@synopackageland/cli 0.4.0 → 0.5.0

package/templates/_gateway/csrf_test.go

@@ -0,0 +1,155 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// browserPost is what a browser sends for a same-origin fetch to the gateway
+// (httptest requests are addressed to example.com).
+func browserPost(token string) map[string]string {
+	return map[string]string{
+		"Cookie":         "id=abc",
+		"X-SYNO-TOKEN":   token,
+		"Origin":         "http://example.com",
+		"Sec-Fetch-Site": "same-origin",
+	}
+}
+
+func with(hdr map[string]string, kv ...string) map[string]string {
+	out := map[string]string{}
+	for k, v := range hdr {
+		out[k] = v
+	}
+	for i := 0; i < len(kv); i += 2 {
+		if kv[i+1] == "" {
+			delete(out, kv[i])
+		} else {
+			out[kv[i]] = kv[i+1]
+		}
+	}
+	return out
+}
+
+func csrfGateway(t *testing.T) (http.Handler, *upstream) {
+	t.Helper()
+	up := newUpstream(t, hello)
+	return newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up), up
+}
+
+func TestSameOriginStateChangeReachesContainer(t *testing.T) {
+	g, up := csrfGateway(t)
+	cases := map[string]map[string]string{
+		"origin and fetch metadata":                           browserPost("tok"),
+		"origin only (no fetch metadata, e.g. Safari < 16.4)": with(browserPost("tok"), "Sec-Fetch-Site", ""),
+		"fetch metadata only":                                 with(browserPost("tok"), "Origin", ""),
+		"host case and default port":                          with(browserPost("tok"), "Origin", "http://EXAMPLE.com:80"),
+	}
+	for name, hdr := range cases {
+		if w := do(g, "POST", base+"/save", hdr, "x"); w.Code != 200 {
+			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
+		}
+	}
+	if up.hits.Load() != int32(len(cases)) {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestCrossSiteStateChangeIsRefusedBeforeTheContainer(t *testing.T) {
+	g, up := csrfGateway(t)
+	cases := map[string]map[string]string{
+		"foreign origin":                with(browserPost("tok"), "Origin", "https://evil.example", "Sec-Fetch-Site", ""),
+		"foreign origin, claims same":   with(browserPost("tok"), "Origin", "https://evil.example"),
+		"origin null":                   with(browserPost("tok"), "Origin", "null", "Sec-Fetch-Site", ""),
+		"origin is not a URL":           with(browserPost("tok"), "Origin", "::::", "Sec-Fetch-Site", ""),
+		"origin has a path":             with(browserPost("tok"), "Origin", "http://example.com/x", "Sec-Fetch-Site", ""),
+		"same host other port":          with(browserPost("tok"), "Origin", "http://example.com:5001", "Sec-Fetch-Site", ""),
+		"sub-domain of the host":        with(browserPost("tok"), "Origin", "http://evil.example.com", "Sec-Fetch-Site", ""),
+		"fetch metadata cross-site":     with(browserPost("tok"), "Sec-Fetch-Site", "cross-site"),
+		"fetch metadata same-site":      with(browserPost("tok"), "Sec-Fetch-Site", "same-site"),
+		"fetch metadata none":           with(browserPost("tok"), "Sec-Fetch-Site", "none"),
+		"fetch metadata unknown":        with(browserPost("tok"), "Sec-Fetch-Site", "whatever"),
+		"fetch cross-site, origin same": with(browserPost("tok"), "Sec-Fetch-Site", "cross-site", "Origin", "http://example.com"),
+	}
+	for name, hdr := range cases {
+		w := do(g, "POST", base+"/save", hdr, "x")
+		if !refusedAsForbidden(w, "cross_site_blocked") {
+			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestStateChangeWithoutAnyOriginEvidenceIsRefused(t *testing.T) {
+	g, up := csrfGateway(t)
+	hdr := with(browserPost("tok"), "Origin", "", "Sec-Fetch-Site", "")
+	w := do(g, "POST", base+"/save", hdr, "x")
