@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/_executor/executor.go

@@ -0,0 +1,524 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+	"unicode"
+	"unicode/utf8"
+)
+
+const version = "1"
+const maxRequest = 64 << 10
+
+var allOps = []string{"status", "delegate.create", "delegate.list", "delegate.revoke", "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "root.run"}
+var tokenRE = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$`)
+var idRE = regexp.MustCompile(`^[a-f0-9]{64}$`)
+
+type Policy struct {
+	Version    int               `json:"v"`
+	Package    string            `json:"package"`
+	App        string            `json:"app"`
+	Scope      string            `json:"scope,omitempty"`
+	Operations []string          `json:"operations"`
+	Root       map[string]string `json:"root,omitempty"`
+}
+type Subject struct {
+	Username string `json:"username"`
+	UID      int    `json:"uid"`
+	GID      int    `json:"gid"`
+	Groups   []int  `json:"groups"`
+	Home     string `json:"home"`
+	Expired  string `json:"expired"`
+	Admin    bool   `json:"admin"`
+}
+type Delegation struct {
+	ID      string    `json:"delegation_id"`
+	Package string    `json:"package"`
+	Subject Subject   `json:"subject"`
+	Job     string    `json:"job_id"`
+	Ops     []string  `json:"ops"`
+	Scope   string    `json:"scope"`
+	Path    string    `json:"path"`
+	Root    string    `json:"root"`
+	Expires time.Time `json:"expires_at"`
+	Revoked bool      `json:"revoked"`
+}
+type Auth struct {
+	Cookie    string `json:"dsm_cookie,omitempty"`
+	SynoToken string `json:"dsm_synotoken,omitempty"`
+	hasKeys   bool
+}
+
+// Preserve wire key presence: an explicit empty credential is caller auth.
+func (a *Auth) UnmarshalJSON(b []byte) error {
+	type plainAuth Auth
+	var decoded plainAuth
+	if err := strictJSON(b, &decoded); err != nil {
+		return err
+	}
+	var keys map[string]json.RawMessage
+	if err := json.Unmarshal(b, &keys); err != nil {
+		return err
+	}
+	for key := range keys {
+		if key != "dsm_cookie" && key != "dsm_synotoken" {
+			return errors.New("auth key")
+		}
+	}
+	*a = Auth(decoded)
+	a.hasKeys = len(keys) > 0 || bytes.Equal(bytes.TrimSpace(b), []byte("null"))
+	return nil
+}
+
+type Request struct {
+	Version int             `json:"v"`
+	Op      string          `json:"op"`
+	Auth    Auth            `json:"auth"`
+	Params  json.RawMessage `json:"params"`
+}
+type Response struct {
+	OK      bool   `json:"ok"`
+	Result  any    `json:"result,omitempty"`
+	Code    string `json:"code,omitempty"`
+	Message string `json:"message,omitempty"`
+}
+type Params struct {
+	Job     string   `json:"job_id,omitempty"`
+	Ops     []string `json:"ops,omitempty"`
+	Scope   string   `json:"scope,omitempty"`
+	Path    string   `json:"path,omitempty"`
+	TTL     int64    `json:"ttl_seconds,omitempty"`
+	ID      string   `json:"delegation_id,omitempty"`
+	Staging string   `json:"staging,omitempty"`
+	Dest    string   `json:"dest_dir,omitempty"`
+	Name    string   `json:"name,omitempty"`
+}
+type DSM interface {
+	Verify(context.Context, string, string) (string, error)
+	Account(context.Context, string) (Subject, error)
+	Allow(context.Context, Subject, string) error
+	ScopeRoot(context.Context, Subject, string) (string, error)
+	API(context.Context, string, string, map[string]any) (json.RawMessage, error)
+}
+type writeJobKey struct{}
+
+type Writer interface {
+	Write(context.Context, Subject, string, string, string, string) error
+}
+type RootRunner interface {
+	Run(context.Context, string, string) (string, error)
+}
+type Executor struct {
+	Policy                       Policy
+	DSM                          DSM
+	Writer                       Writer
+	Runner                       RootRunner
+	Store                        *Store
+	Now                          func() time.Time
+	ExecutorDigest, PolicyDigest string
+	mu                           sync.Mutex // Serializes execution with revoke, including already accepted requests.
