Repository navigation
The net zone's words reach the log marked, bounded and as text - #225
Merged
Merged
Conversation
…ervice starts it on a pipe, so the launcher marks each line as the zone's, replaces control bytes and logs a megabyte a start at most; the zone prints what the network says with printf, never echo; the update helper's last line counts as zone 0's answer only when the helper ended well; and the broker no longer logs the calls a net zone makes by the minute, which used up its log's bound in days
…e's resolv.conf, and no longer needs it to: it writes the servers dnsmasq has and one more, then takes it away
The one conflict is the zones suite's verdict list, whose line main now has with #223's names and the policy and hidden-directory checks; this branch adds nothing to it, so main's line stands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The net zone is run by its own service, not the launch service, and so got no relay: it wrote straight to the service's stdout, which is zone 0's catch-all log and, with it, the console. A net zone that has been taken over could write lines there that nothing marks as a zone's (
kryptikd[zone net]: time-offset ... ok,netzone: READY ...), as many as it liked, with any bytes in them.A host on the network could get part of the way without taking the zone:
saywas dash'secho, which acts on backslashes, and the script hands it words from the network, such as the reason a server gives for refusing the update statement.Stacked on #223 (and so on #213): all three change
netzone-init.sh.The change:
build/services/net-zone/runstarts the zone with--ready-fd 3and3>/dev/null. Nobody waits for the readiness line, but with it the launcher keeps the log and gives the zone a pipe (spawn.rs,ZoneOutput): each line is markedzone net|, control bytes are replaced, and one megabyte a start is the most that is logged. No Rust changes for this.netzone-init.sh:sayusesprintf. The update helper's last line is taken as zone 0's answer only when the helper ended with status 0, so a failed fetch whose error text ends inok ...oridleis said and not believed. The statement is asked for again at the next pass when a poll was still running, instead of a day later.update-fetch.pyprints its error on one line.spawn.rs: the launcher no longer logsupdate-poll,update-putandversionrequests. A net zone makes them by the minute, and at 48 bytes each they used up the megabyte of broker lines in about fifteen days, after which no clock or update decision was logged until the zone restarted. What those calls decide is logged where it is decided.The ceiling, said in the service file: a megabyte a start. A net zone that says more goes unlogged until it restarts; filling the allowance again by the hour is the way on.
Tests:
tools/tests/netzone-words.sh, offline under sh, bash and dash: a backslash printed as it came, zone 0'soktaken, the same words after a failed fetch not taken, a failed poll said, a second run refused while one is going, and the service line itself. The suites' matches on the zone's lines are not anchored to a line's start, so the mark does not break them; the Distro run is the proof.Not done here: the mark does not replace UTF-8 C1 control characters; a compromised net zone can still rename an uplink before it returns to zone 0.