mirror of
https://github.com/zap-proto/zip.git
synced 2026-10-19 15:38:57 +00:00
zeekayandHanzo Dev
e7a4b06a6c
forward() overwrote the Host header with the DIAL ADDRESS on every proxied request. A client dials its own address — HostClient.Addr, zaphttp.Dial(addr) — and never reads this header to find the far end, so that value was not routing anything. It was destroying the one fact a child needs to serve more than one brand: which host was asked. hanzoai/iam is where it showed. It serves every brand from one instance and resolves each brand's OIDC issuer from the request Host, so mounted as a plugin child it was asked as "/var/lib/cloud/run/iam.sock", matched no brand, and fell back to its single default — lux.id and zoolabs.id minting tokens claiming iss=hanzo.id, which their own relying parties reject. Config could not reach it: the brand map was in the child's environment and the Host never arrived. The dial address stays the fallback for a request carrying no Host of its own (the MCP hop builds a fresh one), because HTTP/1.1 requires the header. Read through req.Header.Host() rather than req.Host(): the latter goes through the URI, which parses on first touch — 34 allocations on a hop that is meant to cost none, which the alloc gate catches. And a request that already has a Host is now left ALONE rather than re-set. The test measures the SERIALIZED request. fasthttp writes the Host header from the URI once the URI has been parsed, so reading either field in memory can disagree with what actually goes over the wire; serializing is the only reading that cannot. It fails on the old code and passes on this one. Also: every test that binds a unix socket now does it in a short directory. A socket address is 104 bytes on Darwin and t.TempDir spends most of them on the test's own name, so 9 tests failed with "never began listening" — which reads as a timing bug, is green on Linux, red on every Mac, and breaks when a test is RENAMED. Suite goes 11 red to 2, both of which are pre-existing and platform: SO_PEERCRED (no LOCAL_PEERCRED path on macOS) and the alloc gate, which fails on pristine v1.27.1 when run in isolation. Co-authored-by: Hanzo Dev <[email protected]>
25 lines
697 B
Go
25 lines
697 B
Go
package zip
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
)
|
|
|
|
// sockDir is a directory a unix socket can bind in.
|
|
//
|
|
// t.TempDir cannot be used for one: a socket address is 104 bytes on Darwin
|
|
// (108 on Linux) and t.TempDir spends most of them on the TEST'S OWN NAME, so a
|
|
// test with a descriptive name fails to bind with EINVAL — reported as "never
|
|
// began listening", which reads like a timing bug and is not. It is green on
|
|
// Linux, red on every Mac, and a test that passes today breaks when a test is
|
|
// RENAMED.
|
|
func sockDir(t testing.TB) string {
|
|
t.Helper()
|
|
d, err := os.MkdirTemp("", "zt")
|
|
if err != nil {
|
|
t.Fatalf("socket dir: %v", err)
|
|
}
|
|
t.Cleanup(func() { _ = os.RemoveAll(d) })
|
|
return d
|
|
}
|