522 lines
15 KiB
Go
522 lines
15 KiB
Go
package backup
|
|
|
|
import (
|
|
"archive/tar"
|
|
"bytes"
|
|
"compress/gzip"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
var testKey = bytes.Repeat([]byte{42}, 32)
|
|
|
|
func put(t *testing.T, name string, data []byte) {
|
|
t.Helper()
|
|
if err := os.MkdirAll(filepath.Dir(name), 0700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(name, data, 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func sealed(t *testing.T, p payload) string {
|
|
t.Helper()
|
|
plain, err := json.Marshal(p)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return sealPlain(t, magic, plain)
|
|
}
|
|
|
|
func sealPlain(t *testing.T, header string, plain []byte) string {
|
|
t.Helper()
|
|
gcm, err := newGCM(testKey)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
nonce := make([]byte, gcm.NonceSize())
|
|
data := append([]byte(header), nonce...)
|
|
data = gcm.Seal(data, nonce, plain, []byte(header))
|
|
name := filepath.Join(t.TempDir(), "archive")
|
|
put(t, name, data)
|
|
return name
|
|
}
|
|
|
|
func TestResourcesAndManifest(t *testing.T) {
|
|
home, dest := t.TempDir(), t.TempDir()
|
|
for _, dir := range resources {
|
|
put(t, filepath.Join(home, dir, "nested/资源.bin"), []byte{0, 1, 255})
|
|
}
|
|
for _, name := range []string{"node_modules/pkg", "worktrees/x", "sessions/x", "logs/x", "manifest.json"} {
|
|
put(t, filepath.Join(home, name), []byte("excluded"))
|
|
}
|
|
metadata := Metadata{DSHVersion: "1.2.3", CreatedAt: time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)}
|
|
archive := filepath.Join(t.TempDir(), "archive")
|
|
if err := CreateWithMetadata(home, archive, testKey, metadata); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
data, err := os.ReadFile(archive)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !bytes.HasPrefix(data, []byte(magicV2)) {
|
|
t.Fatal("not v2")
|
|
}
|
|
gcm, _ := newGCM(testKey)
|
|
nonce := data[len(magicV2) : len(magicV2)+gcm.NonceSize()]
|
|
plain, err := gcm.Open(nil, nonce, data[len(magicV2)+gcm.NonceSize():], []byte(magicV2))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
gz, err := gzip.NewReader(bytes.NewReader(plain))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer gz.Close()
|
|
tr := tar.NewReader(gz)
|
|
h, err := tr.Next()
|
|
if err != nil || h.Name != "manifest.json" {
|
|
t.Fatal("missing manifest", err)
|
|
}
|
|
b, err := io.ReadAll(tr)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var m manifest
|
|
if err := json.Unmarshal(b, &m); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if m.SchemaVersion != SchemaVersion || m.Metadata != metadata {
|
|
t.Fatalf("manifest: %+v", m)
|
|
}
|
|
if err := Restore(archive, dest, testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, dir := range resources {
|
|
b, err := os.ReadFile(filepath.Join(dest, dir, "nested/资源.bin"))
|
|
if err != nil || !bytes.Equal(b, []byte{0, 1, 255}) {
|
|
t.Fatal(dir, err, b)
|
|
}
|
|
}
|
|
if _, err := os.Stat(filepath.Join(dest, "manifest.json")); !os.IsNotExist(err) {
|
|
t.Fatal("manifest restored into home")
|
|
}
|
|
}
|
|
|
|
func TestLegacyRestore(t *testing.T) {
|
|
home := t.TempDir()
|
|
if err := Restore(sealed(t, payload{1, map[string][]byte{allowed[0]: []byte("legacy")}}), home, testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
b, err := os.ReadFile(filepath.Join(home, allowed[0]))
|
|
