307 lines
10 KiB
Rust
307 lines
10 KiB
Rust
use std::{
|
|
io::{self, ErrorKind, Read, Write},
|
|
path::{Component, Path, PathBuf},
|
|
};
|
|
|
|
use cap_fs_ext::{
|
|
DirExt, FollowSymlinks, MetadataExt as CrossPlatformMetadataExt, OpenOptionsFollowExt,
|
|
};
|
|
use cap_std::{
|
|
ambient_authority,
|
|
fs::{Dir, File, OpenOptions, Permissions},
|
|
};
|
|
use uuid::Uuid;
|
|
|
|
use crate::{SyncClientError, device_api::is_subject_id};
|
|
|
|
const OWNER_FILE: &str = ".sync-owner-user-id";
|
|
const OWNER_TEMP_PREFIX: &str = ".sync-owner-tmp-";
|
|
const MAX_SUBJECT_ID_BYTES: usize = 128;
|
|
|
|
#[derive(Clone, Debug)]
|
|
pub struct SyncOwnerStore {
|
|
root: PathBuf,
|
|
}
|
|
|
|
impl SyncOwnerStore {
|
|
pub fn new(browser_data_root: &Path) -> Self {
|
|
Self { root: browser_data_root.to_path_buf() }
|
|
}
|
|
|
|
pub fn claim(&self, user_id: &str) -> Result<(), SyncClientError> {
|
|
validate_subject_id(user_id)?;
|
|
let directory = open_root(&self.root, true)?
|
|
.ok_or_else(|| storage("browser data root is unavailable"))?;
|
|
if let Some(owner) = read_owner(&directory)? {
|
|
return verify_owner(&owner, user_id);
|
|
}
|
|
persist_owner(&directory, user_id)
|
|
}
|
|
|
|
pub fn verify(&self, user_id: &str) -> Result<(), SyncClientError> {
|
|
validate_subject_id(user_id)?;
|
|
let Some(directory) = open_root(&self.root, false)? else {
|
|
return Err(SyncClientError::SyncOwnerUnclaimed);
|
|
};
|
|
let owner = read_owner(&directory)?.ok_or(SyncClientError::SyncOwnerUnclaimed)?;
|
|
verify_owner(&owner, user_id)
|
|
}
|
|
}
|
|
|
|
fn persist_owner(directory: &Dir, user_id: &str) -> Result<(), SyncClientError> {
|
|
let temporary = format!("{OWNER_TEMP_PREFIX}{}", Uuid::now_v7().simple());
|
|
let mut options = private_open_options();
|
|
options.write(true).create_new(true);
|
|
let mut file = directory.open_with(&temporary, &options).map_err(storage_io)?;
|
|
validate_private_file(&file)?;
|
|
set_private_file_permissions(&file)?;
|
|
let write_result = file
|
|
.write_all(user_id.as_bytes())
|
|
.and_then(|()| file.write_all(b"\n"))
|
|
.and_then(|()| file.sync_all());
|
|
drop(file);
|
|
if let Err(error) = write_result {
|
|
let _ = remove_temporary(directory, &temporary);
|
|
return Err(storage_io(error));
|
|
}
|
|
|
|
match publish_owner(directory, &temporary) {
|
|
Ok(()) => sync_directory(directory)?,
|
|
Err(error) if error.kind() == ErrorKind::AlreadyExists => {
|
|
remove_temporary(directory, &temporary)?;
|
|
}
|
|
Err(error) => {
|
|
let _ = remove_temporary(directory, &temporary);
|
|
return Err(storage_io(error));
|
|
}
|
|
}
|
|
let owner = read_owner(directory)?.ok_or_else(|| storage("sync owner disappeared"))?;
|
|
verify_owner(&owner, user_id)
|
|
}
|
|
|
|
fn read_owner(directory: &Dir) -> Result<Option<String>, SyncClientError> {
|
|
let mut options = private_open_options();
|
|
options.read(true);
|
|
let file = match directory.open_with(OWNER_FILE, &options) {
|
|
Ok(file) => file,
|
|
Err(error) if error.kind() == ErrorKind::NotFound => return Ok(None),
|
|
Err(error) => return Err(storage_io(error)),
|
|
};
|
|
validate_private_file(&file)?;
|
|
let mut bytes = Vec::new();
|
|
file.into_std()
|
|
.take((MAX_SUBJECT_ID_BYTES + 2) as u64)
|
|
.read_to_end(&mut bytes)
|
|
.map_err(storage_io)?;
|
|
if bytes.len() > MAX_SUBJECT_ID_BYTES + 1 || bytes.last() != Some(&b'\n') {
|
|
return Err(storage("sync owner record is invalid"));