+	if !refusedAsForbidden(w, "cross_site_blocked") || up.hits.Load() != 0 {
+		t.Fatalf("%d %q hits=%d", w.Code, w.Body.String(), up.hits.Load())
+	}
+}
+
+func TestStateChangeNeedsAWellFormedToken(t *testing.T) {
+	g, up := csrfGateway(t)
+	for name, token := range map[string]string{
+		"missing":       "",
+		"too long":      strings.Repeat("a", 257),
+		"control bytes": "to\x01ken",
+		"non ASCII":     "tök",
+	} {
+		hdr := with(browserPost("tok"), "X-SYNO-TOKEN", "")
+		if token != "" {
+			hdr["X-SYNO-TOKEN"] = token
+		}
+		w := do(g, "POST", base+"/save", hdr, "x")
+		if !refusedAsForbidden(w, "token_required") {
+			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestSafeRequestsIgnoreOriginEvidence(t *testing.T) {
+	g, _ := csrfGateway(t)
+	hdr := map[string]string{"Cookie": "id=abc", "Origin": "https://evil.example", "Sec-Fetch-Site": "cross-site"}
+	for _, method := range []string{"GET", "HEAD"} {
+		if w := do(g, method, base+"/", hdr, ""); w.Code != 200 {
+			t.Errorf("%s: %d", method, w.Code)
+		}
+	}
+}
+
+func TestOriginMatchIgnoresDefaultPortsOnly(t *testing.T) {
+	cases := []struct {
+		origin, host string
+		want         bool
+	}{
+		{"http://nas.local:5000", "nas.local:5000", true},
+		{"https://nas.local:5001", "nas.local:5001", true},
+		{"https://nas.local", "nas.local:443", true},
+		{"http://nas.local", "nas.local", true},
+		{"https://nas.local:5001", "nas.local:5000", false},
+		{"http://[::1]:5000", "[::1]:5000", true},
+		{"http://nas.local", "nas.local:5000", false},
+		{"", "nas.local", false},
+	}
+	for _, c := range cases {
+		if got := originMatchesHost(c.origin, c.host); got != c.want {
+			t.Errorf("originMatchesHost(%q, %q) = %v", c.origin, c.host, got)
+		}
+	}
+}
+
+// refusedAsForbidden: the gateway means 403, but DSM would replace a 403 body, so it sends 401
+// with the intended status and the reason in headers.
+func refusedAsForbidden(w *httptest.ResponseRecorder, code string) bool {
+	h := w.Header()
+	return w.Code == http.StatusUnauthorized && h.Get("X-Synopkgland-Status") == "403" &&
+		h.Get("X-Synopkgland-Error") == code && strings.Contains(w.Body.String(), code)
+}

package/templates/_gateway/directory.go

@@ -0,0 +1,108 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const maxDirectoryOutput = 64 << 10
+const maxDirectoryGroups = 256
+
+// DSM's dynamic /usr/bin/id uses libc NSS; os/user in the static CGI does not.
+// A fixed executable, a single validated username argument and a clean locale
+// environment keep the browser's credentials and process environment out of NSS.
+// No SDK cache: query once per authenticated request, with a two-second limit.
+type directoryLookup struct {
+	timeout time.Duration
+	run     func(context.Context, string, []string, []string) ([]byte, error)
+}
+
+func (d directoryLookup) groups(ctx context.Context, user string) ([]string, error) {
+	if !userName.MatchString(user) || strings.HasPrefix(user, "-") {
+		return nil, errors.New("invalid directory account")
+	}
+	ctx, cancel := context.WithTimeout(ctx, d.timeout)
+	defer cancel()
+	out, err := d.run(ctx, "/usr/bin/id", []string{user}, []string{"LC_ALL=C"})
+	if ctx.Err() != nil {
+		return nil, fmt.Errorf("directory groups: %w", ctx.Err())
+	}
+	if err != nil {
+		return nil, errors.New("directory group lookup failed")
+	}
+	return parseDirectoryGroups(out)
+}
+
+// Bounded stdout also bounds memory if a directory returns an excessive list.
+// Never include command output in errors: it is not a diagnostic credential path.
