@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/dsm/admin_linux_test.go

@@ -0,0 +1,49 @@
+//go:build linux
+
+package dsm
+
+import (
+	"context"
+	"golang.org/x/sys/unix"
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestNativeBridgeIsSealedBeforeExecution(t *testing.T) {
+	file, err := sealedBridge([]byte("immutable"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	if _, err = file.WriteAt([]byte("attack"), 0); err == nil {
+		t.Fatal("sealed executable remains writable")
+	}
+	if err = file.Truncate(0); err == nil {
+		t.Fatal("sealed executable can shrink")
+	}
+	seals, err := unix.FcntlInt(file.Fd(), unix.F_GET_SEALS, 0)
+	if err != nil || seals != unix.F_SEAL_WRITE|unix.F_SEAL_GROW|unix.F_SEAL_SHRINK|unix.F_SEAL_SEAL {
+		t.Fatal(seals, err)
+	}
+}
+
+// Read-only device fixture. The runner provides existing principals and executes
+// this test binary from a memfd. No files, users, groups or NAS settings change.
+func TestNativeAdministratorDeviceFixture(t *testing.T) {
+	fixture := os.Getenv("DSM_ADMIN_DEVICE_FIXTURE")
+	if fixture == "" {
+		t.Skip("device runner supplies existing principals")
+	}
+	for _, row := range strings.Split(fixture, ";") {
+		fields := strings.SplitN(row, "=", 2)
+		if len(fields) != 2 {
+			t.Fatal("bad fixture")
+		}
+		want := fields[0] == "1"
+		got, err := IsAdministrator(context.Background(), fields[1])
+		if err != nil || got != want {
+			t.Fatalf("native role %q: %v %v want=%v", fields[1], got, err, want)
+		}
+	}
+}

package/templates/native-go/backend/internal/dsm/admin_other.go

@@ -0,0 +1,12 @@
+//go:build !linux
+
+package dsm
+
+import (
+	"context"
+	"os/exec"
+)
+
+// Host tests inject a role provider; DSM native roles require Linux.
+func nativeAdministrator(context.Context, string) (bool, error) { return false, errNativeRole }
+func configureCommand(*exec.Cmd)                                {}

package/templates/native-go/backend/internal/dsm/admin_test.go

@@ -0,0 +1,67 @@
+package dsm
+
+import (
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+)
+
+func TestNativeRoleProtocolNeverGuessesPrivileges(t *testing.T) {
+	for _, tc := range []struct {
+		out          string
+		err          error
+		admin, valid bool
+	}{
+		{"1\n", nil, true, true}, {"0\n", nil, false, true},
+		{"1\n", errors.New("failed"), false, false}, {"true\n", nil, false, false},
+		{"2\n", nil, false, false}, {"-1\n", nil, false, false}, {"1\n0\n", nil, false, false},
+		{"1", nil, false, false}, {" 1\n", nil, false, false}, {"", nil, false, false},
+	} {
+		admin, err := parseNativeRole([]byte(tc.out), tc.err)
+		if admin != tc.admin || (err == nil) != tc.valid {
+			t.Fatalf("%q: admin=%v err=%v", tc.out, admin, err)
+		}
+	}
+}
+
+func TestDirectoryPrincipalsArePreservedForNativeSDK(t *testing.T) {
+	for _, name := range []string{`CORP\alice`, "alice@example.com", "CORP\\\u7ba1\u7406\u54e1", "user with space@example.com", strings.Repeat("a", 256)} {
+		a := newTestAuth(t, &fakeRunner{out: name + "\n"})
+		a.isAdministrator = func(_ context.Context, actual string) (bool, error) {
+			if actual != name {
+				t.Fatalf("principal rewritten %q => %q", name, actual)
+			}
+			return true, nil
+		}
+		id, err := a.Authenticate(sessionRequest())
+		if err != nil || !id.Admin || id.User != name {
+			t.Fatalf("%q: %+v %v", name, id, err)
+		}
+	}
+	for _, name := range []string{"", "alice\nadmin", "alice\x00admin", " alice", "alice ", string([]byte{0xff}), strings.Repeat("a", 1025)} {
+		if validPrincipal(name) {
+			t.Fatalf("accepted invalid principal %q", name)
+		}
+	}
+}
+
+func TestNativeOutputBufferIsBounded(t *testing.T) {
+	out := &boundedOutput{limit: 16}
+	if n, err := out.Write([]byte(strings.Repeat("x", 16))); n != 16 || err != nil {
+		t.Fatal(n, err)
+	}
+	if _, err := out.Write([]byte("1")); err == nil || out.Len() != 16 {
+		t.Fatal(err, out.Len())
+	}
+}
+
+func TestNativeOutputCopyCannotBypassLimit(t *testing.T) {
+	out := &boundedOutput{limit: 16}
+	source := struct{ io.Reader }{strings.NewReader(strings.Repeat("x", 4096))}
+	_, err := io.Copy(out, source)
+	if err == nil || out.Len() > 16 {
+		t.Fatalf("copy bypassed output limit: len=%d err=%v", out.Len(), err)
+	}
+}

