297 lines
10 KiB
Rust
297 lines
10 KiB
Rust
use std::{
|
|
fs,
|
|
io::{self, ErrorKind, Read, Write},
|
|
path::{Component, Path, PathBuf},
|
|
};
|
|
|
|
use cap_fs_ext::{
|
|
DirExt, FollowSymlinks, MetadataExt as CrossPlatformMetadataExt, OpenOptionsFollowExt,
|
|
};
|
|
use cap_std::{
|
|
ambient_authority,
|
|
fs::{Dir, File, OpenOptions, Permissions},
|
|
};
|
|
use zeroize::Zeroizing;
|
|
|
|
use crate::error::SyncClientError;
|
|
|
|
const MARKER_CONTENT: &[u8] = b"ely-bearer-migration-v1\n";
|
|
|
|
pub(super) fn read_legacy_bytes(
|
|
path: &Path,
|
|
maximum_bytes: usize,
|
|
) -> Result<Option<Zeroizing<Vec<u8>>>, SyncClientError> {
|
|
let Some((directory, name)) = open_parent(path, false)? else {
|
|
return Ok(None);
|
|
};
|
|
let Some(file) = open_existing(&directory, name)? else {
|
|
return Ok(None);
|
|
};
|
|
validate_private_file(&file)?;
|
|
let mut bytes = Zeroizing::new(Vec::new());
|
|
file.into_std().take((maximum_bytes + 1) as u64).read_to_end(&mut bytes).map_err(storage_io)?;
|
|
if bytes.len() > maximum_bytes {
|
|
return Err(storage_error("legacy bearer token is too large"));
|
|
}
|
|
Ok(Some(bytes))
|
|
}
|
|
|
|
pub(super) fn ensure_migration_marker(path: &Path) -> Result<(), SyncClientError> {
|
|
let (directory, name) = open_parent(path, true)?
|
|
.ok_or_else(|| storage_error("bearer migration marker parent is missing"))?;
|
|
if let Some(file) = open_existing(&directory, name)? {
|
|
return validate_migration_marker(file);
|
|
}
|
|
let temporary_path = marker_temporary_path(path)?;
|
|
remove_file_if_present(&temporary_path)?;
|
|
let temporary_name = temporary_path
|
|
.file_name()
|
|
.ok_or_else(|| storage_error("bearer migration marker temp name is missing"))?;
|
|
let mut options = private_open_options();
|
|
options.write(true).create_new(true);
|
|
let mut file = directory.open_with(temporary_name, &options).map_err(storage_io)?;
|
|
validate_private_file(&file)?;
|
|
set_private_file_permissions(&file)?;
|
|
file.write_all(MARKER_CONTENT).map_err(storage_io)?;
|
|
file.sync_all().map_err(storage_io)?;
|
|
drop(file);
|
|
directory.rename(temporary_name, &directory, name).map_err(storage_io)?;
|
|
sync_directory(&directory)
|
|
}
|
|
|
|
pub(super) fn migration_marker_exists(path: &Path) -> Result<bool, SyncClientError> {
|
|
let Some((directory, name)) = open_parent(path, false)? else {
|
|
return Ok(false);
|
|
};
|
|
let Some(file) = open_existing(&directory, name)? else {
|
|
return Ok(false);
|
|
};
|
|
validate_migration_marker(file)?;
|
|
Ok(true)
|
|
}
|
|
|
|
fn validate_migration_marker(file: File) -> Result<(), SyncClientError> {
|
|
validate_private_file(&file)?;
|
|
let mut bytes = Vec::new();
|
|
file.into_std()
|
|
.take((MARKER_CONTENT.len() + 1) as u64)
|
|
.read_to_end(&mut bytes)
|
|
.map_err(storage_io)?;
|
|
if bytes != MARKER_CONTENT {
|
|
return Err(storage_error("bearer migration marker content is invalid"));
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
fn marker_temporary_path(path: &Path) -> Result<PathBuf, SyncClientError> {
|
|
let mut name = path
|
|
.file_name()
|
|
.ok_or_else(|| storage_error("bearer migration marker name is missing"))?
