test: assume priv ports start at 1024 if it can't be changed #46536
Conversation
An update to test/parallel/test-cluster-bind-privileged-port.js checks the lowest privileged port to ensure 42 is privileged This only works on kernels > 4.1. On older kernels, this is locked at 1024 so the check is not needed. Fixes: nodejs#45838
nodejs-github-bot
added
needs-ci
| const procFileName = '/proc/sys/net/ipv4/ip_unprivileged_port_start'; | ||
| // Does not exist for Kernel < 4.1 where answer is 1024. So only test limit if limit exists | ||
| if (statSync(procFileName, { throwIfNoEntry: false })) { | ||
| const unprivilegedPortStart = parseInt(readFileSync(procFileName)); | ||
| if (unprivilegedPortStart <= 42) { | ||
| common.skip('Port 42 is unprivileged'); | ||
| } |
There was a problem hiding this comment.
This is a TOCTOU pattern. While mostly academic in this context, node users sometimes copy "best practices" from the test suite so I'd rather not merge this code as-is. Open the file and handle the error when it's not there.
There was a problem hiding this comment.
Agreed. While the TOCTOU race condition can never occur here, your reasoning is all sound. I'll replace it with a try block. Just dislike empty catch blocks but we'll throw a comment in there.
Done.
| if (unprivilegedPortStart <= 42) { | ||
| common.skip('Port 42 is unprivileged'); | ||
| try { | ||
| const sysctlOutput = execSync('sysctl net.ipv4.ip_unprivileged_port_start').toString(); |
There was a problem hiding this comment.
This basically reverts f69e84c. Can't you simply handle the error thrown by readFileSync('/proc/sys/net/ipv4/ip_unprivileged_port_start') when the file does not exist?
There was a problem hiding this comment.
Oh, that is so embarrassing. I am doing this in v19 and v18 (the one I'm actually trying to deploy). Went back to the old one. Ignore this. Will fix in next few hours. ARGGHHH
There was a problem hiding this comment.
OK, fixed. Needed more coffee. Working in 3 places (v19 source, v18 source, my build).
| if (unprivilegedPortStart <= 42) { | ||
| common.skip('Port 42 is unprivileged'); | ||
| try { | ||
| const unprivilegedPortStart = parseInt(readFileSync('/proc/sys/net/ipv4/ip_unprivileged_port_start')); |
There was a problem hiding this comment.
Just a nit that you are free to ignore. I would put only readFileSync() in the try...catch.
let unprivilegedPortStart:
try {
unprivilegedPortStart = readFileSync('/proc/sys/net/ipv4/ip_unprivileged_port_start');
} catch {
// Do nothing.
}
if (parseInt(unprivilegedPortStart) <= 42) {
common.skip('Port 42 is unprivileged');
}There was a problem hiding this comment.
I considered that (and even wrote it). The above I dislike a bit because parseInt returns NaN and Nan <=42 which means it'll work but it's very obscure. First thing you think is "isn't this broken"? So you probably want a "unprivilegedPortStart = 1024;" in the catch which is what the scenario REALLY is when the readFileSync fails.
BUT The entire test of minimum ports, etc is irrelevant when that read fails. That indicates the ability to change the minimum doesn't exist hence even considering it is irrelevant.
So I went with "if the read fails, this entire block of code is irrelevant".
There was a problem hiding this comment.
We could be explicit and do
if (unprivilegedPortStart !== undefined && parseInt(unprivilegedPortStart) <= 42) {
common.skip('Port 42 is unprivileged');
}My reasoning is that only things that are expected to throws errors should be in the try block to avoid hiding unexpected exception.
Anyway, it is only a nit. It is ok as is.
Trott
added
author ready
github-actions
bot
removed
the
request-ci
aduh95
added
commit-queue
nodejs-github-bot
removed
the
commit-queue
|
Landed in 024e648 |
An update to test/parallel/test-cluster-bind-privileged-port.js checks the lowest privileged port to ensure 42 is privileged This only works on kernels > 4.1. On older kernels, this is locked at 1024 so the check is not needed. Fixes: #45838 PR-URL: #46536 Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
An update to test/parallel/test-cluster-bind-privileged-port.js checks the lowest privileged port to ensure 42 is privileged This only works on kernels > 4.1. On older kernels, this is locked at 1024 so the check is not needed. Fixes: #45838 PR-URL: #46536 Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
An update to test/parallel/test-cluster-bind-privileged-port.js checks the lowest privileged port to ensure 42 is privileged This only works on kernels > 4.1. On older kernels, this is locked at 1024 so the check is not needed. Fixes: #45838 PR-URL: #46536 Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
An update to test/parallel/test-cluster-bind-privileged-port.js checks the lowest privileged port to ensure 42 is privileged This only works on kernels > 4.1. On older kernels, this is locked at 1024 so the check is not needed.
Fixes: #45838