package/templates/native-go/backend/internal/dsm/auth.go

@@ -3,24 +3,21 @@
 // DSM runs a package's CGI as the package account and forwards the browser's
 // cookies. This package hands only the session carriers (cookie, SynoToken,
 // client address) to DSM's own authenticate.cgi, which prints the signed-in
-// user name, then reads administrators membership from DSM's group file. It
-// never parses the session cookie or trusts a user name from the request.
+// user name. DSM's native SDK then resolves administrator membership for
+// local, AD and LDAP accounts; no group-name comparison lives in this package.
 package dsm
 
 import (
-	"bufio"
 	"context"
 	"errors"
 	"fmt"
 	"net"
 	"net/http"
 	"net/url"
-	"os"
-	"os/exec"
-	"regexp"
-	"slices"
 	"strings"
 	"time"
+	"unicode"
+	"unicode/utf8"
 
 	"dsmapp/internal/api"
 )
@@ -30,22 +27,28 @@ const AuthenticateCGI = "/usr/syno/synoman/webman/modules/authenticate.cgi"
 
 // Authenticator implements api.Authenticator against DSM.
 type Authenticator struct {
-	GroupFile  string
-	AdminGroup string
-	Timeout    time.Duration
-	run        func(ctx context.Context, path string, env []string) ([]byte, error)
+	Timeout         time.Duration
+	run             func(ctx context.Context, path string, env []string) ([]byte, error)
+	isAdministrator func(context.Context, string) (bool, error)
 }
 
 func NewAuthenticator() *Authenticator {
-	return &Authenticator{
-		GroupFile:  "/etc/group",
-		AdminGroup: "administrators",
-		Timeout:    10 * time.Second,
-		run:        runCGI,
-	}
+	return &Authenticator{Timeout: 10 * time.Second, run: runCGI, isAdministrator: IsAdministrator}
 }
 
-var userName = regexp.MustCompile(`^[A-Za-z0-9._@\\-]{1,64}$`)
+// The name comes only from authenticate.cgi. Preserve directory-qualified and
+// Unicode principals verbatim; controls, multiline and unbounded names refuse.
+func validPrincipal(name string) bool {
+	if name == "" || len(name) > 1024 || !utf8.ValidString(name) || strings.TrimSpace(name) != name || strings.ContainsAny(name, "<>/") {
+		return false
+	}
+	for _, ch := range name {
+		if unicode.IsControl(ch) {
+			return false
+		}
+	}
+	return true
+}
 
 func (a *Authenticator) Authenticate(r *http.Request) (api.Identity, error) {
 	cookie := r.Header.Get("Cookie")
@@ -62,11 +65,11 @@ func (a *Authenticator) Authenticate(r *http.Request) (api.Identity, error) {
 	if err != nil {
 		return api.Identity{}, fmt.Errorf("run %s: %w", AuthenticateCGI, err)
 	}
-	user := strings.TrimSpace(string(out))
-	if !userName.MatchString(user) {
+	user := strings.TrimSuffix(strings.TrimSuffix(string(out), "\n"), "\r")
+	if !validPrincipal(user) {
 		return api.Identity{}, api.ErrNoSession
 	}
-	admin, err := a.isMember(user)
+	admin, err := a.isAdministrator(ctx, user)
 	if err != nil {
 		return api.Identity{}, err
 	}
@@ -89,30 +92,3 @@ func sessionEnv(r *http.Request, cookie string) []string {
 		"REMOTE_ADDR=" + host,
 	}
 }
-
-func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, path)
-	cmd.Env = env
-	return cmd.Output()
-}
-
-// isMember reads the group file fresh on every request, so removing someone
-// from administrators takes effect immediately.
-func (a *Authenticator) isMember(user string) (bool, error) {
-	f, err := os.Open(a.GroupFile)
-	if err != nil {
-		return false, fmt.Errorf("read groups: %w", err)
-	}
-	defer f.Close()
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		fields := strings.Split(scanner.Text(), ":")
-		if len(fields) == 4 && fields[0] == a.AdminGroup {
-			return slices.Contains(strings.Split(fields[3], ","), user), nil
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		return false, fmt.Errorf("read groups: %w", err)
-	}
-	return false, nil
-}