+type directoryOutput struct{ data []byte }
+
+func (b *directoryOutput) Write(p []byte) (int, error) {
+	if len(p) > maxDirectoryOutput-len(b.data) {
+		return 0, errors.New("directory output exceeds limit")
+	}
+	b.data = append(b.data, p...)
+	return len(p), nil
+}
+func runDirectoryCommand(ctx context.Context, path string, args, env []string) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, path, args...)
+	cmd.Env = env
+	cmd.WaitDelay = 100 * time.Millisecond
+	var out directoryOutput
+	cmd.Stdout = &out
+	err := cmd.Run()
+	return out.data, err
+}
+
+var directoryIDLine = regexp.MustCompile(`^uid=([0-9]+)\(([^()\r\n]+)\) gid=([0-9]+)\(([^()\r\n]+)\) groups=([^\r\n]+)\n?$`)
+var directoryGroupEntry = regexp.MustCompile(`^([0-9]+)\(([^()\r\n]+)\)$`)
+
+// Parse full id output, not id -Gn: the latter loses boundaries when AD group
+// names contain spaces (for example VT-NAS\Domain Users). Require every gid to
+// resolve to a bounded valid name, and require the primary group in the list.
+// Unresolved numeric gids, partial/malformed output and ambiguous delimiters deny.
+func parseDirectoryGroups(out []byte) ([]string, error) {
+	invalid := errors.New("incomplete or invalid directory groups")
+	if len(out) > maxDirectoryOutput {
+		return nil, invalid
+	}
+	m := directoryIDLine.FindStringSubmatch(string(out))
+	if m == nil || !validDirectoryID(m[1]) || !validDirectoryID(m[3]) || !userName.MatchString(m[2]) || !groupName.MatchString(m[4]) {
+		return nil, invalid
+	}
+	entries := strings.Split(m[5], ",")
+	if len(entries) > maxDirectoryGroups {
+		return nil, invalid
+	}
+	groups := make([]string, 0, len(entries))
+	seen := map[string]bool{}
+	primary := false
+	for _, entry := range entries {
+		g := directoryGroupEntry.FindStringSubmatch(entry)
+		if g == nil || !validDirectoryID(g[1]) || !groupName.MatchString(g[2]) || seen[g[1]] {
+			return nil, invalid
+		}
+		seen[g[1]] = true
+		if g[1] == m[3] {
+			if g[2] != m[4] {
+				return nil, invalid
+			}
+			primary = true
+		}
+		groups = append(groups, g[2])
+	}
+	if !primary {
+		return nil, invalid
+	}
+	return groups, nil
+}
+func validDirectoryID(value string) bool {
+	n, err := strconv.ParseUint(value, 10, 32)
+	return err == nil && n < 1<<32-1 && strconv.FormatUint(n, 10) == value
+}

package/templates/_gateway/directory_test.go

@@ -0,0 +1,202 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http/httptest"
+	"os"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+)
+
+const directoryID = `uid=2969567732(VT-NAS\Administrator) gid=2969567745(VT-NAS\Domain Users) groups=2969567745(VT-NAS\Domain Users),2969567751(VT-NAS\Enterprise Admins)`
+
+func TestDirectoryIdentityUsesNSSIncludingPrimaryAndSupplementaryGroups(t *testing.T) {
+	a := newTestAuth(t, &fakeRunner{out: `VT-NAS\Administrator`})
+	var gotUser string
+	a.directoryGroups = func(ctx context.Context, user string) ([]string, error) {
+		gotUser = user
+		if _, ok := ctx.Deadline(); !ok {
+			t.Fatal("missing deadline")
+		}
+		return parseDirectoryGroups([]byte(directoryID))
+	}
+	id, err := a.Authenticate(sessionRequest())
+	if err != nil || gotUser != `VT-NAS\Administrator` || !slices.Equal(id.Groups, []string{`VT-NAS\Domain Users`, `VT-NAS\Enterprise Admins`}) {
+		t.Fatalf("id=%+v user=%q err=%v", id, gotUser, err)
+	}
+}
+
+func TestLocalIdentityNeverNeedsDirectoryLookup(t *testing.T) {