if err != nil || string(b) != "legacy" {
|
|
t.Fatal(err, string(b))
|
|
}
|
|
}
|
|
|
|
type tarEntry struct {
|
|
name string
|
|
kind byte
|
|
data []byte
|
|
}
|
|
|
|
func makeTar(t *testing.T, entries []tarEntry) []byte {
|
|
t.Helper()
|
|
var b bytes.Buffer
|
|
gz := gzip.NewWriter(&b)
|
|
tw := tar.NewWriter(gz)
|
|
for _, e := range entries {
|
|
h := &tar.Header{Name: e.name, Typeflag: e.kind, Mode: 0600, Size: int64(len(e.data))}
|
|
if e.kind == tar.TypeSymlink || e.kind == tar.TypeLink {
|
|
h.Linkname = "target"
|
|
}
|
|
if err := tw.WriteHeader(h); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := tw.Write(e.data); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if err := tw.Close(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := gz.Close(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return b.Bytes()
|
|
}
|
|
|
|
func TestV2RejectsInvalidArchivesBeforeWrites(t *testing.T) {
|
|
m, _ := json.Marshal(manifest{SchemaVersion, Metadata{"test", time.Now().UTC()}})
|
|
base := []tarEntry{{"manifest.json", tar.TypeReg, m}, {allowed[0], tar.TypeReg, []byte("new")}}
|
|
cases := map[string][]tarEntry{
|
|
"missing manifest": base[1:],
|
|
"duplicate manifest": append(append([]tarEntry{}, base...), base[0]),
|
|
"duplicate file": append(append([]tarEntry{}, base...), base[1]),
|
|
"invalid manifest": {{"manifest.json", tar.TypeReg, []byte(`{"schema_version":3}`)}},
|
|
"conflict": append(append([]tarEntry{}, base...), tarEntry{"pets/a", tar.TypeReg, nil}, tarEntry{"pets/a/b", tar.TypeReg, nil}),
|
|
}
|
|
for _, name := range []string{"pets/../escape", "pets//a", "pets/./a", "/pets/a", "pets/a/../../escape", "pets/a\\b", "pets/C:bad", "pets", "other/a"} {
|
|
cases[name] = append(append([]tarEntry{}, base...), tarEntry{name, tar.TypeReg, nil})
|
|
}
|
|
for _, kind := range []byte{tar.TypeSymlink, tar.TypeLink, tar.TypeFifo, tar.TypeChar, tar.TypeBlock, tar.TypeDir} {
|
|
cases[fmt.Sprint(kind)] = append(append([]tarEntry{}, base...), tarEntry{"pets/unsafe", kind, nil})
|
|
}
|
|
for name, entries := range cases {
|
|
t.Run(name, func(t *testing.T) {
|
|
home := t.TempDir()
|
|
put(t, filepath.Join(home, allowed[0]), []byte("old"))
|
|
if err := Restore(sealPlain(t, magicV2, makeTar(t, entries)), home, testKey); err == nil {
|
|
t.Fatal("accepted invalid archive")
|
|
}
|
|
b, _ := os.ReadFile(filepath.Join(home, allowed[0]))
|
|
if string(b) != "old" {
|
|
t.Fatal("partial write")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestResourceFilesystemRejections(t *testing.T) {
|
|
for _, name := range []string{"pets", "pets/nested", "pets/nested/file"} {
|
|
t.Run(name, func(t *testing.T) {
|
|
home := t.TempDir()
|
|
if err := os.MkdirAll(filepath.Dir(filepath.Join(home, name)), 0700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.Symlink(t.TempDir(), filepath.Join(home, name)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Create(home, filepath.Join(t.TempDir(), "archive"), testKey); err == nil {
|
|
t.Fatal("followed resource symlink")
|
|
}
|
|
p, err := encodeV2(map[string][]byte{"pets/nested/file": []byte("bad")}, Metadata{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Restore(sealPlain(t, magicV2, p), home, testKey); err == nil {
|
|
t.Fatal("restore followed symlink")
|
|
}
|
|
})
|
|
}
|
|
home := t.TempDir()
|
|
if err := os.Mkdir(filepath.Join(home, "pets"), 0700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