+}
+
+func deny(code string) Response {
+	return Response{Code: code, Message: strings.ToLower(strings.ReplaceAll(code, "_", " "))}
+}
+func success(v any) Response { return Response{OK: true, Result: v} }
+func contains(v []string, s string) bool {
+	for _, x := range v {
+		if x == s {
+			return true
+		}
+	}
+	return false
+}
+func validName(s string) bool {
+	return s != "" && !strings.Contains(s, "/") && !strings.Contains(s, "..") && !strings.ContainsFunc(s, unicode.IsControl) && utf8.ValidString(s)
+}
+func cleanPath(p string) bool {
+	return strings.HasPrefix(p, "/") && filepath.Clean(p) == p && !strings.ContainsFunc(p, unicode.IsControl) && utf8.ValidString(p)
+}
+func within(root, p string) bool {
+	return p == root || strings.HasPrefix(p, strings.TrimSuffix(root, "/")+"/")
+}
+func strictJSON(b []byte, v any) error {
+	if !utf8.Valid(b) {
+		return errors.New("utf8")
+	}
+	// encoding/json otherwise silently accepts duplicate keys, including auth.
+	d := json.NewDecoder(bytes.NewReader(b))
+	_, params := v.(*Params)
+	_, auth := v.(*Auth)
+	if err := uniqueValue(d, params || auth); err != nil {
+		return err
+	}
+	if _, err := d.Token(); err != io.EOF {
+		return errors.New("trailing JSON")
+	}
+	d = json.NewDecoder(bytes.NewReader(b))
+	d.DisallowUnknownFields()
+	return d.Decode(v)
+}
+
+// Match encoding/json's Unicode case folding when detecting duplicate keys.
+func foldJSONKey(s string) string {
+	return strings.Map(func(r rune) rune {
+		folded := r
+		for next := unicode.SimpleFold(r); next != r; next = unicode.SimpleFold(next) {
+			if next < folded {
+				folded = next
+			}
+		}
+		return folded
+	}, s)
+}
+func uniqueValue(d *json.Decoder, canonical bool) error {
+	tok, err := d.Token()
+	if err != nil {
+		return err
+	}
+	del, ok := tok.(json.Delim)
+	if !ok {
+		return nil
+	}
+	switch del {
+	case '{':
+		seen := map[string]bool{}
+		for d.More() {
+			k, err := d.Token()
+			if err != nil {
+				return err
+			}
+			s, ok := k.(string)
+			folded := foldJSONKey(s)
+			if !ok || seen[folded] {
+				return errors.New("duplicate key")
+			}
+			seen[folded] = true
+			credentialObject := strings.EqualFold(s, "auth") || strings.EqualFold(s, "params")
+			if credentialObject && s != "auth" && s != "params" {
+				return errors.New("noncanonical key")
+			}
+			if canonical && strings.ContainsFunc(s, func(r rune) bool { return !((r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '_') }) {
+				return errors.New("noncanonical key")
+			}
+			if err = uniqueValue(d, canonical || credentialObject); err != nil {
+				return err
+			}
+		}
+	case '[':
+		for d.More() {
+			if err = uniqueValue(d, canonical); err != nil {
+				return err
+			}
+		}
+	default:
+		return errors.New("invalid JSON")