+	a := newTestAuth(t, &fakeRunner{out: "alice"})
+	a.directoryGroups = func(context.Context, string) ([]string, error) {
+		t.Fatal("directory lookup for local account")
+		return nil, nil
+	}
+	id, err := a.Authenticate(sessionRequest())
+	if err != nil || !slices.Contains(id.Groups, "staff") {
+		t.Fatalf("id=%+v err=%v", id, err)
+	}
+}
+
+func TestDirectoryFailureCannotFallBackToLocalMemberLists(t *testing.T) {
+	a := newTestAuth(t, &fakeRunner{out: `OTHER\alice`})
+	if err := os.WriteFile(a.groupFile, []byte("staff:x:1030:OTHER\\alice\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	a.directoryGroups = func(context.Context, string) ([]string, error) { return nil, errors.New("directory unavailable") }
+	if _, err := a.Authenticate(sessionRequest()); err == nil || errors.Is(err, errNoSession) {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestDirectoryMembershipAndSessionAreRecheckedEachRequest(t *testing.T) {
+	runner := &fakeRunner{out: `VT-NAS\Administrator`}
+	a := newTestAuth(t, runner)
+	calls := 0
+	a.directoryGroups = func(context.Context, string) ([]string, error) {
+		calls++
+		if calls == 1 {
+			return []string{`VT-NAS\Domain Users`}, nil
+		}
+		return []string{`VT-NAS\Other`}, nil
+	}
+	id, _ := a.Authenticate(sessionRequest())
+	if !slices.Contains(id.Groups, `VT-NAS\Domain Users`) {
+		t.Fatal(id)
+	}
+	id, _ = a.Authenticate(sessionRequest())
+	if slices.Contains(id.Groups, `VT-NAS\Domain Users`) || calls != 2 {
+		t.Fatal(id, calls)
+	}
+	runner.err = &exitError{}
+	if _, err := a.Authenticate(sessionRequest()); !errors.Is(err, errNoSession) || calls != 2 {
+		t.Fatal(err, calls)
+	}
+}
+
+func TestNSSParserPreservesQualifiedNamesAndFailsClosed(t *testing.T) {
+	for _, text := range []string{directoryID + "\n", `uid=123(alice@example.test) gid=200(staff@example.test) groups=200(staff@example.test),201(Domain Users@example.test)`} {
+		groups, err := parseDirectoryGroups([]byte(text))
+		if err != nil || len(groups) != 2 {
+			t.Fatalf("groups=%q err=%v", groups, err)
+		}
+	}
+	for _, text := range []string{"", "100 101", `uid=1(alice) gid=2(staff) groups=2`, `uid=1(alice) gid=2(staff) groups=3(ops)`, `uid=1(alice) gid=2(staff) groups=2(staff),3`, `uid=1(alice) gid=2(staff) groups=2(staff),3(bad(name))`, directoryID + "\n" + directoryID, `uid=1(alice) gid=2(staff) groups=2(staff),2(ops)`} {
+		if _, err := parseDirectoryGroups([]byte(text)); err == nil {
+			t.Fatalf("accepted %q", text)
+		}
+	}
+}
+
+func TestDirectoryCommandIsBoundedAndHasNoSessionEnvironment(t *testing.T) {
+	var gotPath string
+	var gotArgs, gotEnv []string
+	lookup := directoryLookup{timeout: 20 * time.Millisecond, run: func(ctx context.Context, path string, args, env []string) ([]byte, error) {
+		gotPath, gotArgs, gotEnv = path, args, env
+		if _, ok := ctx.Deadline(); !ok {
+			t.Fatal("missing deadline")
+		}
+		return []byte(directoryID), nil
+	}}
+	if _, err := lookup.groups(context.Background(), `VT-NAS\Administrator`); err != nil {
+		t.Fatal(err)
+	}
+	if gotPath != "/usr/bin/id" || !slices.Equal(gotArgs, []string{`VT-NAS\Administrator`}) || !slices.Equal(gotEnv, []string{"LC_ALL=C"}) {
+		t.Fatal(gotPath, gotArgs, gotEnv)
+	}
+	for _, user := range []string{"", "-G", "--help", "alice\nadmin", "alice;id"} {
+		gotPath = ""
+		if _, err := lookup.groups(context.Background(), user); err == nil || gotPath != "" {
+			t.Fatal(user, err, gotPath)
+		}
+	}
