fix: clamp pull_conns; surface silent reseed skips; test the retry rule

- EffectivePullConns was only lower-bounded; a misconfigured pull_conns
  (e.g. 100000) fanned out that many connections/goroutines and
  exhausted fds. Clamp to maxPullConns (64). splitRanges also guards
  n<1 so it can never divide by zero.
- The no-vsock skip on the auto clone/restore path logged at Debug, so a
  legacy VM silently kept the snapshot's CRNG state. Warn instead.
- Add TestReseedVM_AgentRejectionNotRetried: a mock agent that answers
  then rejects proves a live reply is final and not billed the dial
  retry budget (the exact rule 2010949 introduced, previously untested).

Author: CMGS

cmd/vm/reseed.go

@@ -92,7 +92,8 @@ func signalReseed(ctx context.Context, vm *types.VM, regenMachineID bool) bool {
 		return false
 	}
 	if vm.VsockSocket == "" {
-		logger.Debug(ctx, "skip reseed signal: vsock not configured")
+		// Not Debug: a legacy VM silently keeps the snapshot's CRNG state.
+		logger.Warnf(ctx, "skip reseed for %s: no vsock; this clone keeps the snapshot's CRNG state — recreate the VM to enable the agent", vm.ID)
 		return false
 	}
 	if err := reseedVM(ctx, vm, regenMachineID); err != nil {

cmd/vm/reseed_test.go

@@ -1,10 +1,19 @@
 package vm
 
 import (
+	"bufio"
 	"context"
 	"errors"
+	"io"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
 	"testing"
 
+	"github.com/cocoonstack/cocoon-agent/agent"
+
 	"github.com/cocoonstack/cocoon/types"
 )
 
@@ -39,3 +48,51 @@ func TestReseedVM_CtxCanceled(t *testing.T) {
 		t.Fatalf("got err=%v, want context.Canceled", err)
 	}
 }
+
+// TestReseedVM_AgentRejectionNotRetried pins the dial-vs-rejection distinction:
+// once the agent answers, its reply is final and must not be billed the retry budget.
+func TestReseedVM_AgentRejectionNotRetried(t *testing.T) {
+	// A short dir: unix socket paths are capped at ~104 bytes, which t.TempDir() blows past.
+	dir, err := os.MkdirTemp("/tmp", "rsd")
+	if err != nil {
+		t.Fatalf("temp dir: %v", err)
+	}
+	defer func() { _ = os.RemoveAll(dir) }()
+	sock := filepath.Join(dir, "s.sock")
+	ln, err := net.Listen("unix", sock)
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer func() { _ = ln.Close() }()
+
+	var accepts atomic.Int32
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			accepts.Add(1)
+			br := bufio.NewReader(conn)
+			_, _ = br.ReadString('\n')            // CONNECT <port>
+			_, _ = io.WriteString(conn, "OK 1\n") // hybrid-vsock handshake ack
+			_, _ = br.ReadString('\n')            // reseed opening frame
+			// A live agent rejects (e.g. version skew); reseedVM must surface it, not retry.
+			_ = agent.NewEncoder(conn).Encode(agent.Message{Type: agent.MsgError, Message: "version skew"})
+			_ = conn.Close()
+		}
+	}()
+
+	vm := &types.VM{ID: "vm1", VsockSocket: sock}
+	err = reseedVM(t.Context(), vm, false)
+	if err == nil || !strings.Contains(err.Error(), "version skew") {
+		t.Fatalf("err = %v, want it to carry the agent's rejection", err)
+	}
+	_ = ln.Close()
+	<-done
+	if n := accepts.Load(); n != 1 {
+		t.Errorf("agent accepted %d times; a live rejection must not be retried (want 1)", n)
+	}
+}

config/config.go

@@ -16,6 +16,8 @@ const (
 
 	// defaultPullConns is the default concurrent Range connections per cloud-image download.
 	defaultPullConns = 8
+	// maxPullConns caps it so a misconfigured pull_conns can't exhaust file descriptors.
+	maxPullConns = 64
 )
 
 // HypervisorType identifies the selected hypervisor backend.
@@ -69,9 +71,9 @@ func (c *Config) EffectivePoolSize() int {
 	return utils.PoolSizeOrDefault(c.PoolSize)
 }
 
-// EffectivePullConns returns PullConns if set, otherwise defaultPullConns.
+// EffectivePullConns returns PullConns (defaultPullConns when unset) clamped to maxPullConns.
 func (c *Config) EffectivePullConns() int {
-	return utils.OrDefault(c.PullConns, defaultPullConns)
+	return min(utils.OrDefault(c.PullConns, defaultPullConns), maxPullConns)
 }
 
 // Validate checks that all config fields are within acceptable ranges.

images/cloudimg/pull.go

@@ -313,6 +313,9 @@ func hashDigest(dst *os.File) (string, error) {
 
 // splitRanges divides [0,size) into up to n contiguous, inclusive-ended byte ranges.
 func splitRanges(size int64, n int) []byteRange {
+	if n < 1 {
+		n = 1
+	}
 	chunk := (size + int64(n) - 1) / int64(n)
 	ranges := make([]byteRange, 0, n)
 	for start := int64(0); start < size; start += chunk {