make this whole test vacuous, so both properties
|
||
|
|
## are asserted before anything else runs.
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
SCAN_PATH='/usr/local/lsws/lsphp83/etc/php/8.3/mods-available'
|
||
|
|
make_fixture() { # $1=outfile $2=yes|no (include the cac_path_parity line)
|
||
|
|
{
|
||
|
|
printf 'phpinfo()\nPHP Version => 8.3.27\n\n'
|
||
|
|
printf 'System => Linux 6ecb4e0a1c1f 5.15.0 #1 SMP x86_64\n'
|
||
|
|
printf 'Server API => LiteSpeed V8.3\n'
|
||
|
|
printf 'Configuration File (php.ini) Path => /usr/local/lsws/lsphp83/etc/php/8.3/litespeed\n'
|
||
|
|
printf 'Scan this dir for additional .ini files => %s\n' "$SCAN_PATH"
|
||
|
|
printf 'PHP API => 20230831\nDebug Build => no\nThread Safety => disabled\n\n'
|
||
|
|
printf 'bcmath\n\nBCMath support => enabled\n\n'
|
||
|
|
printf 'calendar\n\nCalendar support => enabled\n\n'
|
||
|
|
[ "$2" = yes ] && printf 'cac_path_parity\n\ncac_path_parity support => enabled\nRewriting => active\n\n'
|
||
|
|
printf 'Core\n\nPHP Version => 8.3.27\n\n'
|
||
|
|
## ~40 KB of directive rows, exactly the shape phpinfo() prints them in.
|
||
|
|
local i=0
|
||
|
|
while [ "$i" -lt 700 ]; do
|
||
|
|
printf 'some.directive_%03d => local_value_%03d => master_value_%03d\n' "$i" "$i" "$i"
|
||
|
|
i=$((i+1))
|
||
|
|
done
|
||
|
|
} > "$1"
|
||
|
|
}
|
||
|
|
make_fixture "$TMP/info-present.txt" yes
|
||
|
|
make_fixture "$TMP/info-absent.txt" no
|
||
|
|
: > "$TMP/info-empty.txt"
|
||
|
|
|
||
|
|
echo "== fixture sanity =="
|
||
|
|
FIX_BYTES=$(wc -c < "$TMP/info-present.txt")
|
||
|
|
MATCH_OFF=$(grep -b -m1 '^cac_path_parity support => enabled$' "$TMP/info-present.txt" | cut -d: -f1)
|
||
|
|
if [ "$FIX_BYTES" -ge 32768 ]; then
|
||
|
|
ok "fixture is ${FIX_BYTES} bytes (realistic 'lsphp -i' is ~40 KB)"
|
||
|
|
else
|
||
|
|
bad "fixture is only ${FIX_BYTES} bytes — too small to reproduce the failure"
|
||
|
|
fi
|
||
|
|
if [ "$MATCH_OFF" -lt $((FIX_BYTES / 4)) ]; then
|
||
|
|
ok "match sits at byte ${MATCH_OFF} of ${FIX_BYTES} — most of the body is still unwritten when a reader could stop"
|
||
|
|
else
|
||
|
|
bad "match at byte ${MATCH_OFF} of ${FIX_BYTES} leaves too small a tail; the test would be vacuous"