l, err := net.Listen("unix", filepath.Join(home, "pets/socket"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer l.Close()
|
|
if err := Create(home, filepath.Join(t.TempDir(), "archive"), testKey); err == nil {
|
|
t.Fatal("special file accepted")
|
|
}
|
|
}
|
|
|
|
func TestV2LimitsAndCorruption(t *testing.T) {
|
|
files := make(map[string][]byte)
|
|
home := t.TempDir()
|
|
for i := 0; i < MaxFiles; i++ {
|
|
name := fmt.Sprintf("pets/%d", i)
|
|
files[name] = nil
|
|
put(t, filepath.Join(home, name), nil)
|
|
}
|
|
archive := filepath.Join(t.TempDir(), "archive")
|
|
if err := Create(home, archive, testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Restore(archive, t.TempDir(), testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
put(t, filepath.Join(home, "pets/extra"), nil)
|
|
if err := Create(home, archive, testKey); err == nil {
|
|
t.Fatal("file count accepted")
|
|
}
|
|
files["pets/extra"] = nil
|
|
p, err := encodeV2(files, Metadata{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := decodeV2(p); err == nil {
|
|
t.Fatal("archive file count accepted")
|
|
}
|
|
p, err = encodeV2(map[string][]byte{"pets/large": make([]byte, MaxTotalBytes+1)}, Metadata{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := decodeV2(p); err == nil {
|
|
t.Fatal("expanded file limit accepted")
|
|
}
|
|
p, err = encodeV2(nil, Metadata{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
badChecksum := bytes.Clone(p)
|
|
badChecksum[len(badChecksum)-8] ^= 1
|
|
for _, bad := range [][]byte{p[:len(p)-1], append(bytes.Clone(p), 0), append(bytes.Clone(p), p...), badChecksum} {
|
|
if _, err := decodeV2(bad); err == nil {
|
|
t.Fatal("corrupt gzip accepted")
|
|
}
|
|
}
|
|
if _, err := encodeV2(nil, Metadata{DSHVersion: string(make([]byte, maxManifestBytes))}); err == nil {
|
|
t.Fatal("oversized manifest accepted")
|
|
}
|
|
}
|
|
|
|
func TestRoundTrip(t *testing.T) {
|
|
home, dest := t.TempDir(), t.TempDir()
|
|
for _, name := range allowed {
|
|
put(t, filepath.Join(home, name), []byte("secret:"+name))
|
|
}
|
|
put(t, filepath.Join(home, "not-allowed"), []byte("ignore"))
|
|
archive := filepath.Join(t.TempDir(), "archive")
|
|
if err := Create(home, archive, testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
first, err := os.ReadFile(archive)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if bytes.Contains(first, []byte("secret:")) {
|
|
t.Fatal("plaintext leaked")
|
|
}
|
|
if err := Create(home, archive, testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second, err := os.ReadFile(archive)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if bytes.Equal(first, second) {
|
|
t.Fatal("nonce reused")
|
|
}
|
|
put(t, filepath.Join(dest, allowed[0]), []byte("old"))
|
|
if err := os.Chmod(filepath.Join(dest, allowed[0]), 0644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Restore(archive, dest, testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, name := range allowed {
|
|
data, err := os.ReadFile(filepath.Join(dest, name))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if string(data) != "secret:"+name {
|
|
t.Fatalf("wrong data: %s", name)
|
|
}
|
|
info, err := os.Stat(filepath.Join(dest, name))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if info.Mode().Perm() != 0600 {
|
|
t.Fatalf("mode: %v", info.Mode())
|
|
}
|
|
}
|
|
