Repository navigation
fix(test): retry transparent gateway egress check in verify_gateway - #121
Conversation
A single curl attempt against check.torproject.org over a fresh circuit flaked in the daily canary (curl exit 55) although the gateway was healthy; the manual re-run passed. Retry up to 4 times like the other canary egress checks, then fail.
Gateway bootstrap polls waited for /status connected, which additionally requires the external check.torproject.org egress probe. Its intermittent unreachability from CI runners flaked the step (PR #121 smoke run) although Tor reached 100% in seconds. Poll /health tor.progress == 100 instead; egress itself is verified separately by verify_gateway.sh.
MustermenschAlex
left a comment
MustermenschAlex
left a comment
There was a problem hiding this comment.
Solid hardening: retries match the other egress checks, and switching the gateway bootstrap wait to /health tor.progress removes the hidden dependency on the external check service without weakening the actual egress assertion in verify_gateway.sh. All checks green. Approving.
kuenstlichedummheit-sys
left a comment
kuenstlichedummheit-sys
left a comment
There was a problem hiding this comment.
Flake-hunting done right: first the retry, then noticing the bootstrap poll itself was hostage to check.torproject.org. Waiting on progress 100 instead of a full egress round-trip is the honest signal here. Green across the board, ship it.
majorungustl
left a comment
majorungustl
left a comment
There was a problem hiding this comment.
This is exactly how it should be: less coupled to a flaky external service for the bootstrap wait, and the real leak checks stay strict with retries. Small diff, big reliability win. LGTM.
Closes #120
Context
After PR #118 merged and the new image published, the first daily canary run failed in 'Verify Transparent Tor Gateway Mode': the gateway container bootstrapped fine and every netfilter check passed, but the single transparent-egress curl to check.torproject.org died with curl exit 55. A manual re-run of the identical published image passed, and the canary alert (#116) auto-closed — so this was a transient external flake, not a product regression.
Change
tests/integration/verify_gateway.sh now retries the transparent egress check up to 4 times (with curl --retry 2 --retry-all-errors and 3s backoff), matching the HTTP/SOCKS egress checks in the live canary. Any real leak still fails after the retries.
Verification