|
||
|
|
fi
|
||
|
|
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
## 3. Behaviour, under the REAL option set (`set -euo pipefail`, as line 34 of
|
||
|
|
## the entrypoint sets it). Each case runs in its own bash process so the
|
||
|
|
## options and the exit status are the genuine article, not something this
|
||
|
|
## harness simulated.
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
cat > "$TMP/runner.sh" <<'RUNNER'
|
||
|
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
# shellcheck disable=SC1091
|
||
|
|
source "$1" # the extracted probe helpers
|
||
|
|
LSPHP_INFO=$(cat "$2")
|
||
|
|
case "$3" in
|
||
|
|
has_ext) lsphp_info_has_parity_ext "$LSPHP_INFO" ;;
|
||
|
|
scan_dir) lsphp_info_scan_dir "$LSPHP_INFO" ;;
|
||
|
|
usable) lsphp_info_is_usable "$LSPHP_INFO" ;;
|
||
|
|
legacy) printf '%s\n' "$LSPHP_INFO" | grep -q '^cac_path_parity support => enabled$' ;;
|
||
|
|
*) echo "unknown case $3" >&2; exit 99 ;;
|
||
|
|
esac
|
||
|
|
RUNNER
|
||
|
|
|
||
|
|
## NOT `out=$(run …)`: command substitution runs the function in a subshell,
|
||
|
|
## where an exit status assigned to RC would be thrown away with it. Run in this
|
||
|
|
## shell, capture stdout through a file, and RC is the real thing.
|
||
|
|
RC=0; out=""
|
||
|
|
run() { # $1=fixture $2=case -> sets RC and out
|
||
|
|
RC=0
|
||
|
|
bash "$TMP/runner.sh" "$TMP/helpers.sh" "$1" "$2" >"$TMP/out" 2>&1 || RC=$?
|
||
|
|
out=$(cat "$TMP/out")
|
||
|
|
}
|
||
|
|
|
||
|
|
echo "== the shipped probes under set -euo pipefail =="
|
||
|
|
if [ "$HAVE_HELPERS" = no ]; then
|
||
|
|
echo " (skipped — no probe helpers to run; see the failure above)"
|
||
|
|
fi
|
||
|
|
if [ "$HAVE_HELPERS" = yes ]; then
|
||
|
|
|
||
|
|
run "$TMP/info-present.txt" has_ext
|
||
|
|
if [ "$RC" -eq 0 ]; then
|
||
|
|
ok "extension present => branch TAKEN (exit 0)"
|
||
|
|
elif [ "$RC" -eq 141 ]; then
|
||
|
|
bad "exit 141 (SIGPIPE): the probe is a pipeline again — this is the original bug"
|
||
|
|
else
|
||
|
|
bad "extension present => exit $RC (expected 0). Output: $out"
|
||
|
|
fi
|
||
|
|
|
||
|
|
run "$TMP/info-absent.txt" has_ext
|
||
|
|
if [ "$RC" -eq 1 ]; then
|
||
|
|
ok "extension genuinely absent => branch NOT taken (exit 1, a clean 'no')"
|
||
|
|
else
|
||
|
|
bad "extension absent => exit $RC (expected 1). Output: $out"
|
||
|
|
fi
|
||
|
|
|
||
|
|
run "$TMP/info-present.txt" scan_dir
|
||
|
|
if [ "$RC" -eq 0 ] && [ "$out" = "$SCAN_PATH" ]; then
|
||
|
|
ok "scan-dir probe returns '$out' (exit 0)"
|
||
|
|
elif [ "$RC" -eq 141 ]; then
|
||
|
|
bad "scan-dir probe exit 141 (SIGPIPE) — as a bare assignment under set -e that KILLS PID 1"
|
||
|
|
else
|
||
|
|
bad "scan-dir probe => exit $RC, got '$out', expected '$SCAN_PATH'"
|
||
|
|
fi
|
||
|
|
|
||
|
|
run "$TMP/info-present.txt" usable
|
||
|
|
if [ "$RC" -eq 0 ]; then ok "usability probe: real phpinfo body => usable (exit 0)"
|
||
|
|
else bad "usability probe on real body => exit $RC (expected 0)"; fi
|
||
|
|
|
||
|
|
run "$TMP/info-empty.txt" usable
|
||
|
|
if [ "$RC" -eq 1 ]; then ok "usability probe: empty body => NOT usable (exit 1)"
