Skip to content

fix(dnstap source): don't delete the socket file during config validation#25538

Open
xfocus3 wants to merge 2 commits into
vectordotdev:masterfrom
xfocus3:fix/dnstap-validate-socket-25513
Open

fix(dnstap source): don't delete the socket file during config validation#25538
xfocus3 wants to merge 2 commits into
vectordotdev:masterfrom
xfocus3:fix/dnstap-validate-socket-25513

Conversation

@xfocus3
Copy link
Copy Markdown

@xfocus3 xfocus3 commented May 30, 2026

Summary

Closes #25513.

vector validate -d (documented as a dry-run) deleted the Unix socket file of any running dnstap source in mode: unix, killing the source's accept loop.

Root cause

build_framestream_unix_source() (src/sources/util/framestream.rs) removed any existing file at the socket path and bound the listener eagerly, before constructing the source future:

match fs::metadata(&path) { Ok(_) => { fs::remove_file(&path)?; } ... };
let listener = UnixListener::bind(&path)?;

This is fine for a real startup, but vector validate instantiates all components (via TopologyPiecesBuilder::build()) to validate them — which runs this destructive code against the live socket of a separate, already-running Vector instance.

Fix

Move the socket setup (stale-file removal, bind, buffer-size sockopts, permission changes) into the returned source future, so it only executes when the source actually starts — not when it's built/validated. This matches how the other unix sources already work (util/unix_stream.rs, util/unix_datagram.rs bind inside Box::pin(async move { ... })).

Build/validation errors are now logged and surfaced as a source failure (Err(())) inside the future, consistent with the other unix sources.

How did you test this PR?

  • Added a regression test (build_unix_source_does_not_remove_existing_socket) that creates a file at the socket path, builds the source, and asserts the file still exists after build (it is only managed when the future runs).
  • All existing framestream tests pass: cargo test --lib --no-default-features --features sources-dnstap sources::util::framestream::test → 12 passed.
  • cargo check, cargo clippy -- -D warnings, and cargo fmt --check pass for the sources-dnstap feature.

…tion

The framestream-based unix source removed any existing socket file and
bound the listener eagerly while the source was being built. Component
instantiation happens during `vector validate`, so validating a config
deleted the socket file of an already-running dnstap source (mode: unix),
killing it.

Move the socket setup (stale-file removal, bind, buffer sizes, permissions)
into the source future so it only runs when the source actually starts,
matching the other unix sources. Validation no longer has this destructive
side effect.

Closes vectordotdev#25513
@xfocus3 xfocus3 requested a review from a team as a code owner May 30, 2026 15:45
@github-actions github-actions Bot added the domain: sources Anything related to the Vector's sources label May 30, 2026
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 39e4b5ea3e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +759 to +760
if let Some(socket_permission) = frame_handler.socket_file_mode() {
if !(448..=511).contains(&socket_permission) {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve validation of invalid socket_file_mode

With this check now inside the returned source future, build_framestream_unix_source returns Ok during component construction for configs such as a dnstap unix source with socket_file_mode = 0o600; vector validate will therefore pass a config that immediately fails when the source starts. The destructive socket operations need to be deferred, but this non-destructive mode validation should still happen during build/config validation or in a dedicated config validator.

Useful? React with 👍 / 👎.

The changelog fragment uses 'framestream' (the frame streams protocol the
dnstap source is built on), which the spell-checker doesn't recognize.
@github-actions github-actions Bot added the domain: ci Anything related to Vector's CI environment label May 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

domain: ci Anything related to Vector's CI environment domain: sources Anything related to the Vector's sources

Projects

None yet

Development

Successfully merging this pull request may close these issues.

vector validate -d deletes Unix socket of running dnstap source (destructive side-effect in dry-run)

1 participant