+	}
+	_, err = d.Token()
+	return err
+}
+func (e *Executor) Connection(parent context.Context, c net.Conn, uid int, peer func(net.Conn) (int, error)) {
+	got, err := peer(c)
+	if err != nil || got != uid {
+		return
+	}
+	c.SetDeadline(time.Now().Add(15 * time.Second))
+	r := bufio.NewReaderSize(c, maxRequest+1)
+	line, err := r.ReadSlice('\n')
+	var out Response
+	if len(line) > maxRequest || err == bufio.ErrBufferFull {
+		out = deny("REQUEST_TOO_LARGE")
+	} else if err != nil {
+		out = deny("INVALID_REQUEST")
+	} else {
+		var req Request
+		if strictJSON(line, &req) != nil {
+			out = deny("INVALID_REQUEST")
+		} else {
+			ctx, cancel := context.WithTimeout(parent, 30*time.Second)
+			defer cancel()
+			out = e.Handle(ctx, req)
+		}
+	}
+	c.SetWriteDeadline(time.Now().Add(5 * time.Second))
+	json.NewEncoder(c).Encode(out)
+}
+func (e *Executor) eligible(ctx context.Context, name string, uid int, files bool) (Subject, string) {
+	s, err := e.DSM.Account(ctx, name)
+	if err != nil || s.Username != name || s.Expired != "normal" || s.Admin || s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || (uid >= 0 && s.UID != uid) {
+		return Subject{}, "INELIGIBLE"
+	}
+	if e.DSM.Allow(ctx, s, e.Policy.App) != nil {
+		return Subject{}, "APP_DENIED"
+	}
+	if files && e.DSM.Allow(ctx, s, "SYNO.SDS.App.FileStation3.Instance") != nil {
+		return Subject{}, "APP_DENIED"
+	}
+	return s, ""
+}
+func (e *Executor) verified(ctx context.Context, auth Auth) (Subject, string) {
+	if auth.Cookie == "" || len(auth.Cookie) > 4096 || (strings.Contains(auth.Cookie, ";") || strings.ContainsFunc(auth.Cookie, func(r rune) bool { return r < 0x20 || r == 0x7f })) || auth.SynoToken == "" || len(auth.SynoToken) > 4096 || strings.ContainsFunc(auth.SynoToken, unicode.IsControl) {
+		return Subject{}, "AUTH_DENIED"
+	}
+	name, err := e.DSM.Verify(ctx, auth.Cookie, auth.SynoToken)
+	if err != nil || name == "" {
+		return Subject{}, "AUTH_DENIED"
+	}
+	s, err := e.DSM.Account(ctx, name)
+	if err != nil || s.Username != name || s.Expired != "normal" {
+		return Subject{}, "AUTH_DENIED"
+	}
+	return s, ""
+}
+func (e *Executor) Handle(ctx context.Context, r Request) Response {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if ctx.Err() != nil {
+		return deny("EXECUTOR_PAUSED")
+	}
+	if r.Version != 1 {
+		return deny("INVALID_REQUEST")
+	}
+	if !contains(allOps, r.Op) {
+		return deny("UNKNOWN_OP")
+	}
+	if !contains(e.Policy.Operations, r.Op) {
+		return deny("POLICY_DENIED")
+	}
+	var p Params
+	if len(r.Params) == 0 {
+		r.Params = json.RawMessage(`{}`)
+	}
+	if strictJSON(r.Params, &p) != nil {
+		return deny("INVALID_REQUEST")
+	}
+	// Reject parameters belonging to another operation, rather than silently ignoring them.