|
||
|
|
else bad "usability probe on empty body => exit $RC (expected 1)"; fi
|
||
|
|
|
||
|
|
## The two failure causes must be reported as the different things they are.
|
||
|
|
## A probe that cannot answer has established nothing about the image, and the
|
||
|
|
## old message asserted the opposite of that for every reason it fired.
|
||
|
|
## SC2016: these patterns are the entrypoint's literal text, `$` and all.
|
||
|
|
# shellcheck disable=SC2016
|
||
|
|
if grep -q 'if lsphp_info_is_usable "$LSPHP_INFO"; then' "$ENTRYPOINT" &&
|
||
|
|
grep -q 'This is a PROBE failure and establishes nothing' "$ENTRYPOINT"; then
|
||
|
|
ok "a probe that produced nothing is reported as OUR failure, not as a verdict on the image"
|
||
|
|
else
|
||
|
|
bad "entrypoint no longer reports an unusable 'lsphp -i' as a probe failure"
|
||
|
|
fi
|
||
|
|
# shellcheck disable=SC2016
|
||
|
|
if grep -q 'not loadable in this image' "$ENTRYPOINT" &&
|
||
|
|
grep -q 'answered (${#LSPHP_INFO} bytes, scan dir ${SCAN_DIR}) and does not list it' "$ENTRYPOINT"; then
|
||
|
|
ok "the 'extension not loadable' verdict now ships the evidence it rests on"
|
||
|
|
else
|
||
|
|
bad "the 'extension not loadable' message no longer states what it observed"
|
||
|
|
fi
|
||
|
|
|
||
|
|
fi # HAVE_HELPERS
|
||
|
|
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
## 4. The old form, for the record. NOT asserted: it is a race, and asserting a
|
||
|
|
## race would make this suite flap on whichever machine happens to win it.
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
echo "== the pre-fix pipeline form on the same input (informational) =="
|
||
|
|
if [ "$HAVE_HELPERS" = no ]; then
|
||
|
|
echo " (skipped — the runner needs the helper block to source)"
|
||
|
|
fi
|
||
|
|
legacy_rcs=""
|
||
|
|
if [ "$HAVE_HELPERS" = yes ]; then
|
||
|
|
for _ in 1 2 3 4 5 6 7 8 9 10; do
|
||
|
|
run "$TMP/info-present.txt" legacy
|
||
|
|
legacy_rcs="$legacy_rcs $RC"
|
||
|
|
done
|
||
|
|
echo " 10 runs of 'printf | grep -q' under pipefail:${legacy_rcs}"
|
||
|
|
echo " (0 = happened to finish writing, 141 = writer SIGPIPEd and pipefail reported the"
|
||
|
|
echo " extension MISSING because it was present. Either value is expected here.)"
