dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: gateway pre-flight check could never actually fail
Some checks failed
ci / build-test (push) Has been cancelled
Details
ci / docker-build (push) Has been cancelled
Details

Browse Source 
Verified live that after deploying the "fixed" bridge-bound pre-flight, it
still let a known-bad vmbr0+192.168.8.2 config straight through to a full
pct_create with no error. Root cause: the check used
`strings.Contains(pingOut, "REACHABLE")` against markers "REACHABLE" /
"UNREACHABLE" — but "UNREACHABLE" contains "REACHABLE" as a substring, so the
containment check was true for BOTH outcomes. The pre-flight was structurally
incapable of ever failing, regardless of the actual ping result.

Fixed with distinct, non-overlapping markers (PREFLIGHT_OK/PREFLIGHT_FAIL)
and exact-match comparison, pulled into a small gatewayPreflightPassed()
helper with a unit test asserting the exact historical bug case
("UNREACHABLE" must be false) so this bug class can't silently recur.

Re-verified live end-to-end: manually re-tested the exact ping command
(confirmed UNREACHABLE via vmbr0), and this was caught only by actually
running the check against production, not by reading the code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-10 12:02:42 +02:00
parent 3f3de18b23
commit 7a7ce2b89b
2 changed files with 39 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
internal/httpapi/pct_create_test.go
View File

@@ -88,6 +88,32 @@ func TestJSONErrValidForNastyOutput(t *testing.T) {
}
}
// TestGatewayPreflightPassed guards the exact bug found live: "UNREACHABLE"
// contains "REACHABLE" as a substring, so a strings.Contains(out,"REACHABLE")
// check is true for BOTH outcomes and can never fail. Exact-match only.
func TestGatewayPreflightPassed(t *testing.T) {
cases := []struct {
out string
want bool
}{
{"PREFLIGHT_OK", true},
{"PREFLIGHT_OK\n", true},
{" PREFLIGHT_OK ", true},
{"PREFLIGHT_FAIL", false},
{"PREFLIGHT_FAIL\n", false},
{"", false},
{"some garbage output", false},
// the specific historical bug: a naive substring check on the old
// REACHABLE/UNREACHABLE markers would have called this true.
{"UNREACHABLE", false},
}
for _, c := range cases {
if got := gatewayPreflightPassed(c.out); got != c.want {
t.Errorf("gatewayPreflightPassed(%q) = %v, want %v", c.out, got, c.want)
}
}
}
func TestProvisionScript(t *testing.T) {
s := provisionScript([]string{"docker.io", "git"}, "echo hi > /root/x")
// Network/DNS gate must come before apt.

15
internal/httpapi/phase3.go
View File

@@ -439,8 +439,8 @@ func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID,
// actually experience, not what the host's broader routing table can
// reach.
if isStatic && cfg.GW != "" {
pingOut, pingErr := sshExec(ctx, host, user, fmt.Sprintf("ping -I %s -c1 -W2 %s >/dev/null 2>&1 && echo REACHABLE || echo UNREACHABLE", cfg.Bridge, cfg.GW))
if pingErr != nil || !strings.Contains(pingOut, "REACHABLE") {
pingOut, pingErr := sshExec(ctx, host, user, fmt.Sprintf("ping -I %s -c1 -W2 %s >/dev/null 2>&1 && echo PREFLIGHT_OK || echo PREFLIGHT_FAIL", cfg.Bridge, cfg.GW))
if pingErr != nil || !gatewayPreflightPassed(pingOut) {
msg := fmt.Sprintf(
"gateway %s is not reachable from %s on bridge %s — this almost always means the bridge doesn't carry that subnet on this host (each bridge only reaches the network it's physically wired to). "+
"Do not retry with a different gateway guess in the same subnet: find an existing LXC on this host with an IP in the same /28 and copy its exact bridge+gateway, or use DHCP instead.",
@@ -637,6 +637,17 @@ func jsonErr(format string, args ...any) []byte {
// the host's template cache. Exact match wins; a bare distro hint (e.g.
// "debian-13" or "debian") matches by prefix; empty picks the newest debian
// (falling back to any) template available. Returns "" when nothing fits.
// gatewayPreflightPassed interprets the PREFLIGHT_OK/PREFLIGHT_FAIL markers
// from the pct_create gateway pre-flight check. Pulled out as its own
// function (rather than an inline strings.Contains at the call site) so it's
// unit-testable: a prior version checked for "REACHABLE", which is a
// substring of "UNREACHABLE" — the check could never actually fail, and it
// took a live deployment to notice. Exact-match markers plus a test make
// that specific bug class structurally unable to recur silently.
func gatewayPreflightPassed(out string) bool {
return strings.TrimSpace(out) == "PREFLIGHT_OK"
}
func resolveTemplate(requested string, available []string) string {
if len(available) == 0 {
return ""