fix(failover+config): self-heal never-first-packet inputs; hot-reload egress & hook-root flags#27
Merged
Merged
Conversation
…oad SSRF/hook-root flags Failover: - manager: an active input that connects but never delivers a packet now times out and fails over. collectTimeoutIfNeeded no longer gates on StatusActive — it fires for the active input on packet silence past the timeout regardless of status (excluded only while a failover is already in flight). Register stamps LastPacketAt on each input so the window measures connect-to-first-packet as a grace period. Closes the connects-but-no-packets blind spot noted as an A-5 follow-up. - ingestor worker: dial errors blocked by the egress guard are classified as fail-immediately, so a rejected input reports the error and triggers failover instantly instead of reconnect-looping silently. Config hot-reload (previously boot-captured, needed a restart): - ingestor: allow_private_targets is read live. Service holds its config in an atomic.Pointer (SetConfig/currentCfg); pull readers are built from currentCfg on each start/switch; runtime.diff calls Ingestor.SetConfig on config change. - hooks: file_root_dir is read live. Service holds its config in an atomic.Pointer (SetConfig/FileRootDir); the REST handler reads the root per request instead of caching at boot; runtime.diff calls HooksSvc.SetConfig on config change. Tests: never-active timeout + within-grace cases, egress-blocked fail-fast case, ingestor/hooks SetConfig hot-swap, handler in/out-of-root file-target enforcement. make check green (vet + lint + test -race).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two related operational fixes found while testing the merged security batch.
1. Failover now covers inputs that connect but never deliver a packet
Previously a switched-to input (manual switch or auto-failover) that opened the connection but never produced a packet stayed non-Active forever, so the packet-timeout monitor never fired and the stream froze with no failover.
collectTimeoutIfNeededno longer gates onStatusActive. It fires for the active input whenever packet silence exceeds the timeout, regardless of status (excluded only while a failover is already in flight).RegisterstampsLastPacketAton each input so the timeout window measures connect-to-first-packet as a grace period.2. Config flags are now hot-reloadable (were boot-captured, needed a restart)
allow_private_targets: held in anatomic.Pointer(SetConfig/currentCfg); pull readers are built from the live config on each start/switch;runtime.diffpushes the new value on config change.file_root_dir: held in anatomic.Pointer(SetConfig/FileRootDir); the REST handler reads the root per request instead of caching at boot;runtime.diffpushes the new value on config change.Tests
Never-active timeout + within-grace cases, egress-blocked fail-fast case, ingestor/hooks
SetConfighot-swap, and handler in/out-of-root file-target enforcement.make checkgreen (vet + lint + test -race).Audit doc updated: A-5 follow-up marked fixed; hot-reload notes added to the S-2 / S-4 residuals.