From 0353e8797c05aa3ff109bb11cd4dabde7199e818 Mon Sep 17 00:00:00 2001 From: rosstimothy <39066650+rosstimothy@users.noreply.github.com> Date: Tue, 17 Feb 2026 15:26:17 -0500 Subject: [PATCH] [fix] panic on failure in TestHSMRevert (#63802) Removes shadowing of the auth1 variable to ensure that cleanup always happens on a valid and non-nil teleport process. ``` panic: runtime error: invalid memory address or nil pointer dereference [recovered, repanicked] [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x181445ee] goroutine 20184 [running]: testing.tRunner.func1.2({0x18f7e9c0, 0x232a1910}) /opt/go/src/testing/testing.go:1872 +0x419 testing.tRunner.func1() /opt/go/src/testing/testing.go:1875 +0x683 panic({0x18f7e9c0?, 0x232a1910?}) /opt/go/src/runtime/panic.go:783 +0x132 github.com/gravitational/teleport/integration/hsm.TestHSMRevert.func1() /__w/teleport/teleport/integration/hsm/hsm_test.go:557 +0x6e testing.(*common).Cleanup.func1() /opt/go/src/testing/testing.go:1308 +0x169 testing.(*common).runCleanup(0xc002a336c0, 0x0) /opt/go/src/testing/testing.go:1572 +0x226 testing.tRunner.func2() /opt/go/src/testing/testing.go:1928 +0x4d runtime.Goexit() /opt/go/src/runtime/panic.go:615 +0x5e testing.(*common).FailNow(0xc002a336c0) /opt/go/src/testing/testing.go:1013 +0x7b github.com/stretchr/testify/require.NoError({0x1beac6e8, 0xc002a336c0}, {0x1be434a0, 0xc0030987e0}, {0x0, 0x0, 0x0}) /go/pkg/mod/github.com/stretchr/testify@v1.11.1/require/require.go:1401 +0xe4 github.com/gravitational/teleport/integration/hsm.TestHSMRevert(0xc002a336c0) /__w/teleport/teleport/integration/hsm/hsm_test.go:567 +0x6e5 testing.tRunner(0xc002a336c0, 0x1abea740) /opt/go/src/testing/testing.go:1934 +0x21d created by testing.(*T).Run in goroutine 1 /opt/go/src/testing/testing.go:1997 +0x9d3 ``` --- integration/hsm/hsm_test.go | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/integration/hsm/hsm_test.go b/integration/hsm/hsm_test.go index 5535aec038e..9a46df92411 100644 --- a/integration/hsm/hsm_test.go +++ b/integration/hsm/hsm_test.go @@ -549,27 +549,28 @@ func TestHSMRevert(t *testing.T) { ctx := t.Context() log := logtest.With(teleport.ComponentKey, "TestHSMRevert") + // Start auth with an HSM attached and generate HSM keys. log.DebugContext(ctx, "starting auth server") - auth1Config := newHSMAuthConfig(t, liteBackendConfig(t), log, clock) - auth1, err := newTeleportService(ctx, auth1Config, "auth1") + authConfig := newHSMAuthConfig(t, liteBackendConfig(t), log, clock) + hsmAuth, err := newTeleportService(ctx, authConfig, "auth1") require.NoError(t, err) + require.NoError(t, hsmAuth.process.Close()) + require.NoError(t, hsmAuth.waitForShutdown(ctx)) t.Cleanup(func() { - assert.NoError(t, auth1.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil), + assert.NoError(t, hsmAuth.process.GetAuthServer().GetKeyStore().DeleteUnusedKeys(ctx, nil), "failed to delete hsm keys during test cleanup") - assert.NoError(t, auth1.cleanup()) + assert.NoError(t, hsmAuth.cleanup()) }) // Switch config back to default (software) and restart. - auth1.process.Close() - require.NoError(t, auth1.waitForShutdown(ctx)) - auth1Config.Auth.KeyStore = servicecfg.KeystoreConfig{} - auth1, err = newTeleportService(ctx, auth1Config, "auth1") + authConfig.Auth.KeyStore = servicecfg.KeystoreConfig{} + softwareAuth, err := newTeleportService(ctx, authConfig, "auth1") require.NoError(t, err) // Make sure a cluster alert is created. var alert types.ClusterAlert require.EventuallyWithT(t, func(t *assert.CollectT) { - alerts, err := auth1.process.GetAuthServer().GetClusterAlerts(ctx, types.GetClusterAlertsRequest{}) + alerts, err := softwareAuth.process.GetAuthServer().GetClusterAlerts(ctx, types.GetClusterAlertsRequest{}) require.NoError(t, err) require.Len(t, alerts, 1) alert = alerts[0] @@ -580,7 +581,7 @@ func TestHSMRevert(t *testing.T) { assert.Contains(t, alert.Spec.Message, "The Auth Service is currently unable to sign certificates") rotate := func(caType types.CertAuthType, targetPhase string) error { - return auth1.process.GetAuthServer().RotateCertAuthority(ctx, types.RotateRequest{ + return softwareAuth.process.GetAuthServer().RotateCertAuthority(ctx, types.RotateRequest{ Type: caType, TargetPhase: targetPhase, Mode: types.RotationModeManual, @@ -599,7 +600,7 @@ func TestHSMRevert(t *testing.T) { if targetPhase == types.RotationPhaseInit { expectedEvent = service.TeleportPhaseChangeEvent } - require.NoError(t, auth1.waitingForNewEvent(ctx, expectedEvent, func() error { + require.NoError(t, softwareAuth.waitingForNewEvent(ctx, expectedEvent, func() error { return rotate(caType, targetPhase) })) } else { @@ -613,7 +614,7 @@ func TestHSMRevert(t *testing.T) { // auth.AutoRotateCertAuthorities which reconciles the alert state. clock.Advance(2 * defaults.HighResPollingPeriod) assert.EventuallyWithT(t, func(t *assert.CollectT) { - alerts, err := auth1.process.GetAuthServer().GetClusterAlerts(ctx, types.GetClusterAlertsRequest{}) + alerts, err := softwareAuth.process.GetAuthServer().GetClusterAlerts(ctx, types.GetClusterAlertsRequest{}) assert.NoError(t, err) assert.Empty(t, alerts)