if _, err := os.Stat(filepath.Join(dest, "not-allowed")); !os.IsNotExist(err) {
|
|
t.Fatal("unlisted file restored")
|
|
}
|
|
info, err := os.Stat(archive)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if info.Mode().Perm() != 0600 {
|
|
t.Fatal("archive permissions")
|
|
}
|
|
}
|
|
|
|
func TestAuthentication(t *testing.T) {
|
|
archive := sealed(t, payload{1, map[string][]byte{allowed[0]: []byte("new")}})
|
|
original, err := os.ReadFile(archive)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, offset := range []int{0, len(magic), len(original) - 1} {
|
|
t.Run(fmt.Sprint(offset), func(t *testing.T) {
|
|
data := bytes.Clone(original)
|
|
data[offset] ^= 1
|
|
put(t, archive, data)
|
|
home := t.TempDir()
|
|
put(t, filepath.Join(home, allowed[0]), []byte("old"))
|
|
if err := Restore(archive, home, testKey); err == nil {
|
|
t.Fatal("tampering accepted")
|
|
}
|
|
got, _ := os.ReadFile(filepath.Join(home, allowed[0]))
|
|
if string(got) != "old" {
|
|
t.Fatal("modified on failure")
|
|
}
|
|
})
|
|
}
|
|
put(t, archive, original)
|
|
if err := Restore(archive, t.TempDir(), bytes.Repeat([]byte{1}, 32)); err == nil {
|
|
t.Fatal("wrong key accepted")
|
|
}
|
|
put(t, archive, original[:len(original)-1])
|
|
if err := Restore(archive, t.TempDir(), testKey); err == nil {
|
|
t.Fatal("truncation accepted")
|
|
}
|
|
}
|
|
|
|
func TestInvalidPathsAndVersion(t *testing.T) {
|
|
for _, name := range []string{"../escape", "/tmp/escape", "profiles/web/../../../escape", "profiles//web/package.json", "other", "profiles\\web\\package.json"} {
|
|
t.Run(name, func(t *testing.T) {
|
|
home := t.TempDir()
|
|
put(t, filepath.Join(home, allowed[0]), []byte("old"))
|
|
archive := sealed(t, payload{1, map[string][]byte{allowed[0]: []byte("new"), name: []byte("bad")}})
|
|
if err := Restore(archive, home, testKey); err == nil {
|
|
t.Fatal("invalid path accepted")
|
|
}
|
|
got, _ := os.ReadFile(filepath.Join(home, allowed[0]))
|
|
if string(got) != "old" {
|
|
t.Fatal("partial restore before validation")
|
|
}
|
|
})
|
|
}
|
|
if err := Restore(sealed(t, payload{2, map[string][]byte{}}), t.TempDir(), testKey); err == nil {
|
|
t.Fatal("version accepted")
|
|
}
|
|
files := map[string][]byte{}
|
|
for i := 0; i < MaxFiles+1; i++ {
|
|
files[fmt.Sprint(i)] = nil
|
|
}
|
|
if err := Restore(sealed(t, payload{1, files}), t.TempDir(), testKey); err == nil {
|
|
t.Fatal("file count accepted")
|
|
}
|
|
}
|
|
|
|
func TestSymlinks(t *testing.T) {
|
|
for _, outside := range []bool{false, true} {
|
|
for _, parent := range []bool{false, true} {
|
|
t.Run(fmt.Sprintf("outside=%v/parent=%v", outside, parent), func(t *testing.T) {
|
|
home := t.TempDir()
|
|
target := filepath.Join(home, "target")
|
|
linkTarget := "target"
|
|
if outside {
|
|
target = filepath.Join(t.TempDir(), "target")
|
|
linkTarget = target
|
|
}
|
|
name := allowed[0]
|
|
link := filepath.Join(home, name)
|
|
if parent {
|
|
name = "profiles/web/package.json"
|
|
link = filepath.Join(home, "profiles")
|
|
put(t, filepath.Join(target, "web/package.json"), []byte("safe"))
|
|
} else {
|
|
put(t, target, []byte("safe"))
|
|
}
|
|
if err := os.Symlink(linkTarget, link); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Create(home, filepath.Join(t.TempDir(), "archive"), testKey); err == nil {
|
|
t.Fatal("create followed symlink")
|
|
}
|
|
archive := sealed(t, payload{1, map[string][]byte{name: []byte("bad")}})
