Read quarantine evidence back when planning a seed

internal/bind/seed_test.go

@@ -0,0 +1,168 @@
+package bind
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func requireShell(t *testing.T, tools ...string) string {
+	t.Helper()
+	sh, err := exec.LookPath("sh")
+	if err != nil {
+		t.Skipf("no POSIX shell: %v", err)
+	}
+	for _, tool := range tools {
+		if _, err := exec.LookPath(tool); err != nil {
+			t.Skipf("seed script needs %s: %v", tool, err)
+		}
+	}
+	return sh
+}
+
+// inFlightZone lays out the state the operator actually hit in production: a
+// zone file a previous reconcile clobbered back to serial 1, with the journal
+// that carries the live records up to 16.
+func inFlightZone(t *testing.T) (dir, path string) {
+	t.Helper()
+	dir = t.TempDir()
+	path = filepath.Join(dir, "db.example.com")
+	if err := os.WriteFile(path, []byte(renderSeedZone("example.com", "10.0.0.1", 1)), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(JournalPath(path), journalHeader(";BIND LOG V9.2\n", 10, 16), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return dir, path
+}
+
+func runSeedScript(t *testing.T, sh, path string, plan SeedPlan, content, stdin string) error {
+	t.Helper()
+	cmd := exec.Command(sh, "-c", seedScript(path, plan, len(content)))
+	cmd.Stdin = strings.NewReader(stdin)
+	return cmd.Run()
+}
+
+func probeState(t *testing.T, sh, path string) ZoneDiskState {
+	t.Helper()
+	out, err := exec.Command(sh, "-c", zoneStateProbe(path)).Output()
+	if err != nil {
+		t.Fatalf("probe failed: %v", err)
+	}
+	st, ok := parseZoneDiskState(string(out))
+	if !ok {
+		t.Fatalf("probe output rejected: %q", out)
+	}
+	return st
+}
+
+func siblings(t *testing.T, dir string) map[string]string {
+	t.Helper()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := map[string]string{}
+	for _, e := range entries {
+		b, err := os.ReadFile(filepath.Join(dir, e.Name()))
+		if err != nil {
+			t.Fatal(err)
+		}
+		found[e.Name()] = string(b)
+	}
+	return found
+}
+
+// A stdin stream cut mid-transfer gives cat a short file and exits 0. The seed
+// must refuse to install it, and must not have quarantined anything on the way:
+// a run that stopped here has to leave the zone exactly as it found it.
+func TestSeedScriptInterruptedWriteLeavesDiskUntouched(t *testing.T) {
+	sh := requireShell(t, "wc", "tr", "mv", "rm", "mkdir", "dirname")
+	dir, path := inFlightZone(t)
+
+	plan := PlanSeed(probeState(t, sh, path))
+	if !plan.WriteSeed || !plan.QuarantineZoneFile || !plan.QuarantineJournal {
+		t.Fatalf("expected a reseed over both files, got %+v", plan)
+	}
+	content := renderSeedZone("example.com", "10.0.0.1", plan.Serial)
+
+	if err := runSeedScript(t, sh, path, plan, content, content[:len(content)/2]); err == nil {
+		t.Fatal("a truncated seed write must fail rather than install a torn zone file")
+	}
+
+	serial, ok := ParseZoneSerial(siblings(t, dir)[filepath.Base(path)])
+	if !ok || serial != 1 {
+		t.Errorf("the zone file was damaged by the interrupted seed: serial = (%d,%v)", serial, ok)
+	}
+	for name := range siblings(t, dir) {
+		if strings.Contains(name, quarantineMarker) {
+			t.Errorf("nothing should have been quarantined before the write landed: %s", name)
+		}
+		if strings.HasSuffix(name, seedTempSuffix) {
+			t.Errorf("the staging file should have been cleaned up: %s", name)
+		}
+	}
+
+	// The retry must still see the journal and reseed above it, not at 1.
+	retry := PlanSeed(probeState(t, sh, path))
+	if retry != plan {
+		t.Errorf("retry planned %+v, want the original %+v", retry, plan)
+	}
+}
+
+func TestSeedScriptInstallsOverQuarantinedFiles(t *testing.T) {
+	sh := requireShell(t, "wc", "tr", "mv", "rm", "mkdir", "dirname")
+	dir, path := inFlightZone(t)
+
+	plan := PlanSeed(probeState(t, sh, path))
+	content := renderSeedZone("example.com", "10.0.0.1", plan.Serial)
+	if err := runSeedScript(t, sh, path, plan, content, content); err != nil {
+		t.Fatalf("seed script: %v", err)
+	}
+
+	st := probeState(t, sh, path)
+	if !st.ZoneFile || st.ZoneSerial != plan.Serial {
+		t.Errorf("installed state = %+v want serial %d", st, plan.Serial)
+	}
+	if st.Journal {
+		t.Error("the unreplayable journal should have been moved aside")
+	}
+	found := siblings(t, dir)
+	for _, want := range []string{"db.example.com.orphaned-16", "db.example.com.jnl.orphaned-16"} {
+		if _, ok := found[want]; !ok {
+			t.Errorf("missing preserved file %s: %v", want, keys(found))
+		}
+	}
+	if _, ok := found[filepath.Base(path)+seedTempSuffix]; ok {
+		t.Error("the staging file should have been renamed into place")
+	}
+	if next := PlanSeed(st); next != (SeedPlan{}) {
+		t.Errorf("second reconcile should be a no-op, got %+v", next)
+	}
+}
+
+// The seed has to work on a PVC that has never held this zone, directories
+// included.
+func TestSeedScriptFreshInstall(t *testing.T) {
+	sh := requireShell(t, "wc", "tr", "mv", "rm", "mkdir", "dirname")
+	path := filepath.Join(t.TempDir(), "zones", "db.example.com")
+
+	plan := PlanSeed(ZoneDiskState{})
+	content := renderSeedZone("example.com", "10.0.0.1", plan.Serial)
+	if err := runSeedScript(t, sh, path, plan, content, content); err != nil {
+		t.Fatalf("seed script: %v", err)
+	}
+	if st := probeState(t, sh, path); !st.ZoneFile || st.ZoneSerial != 1 {
+		t.Errorf("fresh install state = %+v want serial 1", st)
+	}
+}
+
+func keys(m map[string]string) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	return out
+}