|
|
.to_os_string();
|
|
name.push(".tmp");
|
|
Ok(path.with_file_name(name))
|
|
}
|
|
|
|
pub(super) fn remove_file_if_present(path: &Path) -> Result<(), SyncClientError> {
|
|
let Some((directory, name)) = open_parent(path, false)? else {
|
|
return Ok(());
|
|
};
|
|
let metadata = match directory.symlink_metadata(name) {
|
|
Ok(metadata) => metadata,
|
|
Err(error) if error.kind() == ErrorKind::NotFound => return Ok(()),
|
|
Err(error) => return Err(storage_io(error)),
|
|
};
|
|
if metadata.is_symlink() {
|
|
return directory.remove_file_or_symlink(name).map_err(storage_io);
|
|
}
|
|
let file = open_existing(&directory, name)?.ok_or_else(|| {
|
|
storage_error("legacy bearer token disappeared during cleanup validation")
|
|
})?;
|
|
validate_private_file(&file)?;
|
|
drop(file);
|
|
directory.remove_file_or_symlink(name).map_err(storage_io)
|
|
}
|
|
|
|
pub(super) fn open_lock_file(path: &Path) -> Result<fs::File, SyncClientError> {
|
|
let (directory, name) =
|
|
open_parent(path, true)?.ok_or_else(|| storage_error("bearer lock parent is missing"))?;
|
|
let mut options = private_open_options();
|
|
options.read(true).write(true).create(true);
|
|
let file = directory.open_with(name, &options).map_err(storage_io)?;
|
|
validate_private_file(&file)?;
|
|
set_private_file_permissions(&file)?;
|
|
Ok(file.into_std())
|
|
}
|
|
|
|
fn open_parent(
|
|
path: &Path,
|
|
create: bool,
|
|
) -> Result<Option<(Dir, &std::ffi::OsStr)>, SyncClientError> {
|
|
let parent = path.parent().ok_or_else(|| storage_error("credential file parent is missing"))?;
|
|
let name = path.file_name().ok_or_else(|| storage_error("credential file name is missing"))?;
|
|
let Some(directory) = open_directory_nofollow(parent, create)? else {
|
|
return Ok(None);
|
|
};
|
|
validate_private_directory(&directory)?;
|
|
set_private_directory_permissions(&directory)?;
|
|
Ok(Some((directory, name)))
|
|
}
|
|
|
|
fn open_directory_nofollow(path: &Path, create: bool) -> Result<Option<Dir>, SyncClientError> {
|
|
let mut root = PathBuf::new();
|
|
let mut names = Vec::new();
|
|
for component in path.components() {
|
|
match component {
|
|
Component::Prefix(prefix) => root.push(prefix.as_os_str()),
|
|
Component::RootDir => root.push(std::path::MAIN_SEPARATOR_STR),
|
|
Component::Normal(name) => names.push(name.to_os_string()),
|
|
Component::CurDir => {}
|
|
Component::ParentDir => {
|
|
return Err(storage_error("credential path traversal is invalid"));
|
|
}
|
|
}
|
|
}
|
|
if root.as_os_str().is_empty() {
|
|
return Err(storage_error("credential paths must be absolute"));
|
|
}
|
|
let mut directory = Dir::open_ambient_dir(root, ambient_authority()).map_err(storage_io)?;
|
|
#[cfg(windows)]
|
|
let strict_component = names.len().saturating_sub(4);
|
|
#[cfg(windows)]
|
|
let mut require_nofollow = false;
|
|
#[cfg(windows)]
|
|
let mut component_index = 0;
|
|
#[cfg(not(windows))]
|
|
let mut require_nofollow = directory_requires_nofollow(&directory)?;
|
|
for name in names {
|
|
#[cfg(windows)]
|
|
{
|
|
require_nofollow |= component_index >= strict_component;
|
|
component_index += 1;
|
|
}
|
|
if create {
|
|
match directory.create_dir(&name) {
|
|
Ok(()) => {}
|
|
Err(error) if error.kind() == ErrorKind::AlreadyExists => {}
|
|
Err(error) => return Err(storage_io(error)),
|
|
}
|
|
}
|
|
let opened = match directory.open_dir_nofollow(&name) {
|
|
Ok(directory) => directory,
|
|
Err(_) if !require_nofollow => match directory.open_dir(&name) {
|
|
Ok(directory) => directory,
|
|
Err(error) if !create && error.kind() == ErrorKind::NotFound => return Ok(None),
