mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-30 11:07:33 +00:00
DanConwayDev
1c362df0cf
The naive find_free_port pattern — bind 127.0.0.1:0, read the port, drop
the listener, return — has a TOCTOU window where another caller in the
process can be handed the same port back before the consumer's real bind.
The hazard is especially sharp where a port is pre-allocated to embed in
an announcement event, then used minutes later to spawn the relay that
will host it (purgatory_sync, sync/historic_sync, sync/metrics,
archive_grasp_services, sync_helpers::run_sync_test_*).
Introduce tests/common/port.rs with PortReservation + reserve_port():
the listener stays bound for the lifetime of the reservation, so no
other reserve_port call in this process can be handed the same number.
TestRelay grows reservation-based constructors and routes every
existing public start* method through the same reservation path
internally; the bare find_free_port / start_on_port_* /
start_with_archive_and_sync / start_with_all_options API is removed
and all callers migrated.
Defense-in-depth retry on subprocess early-exit (detected via try_wait
during the readiness probe so we fail fast rather than waiting the
full 5s timeout) covers the residual microsecond-scale TOCTOU window
between PortReservation::release and ngit-grasp's own bind. Has not
been observed to fire in local stress runs; kept as belt-and-braces
for CI / loaded hardware.
Mirrors ngit commit 5883494 ("test(harness): port reservation + retry
to harden against :0 bind race").