|
|
if err := Restore(archive, home, testKey); err == nil {
|
|
t.Fatal("restore followed symlink")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSymlinkPreflightAndArchive(t *testing.T) {
|
|
home := t.TempDir()
|
|
put(t, filepath.Join(home, allowed[0]), []byte("old"))
|
|
target := filepath.Join(t.TempDir(), "target")
|
|
put(t, target, []byte("safe"))
|
|
if err := os.Symlink(target, filepath.Join(home, "dsh-ssh.json")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
archive := sealed(t, payload{1, map[string][]byte{allowed[0]: []byte("new"), "dsh-ssh.json": []byte("bad")}})
|
|
if err := Restore(archive, home, testKey); err == nil {
|
|
t.Fatal("symlink accepted")
|
|
}
|
|
got, err := os.ReadFile(filepath.Join(home, allowed[0]))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if string(got) != "old" {
|
|
t.Fatal("preflight modified earlier file")
|
|
}
|
|
got, err = os.ReadFile(target)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if string(got) != "safe" {
|
|
t.Fatal("outside target modified")
|
|
}
|
|
link := filepath.Join(t.TempDir(), "archive-link")
|
|
if err := os.Symlink(archive, link); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Restore(link, t.TempDir(), testKey); err == nil {
|
|
t.Fatal("archive symlink accepted")
|
|
}
|
|
if err := Create(t.TempDir(), link, testKey); err == nil {
|
|
t.Fatal("destination symlink accepted")
|
|
}
|
|
}
|
|
|
|
func TestSizeLimits(t *testing.T) {
|
|
home := t.TempDir()
|
|
name := filepath.Join(home, allowed[0])
|
|
put(t, name, nil)
|
|
if err := os.Truncate(name, MaxTotalBytes+1); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
archive := filepath.Join(t.TempDir(), "archive")
|
|
if err := Create(home, archive, testKey); err == nil {
|
|
t.Fatal("oversized file accepted")
|
|
}
|
|
if err := os.Truncate(name, MaxTotalBytes); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Create(home, archive, testKey); err != nil {
|
|
t.Fatal("exact limit:", err)
|
|
}
|
|
if err := Restore(archive, t.TempDir(), testKey); err != nil {
|
|
t.Fatal("exact limit restore:", err)
|
|
}
|
|
put(t, filepath.Join(home, allowed[1]), []byte{1})
|
|
if err := Create(home, archive, testKey); err == nil {
|
|
t.Fatal("aggregate limit accepted")
|
|
}
|
|
archive = sealed(t, payload{1, map[string][]byte{allowed[0]: make([]byte, MaxTotalBytes), allowed[1]: {1}}})
|
|
if err := Restore(archive, t.TempDir(), testKey); err == nil {
|
|
t.Fatal("restore aggregate limit accepted")
|
|
}
|
|
put(t, archive, nil)
|
|
if err := os.Truncate(archive, maxArchiveBytes+1); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := Restore(archive, t.TempDir(), testKey); err == nil {
|
|
t.Fatal("oversized archive accepted")
|
|
}
|
|
}
|
|
|
|
func TestMissingFilesAndInvalidKey(t *testing.T) {
|
|
archive := filepath.Join(t.TempDir(), "archive")
|
|
if err := Create(t.TempDir(), archive, nil); err == nil {
|
|
t.Fatal("invalid key accepted")
|
|
}
|
|
if err := Create(t.TempDir(), archive, testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
home := t.TempDir()
|
|
put(t, filepath.Join(home, allowed[0]), []byte("keep"))
|
|
if err := Restore(archive, home, testKey); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
got, _ := os.ReadFile(filepath.Join(home, allowed[0]))
|
|
if string(got) != "keep" {
|
|
t.Fatal("missing file removed")
|
|
}
|
|
}
|