|
|
Err(error) => return Err(storage_io(error)),
|
|
},
|
|
Err(error) if !create && error.kind() == ErrorKind::NotFound => return Ok(None),
|
|
Err(error) => return Err(storage_io(error)),
|
|
};
|
|
#[cfg(not(windows))]
|
|
{
|
|
require_nofollow |= directory_requires_nofollow(&opened)?;
|
|
}
|
|
directory = opened;
|
|
}
|
|
Ok(Some(directory))
|
|
}
|
|
|
|
#[cfg(unix)]
|
|
fn directory_requires_nofollow(directory: &Dir) -> Result<bool, SyncClientError> {
|
|
use cap_std::fs::MetadataExt;
|
|
|
|
let metadata = directory.dir_metadata().map_err(storage_io)?;
|
|
Ok(metadata.uid() == rustix::process::geteuid().as_raw() || metadata.mode() & 0o022 != 0)
|
|
}
|
|
|
|
#[cfg(not(any(unix, windows)))]
|
|
fn directory_requires_nofollow(_directory: &Dir) -> Result<bool, SyncClientError> {
|
|
Ok(true)
|
|
}
|
|
|
|
fn open_existing(directory: &Dir, name: &std::ffi::OsStr) -> Result<Option<File>, SyncClientError> {
|
|
let mut options = private_open_options();
|
|
options.read(true);
|
|
match directory.open_with(name, &options) {
|
|
Ok(file) => Ok(Some(file)),
|
|
Err(error) if error.kind() == ErrorKind::NotFound => Ok(None),
|
|
Err(error) => Err(storage_io(error)),
|
|
}
|
|
}
|
|
|
|
fn private_open_options() -> OpenOptions {
|
|
let mut options = OpenOptions::new();
|
|
options.follow(FollowSymlinks::No);
|
|
#[cfg(unix)]
|
|
{
|
|
use cap_std::fs::OpenOptionsExt;
|
|
options.mode(0o600);
|
|
}
|
|
options
|
|
}
|
|
|
|
fn validate_private_directory(directory: &Dir) -> Result<(), SyncClientError> {
|
|
let metadata = directory.dir_metadata().map_err(storage_io)?;
|
|
if !metadata.is_dir() {
|
|
return Err(storage_error("credential file parent is not a directory"));
|
|
}
|
|
#[cfg(unix)]
|
|
{
|
|
use cap_std::fs::MetadataExt;
|
|
if metadata.uid() != rustix::process::geteuid().as_raw() {
|
|
return Err(storage_error("credential file parent ownership is invalid"));
|
|
}
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
fn validate_private_file(file: &File) -> Result<(), SyncClientError> {
|
|
let metadata = file.metadata().map_err(storage_io)?;
|
|
if !metadata.is_file() || CrossPlatformMetadataExt::nlink(&metadata) != 1 {
|
|
return Err(storage_error("credential file link state is invalid"));
|
|
}
|
|
#[cfg(unix)]
|
|
{
|
|
use cap_std::fs::MetadataExt;
|
|
if metadata.uid() != rustix::process::geteuid().as_raw() {
|
|
return Err(storage_error("credential file ownership is invalid"));
|
|
}
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
fn set_private_directory_permissions(directory: &Dir) -> Result<(), SyncClientError> {
|
|
#[cfg(unix)]
|
|
directory
|
|
.set_permissions(".", Permissions::from_std(fs::Permissions::from_mode(0o700)))
|
|
.map_err(storage_io)?;
|
|
Ok(())
|
|
}
|
|
|
|
fn set_private_file_permissions(file: &File) -> Result<(), SyncClientError> {
|
|
#[cfg(unix)]
|
|
file.set_permissions(Permissions::from_std(fs::Permissions::from_mode(0o600)))
|
|
.map_err(storage_io)?;
|
|
Ok(())
|
|
}
|
|
|
|
#[cfg(unix)]
|
|
fn sync_directory(directory: &Dir) -> Result<(), SyncClientError> {
|
|
directory.try_clone().map_err(storage_io)?.into_std_file().sync_all().map_err(storage_io)
|
|
}
|
|
|
|
#[cfg(not(unix))]
|
|
fn sync_directory(_directory: &Dir) -> Result<(), SyncClientError> {
|
|
Ok(())
|
|
}
|
|
|
|
#[cfg(unix)]
|
|
use std::os::unix::fs::PermissionsExt;
|
|
|
|
fn storage_io(error: io::Error) -> SyncClientError {
|
|
storage_error(error.to_string())
|
|
}
|
|
|
|
fn storage_error(message: impl Into<String>) -> SyncClientError {
|
|
SyncClientError::BearerCredentialStorage(message.into())
|
|
}
|