Improves failure mode by explicitly making returning an error when the
provided cert fingerprint is invalid. The previously existing behavior
of creating a transport that fails all connection verification, is often
hard to troubleshoot.
Improve bad fingerprint test cases.
- use struct field initialization idiom
- clarify error message
- directly use s.rootctx in server request processing
- refactor: use require in e2e ACL test
- inline constant definition
- modernize with `strings.Cut`
- modernize with slices.Backward
- simplify timeFormat initialization
- refactor testing: check `Scanner.Err()` in testenv
- remove spurious parenthesis
- trueStr and falseStr consts
- use inheritPolicyString
- use const in cache info
- "bytes" const in ui task counters
- use common consts in gettool
Add hash size check
Better error reporting by checking the hash size prior to attempting
validation.
Check bad fingerprint hash values
E2E client test for TLS checking
Use a server/client flow to check that TLS certs are checked if the
connection is resumed.
Fixes for new linter warnings:
- fix: add //nolint annotations where it makes sense
- fix: remove no-longer necessary linter annotations
- fix linter: add or remove new lines
- fix linter: use Fprintf instead of WriteString
- fix: check for overflow in conversion to uint8 / byte
Make GetCapacity available over gRPC
Makes the `volume.GetCapacity()` available over gRPC as
`repository.GetCapacity()`
Tests included
---------
- Author: @andrason
- add guards to `MaybeCompactSingleEpoch()`
- add logs and a comment to edge cases
- added new test cases in MaybeCompactSingleEpoch
Authored by @andrason
Authored by @andrason
---------
Co-authored-by: andrason <andrason@users.noreply.github.com>
- fix and reword comments
- unexport `writeKopiaRepositoryBlobWithID`
- remove redundant function declaration in interface
- minor rewording to fix incomplete sentence in documentation
Add fadvise hints to backup read path to reduce OS cache pollution
Issue FADV_SEQUENTIAL at open and FADV_DONTNEED at close for every file read during backup. This tells the kernel to read-ahead aggressively and then reclaim pages once the file is fully consumed, reducing cache pressure from large backups without adding measurable overhead.
Uses SyscallConn().Control() instead of os.File.Fd() to avoid switching file descriptors to blocking mode, which would remove them from Go's epoll poller and stall the upload pipeline.
Incremental FADV_DONTNEED during reads was tested and removed — it adds ~15% overhead on large-file workloads by fighting the kernel's own LRU. Restore write-path cache eviction was also tested and not included.
Authored-by: Rajat Gupta rajat.gupta@veeam.com
Create helper functions that can seed state for epoch manager tests.
Test basic cases of getting the active set of blobs. This indirectly
tests the fallback logic that ensures all epochs are covered when
returning the active set.
Authored-by: @ashmrtn
Update tests to make the same calls made during full maintenance. This
makes the tests more similar to how they used to be before some calls,
like index compaction and write epoch advancement, were moved to the
maintenance code path.
Authored-by: ashmrtn <3891298+ashmrtn@users.noreply.github.com>
- additional test cases for epoch selection
- helper to derive oldest not compacted epoch
- fix selection of next epoch to compact
- cleanup: remove unused code and tests
- fixes#5371
* feat(cli): restrict insecure unauthenticated server to loopback binds
Reject starting the server with --insecure and --without-password when
--address would bind outside loopback (including empty host / all
interfaces). Validate the actual listener after Listen so systemd socket
activation cannot bypass the check.
Add hidden --allow-extremely-dangerous-unauthenticated-server-on-the-network
to opt into the previous behavior for isolated environments.
Extract validation into internal/insecureserverbind with table-driven tests.
Add end-to-end smoke tests for rejection and escape hatch.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Update internal/insecureserverbind/insecureserverbind.go
Co-authored-by: Julio López <1953782+julio-lopez@users.noreply.github.com>
* pr feedback
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Julio López <1953782+julio-lopez@users.noreply.github.com>
- make benchmarking params uint
- prevent error in compression benchmarking
- lint on Windows and address linter warnings
- upgrade golang.org/x/exp
- upgrade github.com/cncf/xds/go
- upgrade github.com/dustinkirkland/golang-petname
- direct users to forum
- add warning about _recovery recipes_
Minor robustness improvements
- add safety check when converting file descriptor (`os.File.Fd()`) to `int`
- check that file descriptor returned by Open (on Linux) is non-negative before converting to `uintptr`. This addresses a linter warning for a most-likely-non-existent-edge-case of converting a negative file descriptor.
- check that parsed content IDs (hashes) do not exceed the maximum id hash length.
- add nolint annotation for safe conversion
Minor improvements:
Refactor the construction of a test string with many control characters in `TestJSONWriter_StringEscapingPerformanceWithManyControlChars` by using a `strings.Builder`.
Rationale: address a future `modernize` linter warning. While this is also "more" efficient, it does not make any practical difference in this context.
Simplify the conversion of a short flag to a string in `emitFlags` by removing an unnecessary byte slice conversion (`tools/cli2md/cli2md.go`).
Rationale: simplify the expression for clarity and address a future linter warning.
- Ref: #5247
Cleanup nits:
- get error handling policy upfront and improve readability in uploader
- update error message
- update field documentation and update flag description
- remove unused function
- const `isWindows` and remove redundant condition check
- add `getEnvVarBool` helper
- refactor common helper for mockfs.AddError* functions, and
add mockfs.AddErrorEntry<Type> wrappers for clarity.
- removed list of skipped tests from gotestsum summary
- Move MaybePrefixLongFilenameOnWindows to ospath package and rename
it to SafeLongFilename, along with corresponding test.
- Elide the function implementation at build time on non-Windows
platforms.
- Update documentation and comments for clarity.
- Rename package-local helper function.
Adjusts tests accordingly.
Also,
- fix error injection for MkdirAll in tests.
- make `TestFileStorageTouch` more robust.
- misc cleanups in FS storage tests
Make purpose parameter a string.
Refactor TestDeriveKeyFromMasterKey
- make variables local to the test and rename accordingly
- make the purpose a `const (untyped) string`
Julio López