+	var keys map[string]json.RawMessage
+	if json.Unmarshal(r.Params, &keys) != nil {
+		return deny("INVALID_REQUEST")
+	}
+	allowed := map[string]string{"status": "", "delegate.create": "job_id ops scope path ttl_seconds", "delegate.list": "", "delegate.revoke": "delegation_id job_id", "files.list": "delegation_id job_id path", "files.info": "delegation_id job_id path", "files.createFolder": "delegation_id job_id path name", "files.checkPermission": "delegation_id job_id path", "files.write": "delegation_id job_id staging dest_dir name", "root.run": "name"}
+	for k := range keys {
+		if !contains(strings.Fields(allowed[r.Op]), k) {
+			return deny("INVALID_REQUEST")
+		}
+	}
+	switch r.Op {
+	case "status":
+		return success(map[string]any{"executor_digest": e.ExecutorDigest, "policy_digest": e.PolicyDigest, "version": version, "ready": true})
+	case "delegate.create":
+		if !tokenRE.MatchString(p.Job) || p.TTL <= 0 || p.TTL > 86400*30 || len(p.Ops) == 0 || p.Scope != e.Policy.Scope || !cleanPath(p.Path) {
+			return deny("INVALID_REQUEST")
+		}
+		for _, op := range p.Ops {
+			if !strings.HasPrefix(op, "files.") || !contains(allOps, op) || !contains(e.Policy.Operations, op) {
+				return deny("POLICY_DENIED")
+			}
+		}
+		s, code := e.verified(ctx, r.Auth)
+		if code != "" {
+			return deny(code)
+		}
+		s, code = e.eligible(ctx, s.Username, s.UID, true)
+		if code != "" {
+			return deny(code)
+		}
+		root, err := e.DSM.ScopeRoot(ctx, s, p.Scope)
+		if err != nil {
+			return deny("SCOPE_DENIED")
+		}
+		d := Delegation{Package: e.Policy.Package, Subject: s, Job: p.Job, Ops: p.Ops, Scope: p.Scope, Path: scopeVirtual(p.Scope), Root: root, Expires: e.Now().UTC().Add(time.Duration(p.TTL) * time.Second)}
+		real, err := scopedPath(d, p.Path)
+		if err != nil {
+			return deny("SCOPE_DENIED")
+		}
+		d.Root = real
+		d.Path = p.Path
+		// Permission creation is checked as the subject, never SYSTEM_ADMIN.
+		if _, err = e.DSM.API(ctx, s.Username, "files.checkPermission", map[string]any{"path": p.Path}); err != nil {
+			return deny("PERMISSION_DENIED")
+		}
+		id := make([]byte, 32)
+		if _, err = rand.Read(id); err != nil {
+			return deny("INTERNAL")
+		}
+		d.ID = hex.EncodeToString(id)
+		if e.Store.Put(d) != nil {
+			return deny("STORAGE_ERROR")
+		}
+		return success(map[string]any{"delegation_id": d.ID, "subject": publicSubject(s), "expires_at": d.Expires})
+	case "delegate.list":
+		s, code := e.verified(ctx, r.Auth)
+		if code != "" {
+			return deny(code)
+		}
+		ds, err := e.Store.List()
+		if err != nil {
+			return deny("STORAGE_ERROR")
+		}
+		out := []any{}
+		for _, d := range ds {
+			if d.Package == e.Policy.Package && d.Subject.UID == s.UID && d.Subject.Username == s.Username {
+				out = append(out, publicDelegation(d))
+			}
+		}
+		return success(map[string]any{"delegations": out})
+	case "delegate.revoke":
+		d, err := e.Store.Get(p.ID)
+		if err != nil || d.Package != e.Policy.Package {
+			return deny("DELEGATION_DENIED")
+		}
+		if r.Auth.hasKeys || r.Auth.Cookie != "" || r.Auth.SynoToken != "" {
+			s, code := e.verified(ctx, r.Auth)
+			if code != "" {
+				return deny(code)
+			}
+			if !s.Admin && (s.UID != d.Subject.UID || s.Username != d.Subject.Username) {
+				return deny("DELEGATION_DENIED")
+			}
+		} else if p.Job == "" || p.Job != d.Job {
+			return deny("DELEGATION_DENIED")
+		}
+		d.Revoked = true
+		if e.Store.Put(d) != nil {
+			return deny("STORAGE_ERROR")
+		}
+		return success(map[string]any{"revoked": true})
+	case "root.run":
+		if !tokenRE.MatchString(p.Name) {
+			return deny("INVALID_REQUEST")
+		}
+		digest, ok := e.Policy.Root[p.Name]
+		if !ok {
+			return deny("POLICY_DENIED")
+		}
+		s, code := e.verified(ctx, r.Auth)
+		if code != "" {
+			return deny(code)
+		}
+		if !s.Admin {
+			return deny("ADMIN_REQUIRED")
+		}
+		if e.DSM.Allow(ctx, s, e.Policy.App) != nil {
+			return deny("APP_DENIED")
+		}
+		if e.Runner == nil {
+			return deny("ROOT_FAILED")
+		}
+		out, err := e.Runner.Run(ctx, p.Name, digest)
+		if err != nil {
+			return deny("ROOT_FAILED")
+		}
+		return success(map[string]any{"output": out})
+	}
+	d, err := e.Store.Get(p.ID)
+	if err != nil || d.Package != e.Policy.Package || d.Revoked || !e.Now().Before(d.Expires) || d.Job != p.Job || !contains(d.Ops, r.Op) || d.Scope != e.Policy.Scope {
+		return deny("DELEGATION_DENIED")
+	}
+	s, code := e.eligible(ctx, d.Subject.Username, d.Subject.UID, true)
+	if code != "" {
+		return deny(code)
+	}
+	root, err := e.DSM.ScopeRoot(ctx, s, d.Scope)
+	if err != nil {
+		return deny("SCOPE_DENIED")
+	}
+	// Revalidate the root so a moved home/share never inherits an old delegation.