|
|
}
|
|
bytes.pop();
|
|
let owner = String::from_utf8(bytes).map_err(|_| storage("sync owner record is invalid"))?;
|
|
validate_subject_id(&owner)?;
|
|
Ok(Some(owner))
|
|
}
|
|
|
|
fn open_root(path: &Path, create: bool) -> Result<Option<Dir>, SyncClientError> {
|
|
let mut root = PathBuf::new();
|
|
let mut names = Vec::new();
|
|
for component in path.components() {
|
|
match component {
|
|
Component::Prefix(prefix) => root.push(prefix.as_os_str()),
|
|
Component::RootDir => root.push(std::path::MAIN_SEPARATOR_STR),
|
|
Component::Normal(name) => names.push(name.to_os_string()),
|
|
Component::CurDir => {}
|
|
Component::ParentDir => return Err(storage("browser data root traversal is invalid")),
|
|
}
|
|
}
|
|
if root.as_os_str().is_empty() {
|
|
return Err(storage("browser data root must be absolute"));
|
|
}
|
|
let mut directory = Dir::open_ambient_dir(root, ambient_authority()).map_err(storage_io)?;
|
|
#[cfg(windows)]
|
|
let strict_component = names.len().saturating_sub(4);
|
|
#[cfg(windows)]
|
|
let mut require_nofollow = false;
|
|
#[cfg(windows)]
|
|
let mut component_index = 0;
|
|
#[cfg(not(windows))]
|
|
let mut require_nofollow = directory_requires_nofollow(&directory)?;
|
|
for name in names {
|
|
#[cfg(windows)]
|
|
{
|
|
require_nofollow |= component_index >= strict_component;
|
|
component_index += 1;
|
|
}
|
|
if create {
|
|
match directory.create_dir(&name) {
|
|
Ok(()) => {}
|
|
Err(error) if error.kind() == ErrorKind::AlreadyExists => {}
|
|
Err(error) => return Err(storage_io(error)),
|
|
}
|
|
}
|
|
let opened = match directory.open_dir_nofollow(&name) {
|
|
Ok(directory) => directory,
|
|
Err(_) if !require_nofollow => match directory.open_dir(&name) {
|
|
Ok(directory) => directory,
|
|
Err(error) if !create && error.kind() == ErrorKind::NotFound => return Ok(None),
|
|
Err(error) => return Err(storage_io(error)),
|
|
},
|
|
Err(error) if !create && error.kind() == ErrorKind::NotFound => return Ok(None),
|
|
Err(error) => return Err(storage_io(error)),
|
|
};
|
|
#[cfg(not(windows))]
|
|
{
|
|
require_nofollow |= directory_requires_nofollow(&opened)?;
|
|
}
|
|
directory = opened;
|
|
}
|
|
validate_private_directory(&directory)?;
|
|
if create {
|
|
set_private_directory_permissions(&directory)?;
|
|
}
|
|
Ok(Some(directory))
|
|
}
|
|
|
|
fn private_open_options() -> OpenOptions {
|
|
let mut options = OpenOptions::new();
|
|
options.follow(FollowSymlinks::No);
|
|
#[cfg(unix)]
|
|
{
|
|
use cap_std::fs::OpenOptionsExt;
|
|
options.mode(0o600);
|
|
}
|
|
options
|
|
}
|
|
|
|
fn validate_private_directory(directory: &Dir) -> Result<(), SyncClientError> {
|
|
let metadata = directory.dir_metadata().map_err(storage_io)?;
|
|
if !metadata.is_dir() {
|
|
return Err(storage("browser data root is invalid"));
|
|
}
|
|
#[cfg(unix)]
|
|
{
|
|
use cap_std::fs::MetadataExt;
|
|
if metadata.uid() != rustix::process::geteuid().as_raw() {
|
|
return Err(storage("browser data root ownership is invalid"));
|
|
}
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
fn validate_private_file(file: &File) -> Result<(), SyncClientError> {
|
|
let metadata = file.metadata().map_err(storage_io)?;
|
|
if !metadata.is_file() || CrossPlatformMetadataExt::nlink(&metadata) != 1 {
|
|
return Err(storage("sync owner record is invalid"));
|
|
}
|
|
#[cfg(unix)]
|
|
{
|
|
use cap_std::fs::MetadataExt;
|
|
