Cyrene
aa0bb45633
Three independent root causes, all found by measuring instead of assuming:
1. SSH failed on 10/16 challenges while state.json looked perfect.
Only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password nobody
used -> 'Permission denied' on every team. Registry gains a per-challenge
'ssh_user'; chpasswd targets the real login and reports failures loudly.
2. phew SLA timed out on a healthy service, four bugs stacked:
- chall.py block-buffers stdout through the exec pipe (PYTHONUNBUFFERED now
set) and does a fresh Pailier keygen (~12 s) before printing its menu;
- _read_until read a TEXT pipe, so read(1) pulled 8 KB into Python's
TextIOWrapper buffer and select() then blocked on data already in memory;
- its buffer was per-call, so the read satisfying 'pt (hex)' also swallowed
the '> ' the next call waited for -> a race that failed intermittently;
- reaping killed chall.py it did not own: a blanket pkill -f, a
snapshot-diff (concurrent sessions diff against the same pre-spawn set),
and a class-level _children shared across uvicorn's thread pool. The child
now prints its own pid so exactly one session is reaped.
Also: ONE interactive session per check instead of five spawns (Paillier is
randomized per ciphertext, not per process) - 5 keygens were the CPU load
that starved the checks. And the 6 orphan single-node containers from the
original deploy were removed; one held 58 leaked chall.py and drove load
average 76 on 2 CPUs.
3. missing_sidecars() matched compose-generated names (teamN-<svc>-1) while
every service sets an explicit container_name, so it reported all 16 running
challenges as missing and hid the one real gap (anti-alchemy-db, which has
no container_name). Now reads container_name when present and falls back to
the compose default otherwise.
Verified: 64/64 SLA across 4 teams; 64/64 real SSH logins succeed with
correct <chall>_teamN hostnames; phew 3/3 sequential with no process leak.
Adds panel/verify_ssh_creds.py, audit_ssh_users.sh, reset_runtime.sh,
sla_sweep.sh, fix_sidecars.sh, phew_concurrency_test.sh, exec_probe_i.py.
34 lines
964 B
Bash
34 lines
964 B
Bash
#!/usr/bin/env bash
|
|
# Bring up only the MISSING sidecars of each team (compose default `up -d`
|
|
# would also rebuild the 16 main services, which is slow and unnecessary).
|
|
set -uo pipefail
|
|
BASE=/opt/gemastik18-final
|
|
cd "$BASE/panel"
|
|
for t in 1 2 3 4; do
|
|
missing=$(python3 -c "
|
|
import sys; sys.path.insert(0,'.')
|
|
import teams
|
|
print(' '.join(teams.missing_sidecars($t)))
|
|
" 2>/dev/null)
|
|
if [ -z "$missing" ]; then
|
|
echo "team$t: nothing missing"
|
|
continue
|
|
fi
|
|
echo "team$t missing: $missing"
|
|
# map container name -> compose service name
|
|
for cont in $missing; do
|
|
svc=${cont#team${t}-}
|
|
svc=${svc%-1}
|
|
echo " starting $svc"
|
|
(cd "$BASE/teams/team$t/services" && \
|
|
docker compose -p "team$t" -f docker-compose.yml up -d --no-deps "$svc" 2>&1 | tail -2)
|
|
done
|
|
done
|
|
echo "=== verify ==="
|
|
python3 -c "
|
|
import sys; sys.path.insert(0,'.')
|
|
import teams
|
|
for i in (1,2,3,4):
|
|
print('team%d still missing:' % i, teams.missing_sidecars(i))
|
|
"
|