+	check := d
+	check.Root = root
+	check.Path = scopeVirtual(d.Scope)
+	real, err := scopedPath(check, d.Path)
+	if err != nil || real != d.Root {
+		return deny("SCOPE_DENIED")
+	}
+	path := p.Path
+	if r.Op == "files.write" {
+		path = p.Dest
+	}
+	if !cleanPath(path) {
+		return deny("INVALID_REQUEST")
+	}
+	if !within(d.Path, path) {
+		return deny("SCOPE_DENIED")
+	}
+	real, err = scopedPath(d, path)
+	if err != nil {
+		return deny("SCOPE_DENIED")
+	}
+	if r.Op == "files.write" {
+		if !validName(p.Name) || !validRelative(p.Staging) {
+			return deny("INVALID_REQUEST")
+		}
+		if err = e.Writer.Write(context.WithValue(ctx, writeJobKey{}, p.Job), s, p.Staging, real, p.Name, d.Root); err != nil {
+			return deny("WRITE_FAILED")
+		}
+		return success(map[string]any{"path": strings.TrimSuffix(p.Dest, "/") + "/" + p.Name})
+	}
+	args := map[string]any{"path": path}
+	if r.Op == "files.createFolder" {
+		if !validName(p.Name) {
+			return deny("INVALID_REQUEST")
+		}
+		args["name"] = p.Name
+	}
+	out, err := e.DSM.API(ctx, s.Username, r.Op, args)
+	if err != nil {
+		return deny("DSM_FAILED")
+	}
+	return success(out)
+}
+func publicSubject(s Subject) any { return map[string]any{"username": s.Username, "uid": s.UID} }
+func publicDelegation(d Delegation) any {
+	return map[string]any{"delegation_id": d.ID, "subject": publicSubject(d.Subject), "job_id": d.Job, "ops": d.Ops, "scope": d.Scope, "path": d.Path, "expires_at": d.Expires, "revoked": d.Revoked}
+}
+func scopeVirtual(scope string) string {
+	if scope == "home" {
+		return "/home"
+	}
+	if strings.HasPrefix(scope, "shared:") && validName(strings.TrimPrefix(scope, "shared:")) {
+		return "/" + strings.TrimPrefix(scope, "shared:")
+	}
+	return ""
+}
+func scopedPath(d Delegation, p string) (string, error) {
+	virtual := scopeVirtual(d.Scope)
+	if virtual == "" || !cleanPath(p) || !within(virtual, p) {
+		return "", errors.New("scope")
+	}
+	// Root is the bound delegation directory; Path is its File Station spelling.
+	base := d.Path
+	if base == "" {
+		base = virtual
+	}
+	if !within(base, p) {
+		return "", errors.New("scope")
+	}
+	real, err := filepath.EvalSymlinks(filepath.Join(d.Root, strings.TrimPrefix(strings.TrimPrefix(p, base), "/")))
+	if err != nil || !within(d.Root, real) {
+		return "", errors.New("scope")
+	}
+	return real, nil
+}
+func validRelative(p string) bool {
+	if p == "" || filepath.IsAbs(p) || filepath.Clean(p) != p {
+		return false
+	}
+	for _, part := range strings.Split(p, "/") {
+		if !validName(part) || part == "." {
+			return false
+		}
+	}
+	return true
+}