if metadata.uid() != rustix::process::geteuid().as_raw() || metadata.mode() & 0o077 != 0 {
|
|
return Err(storage("sync owner record permissions are invalid"));
|
|
}
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
#[cfg(unix)]
|
|
fn directory_requires_nofollow(directory: &Dir) -> Result<bool, SyncClientError> {
|
|
use cap_std::fs::MetadataExt;
|
|
|
|
let metadata = directory.dir_metadata().map_err(storage_io)?;
|
|
Ok(metadata.uid() == rustix::process::geteuid().as_raw() || metadata.mode() & 0o022 != 0)
|
|
}
|
|
|
|
#[cfg(not(any(unix, windows)))]
|
|
fn directory_requires_nofollow(_directory: &Dir) -> Result<bool, SyncClientError> {
|
|
Ok(true)
|
|
}
|
|
|
|
fn set_private_directory_permissions(directory: &Dir) -> Result<(), SyncClientError> {
|
|
#[cfg(unix)]
|
|
directory
|
|
.set_permissions(".", Permissions::from_std(std::fs::Permissions::from_mode(0o700)))
|
|
.map_err(storage_io)?;
|
|
Ok(())
|
|
}
|
|
|
|
fn set_private_file_permissions(file: &File) -> Result<(), SyncClientError> {
|
|
#[cfg(unix)]
|
|
file.set_permissions(Permissions::from_std(std::fs::Permissions::from_mode(0o600)))
|
|
.map_err(storage_io)?;
|
|
Ok(())
|
|
}
|
|
|
|
#[cfg(any(
|
|
target_vendor = "apple",
|
|
target_os = "linux",
|
|
target_os = "android",
|
|
target_os = "redox"
|
|
))]
|
|
fn publish_owner(directory: &Dir, temporary: &str) -> io::Result<()> {
|
|
use std::os::fd::AsFd;
|
|
|
|
rustix::fs::renameat_with(
|
|
directory.as_fd(),
|
|
temporary,
|
|
directory.as_fd(),
|
|
OWNER_FILE,
|
|
rustix::fs::RenameFlags::NOREPLACE,
|
|
)
|
|
.map_err(Into::into)
|
|
}
|
|
|
|
/// Windows `rename` replaces an existing target (MOVEFILE_REPLACE_EXISTING
|
|
/// semantics), which would let a losing concurrent claim overwrite the
|
|
/// winner. `hard_link` fails with `AlreadyExists` on every platform, so it
|
|
/// preserves first-claim-wins.
|
|
#[cfg(not(any(
|
|
target_vendor = "apple",
|
|
target_os = "linux",
|
|
target_os = "android",
|
|
target_os = "redox"
|
|
)))]
|
|
fn publish_owner(directory: &Dir, temporary: &str) -> io::Result<()> {
|
|
directory.hard_link(temporary, directory, OWNER_FILE)?;
|
|
directory.remove_file(temporary)
|
|
}
|
|
|
|
fn remove_temporary(directory: &Dir, temporary: &str) -> Result<(), SyncClientError> {
|
|
match directory.remove_file(temporary) {
|
|
Ok(()) => Ok(()),
|
|
Err(error) if error.kind() == ErrorKind::NotFound => Ok(()),
|
|
Err(error) => Err(storage_io(error)),
|
|
}
|
|
}
|
|
|
|
#[cfg(unix)]
|
|
fn sync_directory(directory: &Dir) -> Result<(), SyncClientError> {
|
|
directory.try_clone().map_err(storage_io)?.into_std_file().sync_all().map_err(storage_io)
|
|
}
|
|
|
|
#[cfg(not(unix))]
|
|
fn sync_directory(_directory: &Dir) -> Result<(), SyncClientError> {
|
|
Ok(())
|
|
}
|
|
|
|
fn validate_subject_id(value: &str) -> Result<(), SyncClientError> {
|
|
if is_subject_id(value) {
|
|
return Ok(());
|
|
}
|
|
Err(storage("sync owner user identifier is invalid"))
|
|
}
|
|
|
|
fn verify_owner(owner: &str, user_id: &str) -> Result<(), SyncClientError> {
|
|
if owner == user_id { Ok(()) } else { Err(SyncClientError::SyncOwnerMismatch) }
|
|
}
|
|
|
|
fn storage_io(error: io::Error) -> SyncClientError {
|
|
storage(error.to_string())
|
|
}
|
|
|
|
fn storage(message: impl Into<String>) -> SyncClientError {
|
|
SyncClientError::SyncOwnerStorage(message.into())
|
|
}
|
|
|
|
#[cfg(unix)]
|
|
use std::os::unix::fs::PermissionsExt;
|