+	lookup.run = func(ctx context.Context, _ string, _, _ []string) ([]byte, error) {
+		<-ctx.Done()
+		return nil, ctx.Err()
+	}
+	if _, err := lookup.groups(context.Background(), "alice"); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatal(err)
+	}
+}
+
+func TestDirectoryRulesKeepTheDomainAndExactCase(t *testing.T) {
+	for _, name := range []string{`VT-NAS\Domain Users`, `Domain Users@example.test`, `DOMAIN\staff`, `staff@example.test`} {
+		cfg := config{Upstream: "127.0.0.1:1", Access: accessGroups, Groups: []string{name}}
+		g, err := newGateway(cfg, &fakeAuth{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !g.permits(identity{Groups: []string{name}}) {
+			t.Fatal(name)
+		}
+		for _, other := range []string{"Domain Users", "staff", `OTHER\Domain Users`, `VT-NAS\domain users`} {
+			if other != name && g.permits(identity{Groups: []string{other}}) {
+				t.Fatal(name, other)
+			}
+		}
+	}
+	g := &gateway{cfg: config{Access: accessAdmins}}
+	if g.permits(identity{Groups: []string{`DOMAIN\administrators`}}) {
+		t.Fatal("domain group became a local administrator")
+	}
+}
+
+func TestDirectoryLookupFailureNeverReachesUpstream(t *testing.T) {
+	a := newTestAuth(t, &fakeRunner{out: `DOMAIN\alice`})
+	a.directoryGroups = func(context.Context, string) ([]string, error) { return nil, errors.New("offline") }
+	g, err := newGateway(config{Upstream: "127.0.0.1:1", Access: accessGroups, Groups: []string{`DOMAIN\staff`}}, a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	w := httptest.NewRecorder()
+	g.ServeHTTP(w, sessionRequest())
+	if w.Header().Get("X-Synopkgland-Error") != "auth_unavailable" {
+		t.Fatal(w.Code, w.Body.String())
+	}
+}
+
+func TestDirectoryIdentitySupportsQualifiedAccountLength(t *testing.T) {
+	user := "DOMAIN\\" + strings.Repeat("a", 100)
+	a := newTestAuth(t, &fakeRunner{out: user})
+	a.directoryGroups = func(context.Context, string) ([]string, error) { return []string{`DOMAIN\staff`}, nil }
+	id, err := a.Authenticate(sessionRequest())
+	if err != nil || id.User != user {
+		t.Fatal(id, err)
+	}
+}
+
+func TestNSSParserBoundsIDsGroupsAndOutput(t *testing.T) {
+	base := `uid=1(alice) gid=2(staff) groups=2(staff)`
+	for _, text := range []string{strings.Replace(base, "uid=1", "uid=4294967295", 1), strings.Replace(base, "gid=2", "gid=4294967296", 1), base + strings.Repeat(",3(ops)", 256), base + strings.Repeat(" ", maxDirectoryOutput), strings.Replace(base, "2(staff)", "02(staff)", -1)} {
+		if _, err := parseDirectoryGroups([]byte(text)); err == nil {
+			t.Fatal("accepted out-of-bounds output")
+		}
+	}
+	var output directoryOutput
+	if _, err := output.Write(make([]byte, maxDirectoryOutput)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := output.Write([]byte{1}); err == nil || len(output.data) != maxDirectoryOutput {
+		t.Fatal("output not bounded")
+	}
+}
+
+func TestNSSNonzeroExitAndCancellationDiscardEvenValidGroups(t *testing.T) {
+	for _, cancelled := range []bool{false, true} {
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+		d := directoryLookup{timeout: time.Second, run: func(context.Context, string, []string, []string) ([]byte, error) {
+			if cancelled {
+				cancel()
+				return []byte(directoryID), nil
+			}
+			return []byte(directoryID), errors.New("exit 1")
+		}}
+		if groups, err := d.groups(ctx, `VT-NAS\Administrator`); err == nil || len(groups) != 0 {
+			t.Fatal(groups, err)
+		}
+	}
+}