|
||
|
|
fi
|
||
|
|
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
## 5. Structural scan — the deterministic guard, and the part of this file that
|
||
|
|
## fails against trunk on EVERY machine. Any script that turns on pipefail
|
||
|
|
## and pipes into a reader that can stop early has this bug latent in it
|
||
|
|
## whether or not today's buffer sizes expose it, so the shape is what gets
|
||
|
|
## outlawed, not the symptom.
|
||
|
|
##
|
||
|
|
## It is a text scan, so it is honest about its limits: it strips quoted
|
||
|
|
## spans and comments (that is what keeps `case a|b)`, `sed "s|x|y|"` and
|
||
|
|
## `echo "a | b"` from being reported), it requires the reader to be the
|
||
|
|
## FIRST word after a pipe, and it reads one line at a time. This file is
|
||
|
|
## skipped because section 4 runs the broken form on purpose.
|
||
|
|
## ---------------------------------------------------------------------------
|
||
|
|
echo "== structural scan: early-exit readers in pipefail scripts =="
|
||
|
|
mapfile -t PIPEFAIL_FILES < <(grep -rl --include='*.sh' -E '^[[:space:]]*set[[:space:]]+-[a-zA-Z]*[[:space:]]*o?[[:space:]]*pipefail|^[[:space:]]*set[[:space:]]+-o[[:space:]]+pipefail' "$ROOT/scripts" "$ROOT/ext" 2>/dev/null | sort)
|
||
|
|
[ "${#PIPEFAIL_FILES[@]}" -gt 0 ] || die "found no pipefail-enabled scripts under $ROOT — the scan would be vacuous"
|
||
|
|
|
||
|
|
cat > "$TMP/scan.awk" <<'AWKPROG'
|
||
|
|
{
|
||
|
|
raw = $0
|
||
|
|
l = raw
|
||
|
|
gsub(/\\"/, "X", l); gsub(/\\'/, "X", l) # escaped quotes are not delimiters
|
||
|
|
while (match(l, /'[^']*'/)) l = substr(l, 1, RSTART-1) "SQ" substr(l, RSTART+RLENGTH)
|
||
|
|
while (match(l, /"[^"]*"/)) l = substr(l, 1, RSTART-1) "DQ" substr(l, RSTART+RLENGTH)
|
||
|
|
if (l ~ /^[[:space:]]*#/) next # whole-line comment
|
||
|
|
sub(/[[:space:]]#.*/, "", l) # trailing comment
|
||
|
|
gsub(/\|\|/, " ", l) # || is not a pipeline
|
||
|
|
if (l !~ /\|/) next
|
||
|
|
n = split(l, seg, "|")
|
||
|
|
for (i = 2; i <= n; i++) {
|
||
|
|
r = seg[i]
|
||
|
|
if (r ~ /^[[:space:]]*grep[[:space:]]+-([[:alnum:]]*q|m)/) { print NR ": " raw; next }
|
||
|
|
if (r ~ /^[[:space:]]*head([[:space:]]|$)/) { print NR ": " raw; next }
|
||
|
|
if (r ~ /^[[:space:]]*(while[[:space:]]+)?read([[:space:]]|$)/) { print NR ": " raw; next }
|
||
|
|
if (r ~ /^[[:space:]]*awk([[:space:]]|$)/ && raw ~ /exit/) { print NR ": " raw; next }
|
||
|
|
if (r ~ /^[[:space:]]*sed([[:space:]]|$)/ && raw ~ /[;{\/][[:space:]]*[qQ][^[:alnum:]]/) { print NR ": " raw; next }
|
||
|
|
}
|
||
|
|
}
|
||
|
|
AWKPROG
|
||
|
|
|
||
|
|
offenders=0
|
||
|
|
for f in "${PIPEFAIL_FILES[@]}"; do
|
||
|
|
[ "$(basename "$f")" = "$(basename "${BASH_SOURCE[0]}")" ] && continue
|
||
|
|
while IFS= read -r hit; do
|
||
|
|
offenders=$((offenders+1))
|
||
|
|
echo " FAIL — ${f#"$ROOT"/}:${hit}" >&2
|
||
|
|
done < <(awk -f "$TMP/scan.awk" "$f")
|
||
|
|
done
|
||
|
|
if [ "$offenders" -eq 0 ]; then
|
||
|
|
ok "${#PIPEFAIL_FILES[@]} pipefail-enabled scripts, no pipeline whose reader can outrun its writer"
|
||
|
|
else
|
||
|
|
bad "$offenders pipeline(s) above pipe into an early-exit reader under pipefail."
|
||
|
|
echo " Read the value into a variable and match it with a here-string (see" >&2
|
||
|
|
echo " lsphp_info_has_parity_ext in scripts/entrypoint-lsphp.sh), or give the" >&2
|
||
|
|
echo " reader the file directly. A here-string is not a pipeline, so there is" >&2
|
||
|
|
echo " no second exit status for pipefail to prefer." >&2
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo "passed: $pass failed: $fail"
|
||
|
|
[ "$fail" -eq 0 ] || exit 1
|
||
|
|
exit 0
|