package/templates/native-go/backend/internal/dsm/auth_test.go

@@ -5,8 +5,6 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
-	"os"
-	"path/filepath"
 	"slices"
 	"strings"
 	"testing"
@@ -14,12 +12,6 @@ import (
 	"dsmapp/internal/api"
 )
 
-const groupFile = `root:x:0:
-users:x:100:
-administrators:x:101:admin,alice
-http:x:1023:
-`
-
 type fakeRunner struct {
 	out  string
 	err  error
@@ -34,12 +26,10 @@ func (f *fakeRunner) run(_ context.Context, path string, env []string) ([]byte,
 
 func newTestAuth(t *testing.T, runner *fakeRunner) *Authenticator {
 	t.Helper()
-	groups := filepath.Join(t.TempDir(), "group")
-	if err := os.WriteFile(groups, []byte(groupFile), 0o644); err != nil {
-		t.Fatal(err)
-	}
 	a := NewAuthenticator()
-	a.GroupFile = groups
+	a.isAdministrator = func(_ context.Context, name string) (bool, error) {
+		return name == "alice" || name == `CORP\alice` || name == "alice@example.com", nil
+	}
 	a.run = runner.run
 	return a
 }
@@ -53,7 +43,7 @@ func sessionRequest() *http.Request {
 	return r
 }
 
-func TestAdminUserIsResolvedFromAuthenticateCGIAndGroupFile(t *testing.T) {
+func TestAdminUserIsResolvedFromAuthenticateCGIAndNativeProvider(t *testing.T) {
 	runner := &fakeRunner{out: "alice\n"}
 	id, err := newTestAuth(t, runner).Authenticate(sessionRequest())
 	if err != nil || id.User != "alice" || !id.Admin {
@@ -102,12 +92,12 @@ func TestMissingCookieNeverRunsAuthenticateCGI(t *testing.T) {
 
 func TestRejectedOrMalformedSessionsAreNoSession(t *testing.T) {
 	for name, runner := range map[string]*fakeRunner{
-		"exit status":   {err: &exitError{}},
-		"empty output":  {out: "\n"},
-		"two lines":     {out: "alice\nadmin\n"},
-		"html output":   {out: "<html>login</html>"},
-		"overlong name": {out: strings.Repeat("a", 200)},
-		"space in name": {out: "alice admin"},
+		"exit status":     {err: &exitError{}},
+		"empty output":    {out: "\n"},
+		"two lines":       {out: "alice\nadmin\n"},
+		"html output":     {out: "<html>login</html>"},
+		"overlong name":   {out: strings.Repeat("a", 1025)},
+		"control in name": {out: "alice\x00admin"},
 	} {
 		t.Run(name, func(t *testing.T) {
 			_, err := newTestAuth(t, runner).Authenticate(sessionRequest())
@@ -125,11 +115,11 @@ func TestBrokenAuthenticatorIsUnavailableNotNoSession(t *testing.T) {
 	}
 }
 
-func TestUnreadableGroupFileFailsClosed(t *testing.T) {
+func TestUnavailableNativeRoleFailsClosed(t *testing.T) {
 	a := newTestAuth(t, &fakeRunner{out: "alice"})
-	a.GroupFile = filepath.Join(t.TempDir(), "missing")
+	a.isAdministrator = func(context.Context, string) (bool, error) { return false, errors.New("native unavailable") }
 	if _, err := a.Authenticate(sessionRequest()); err == nil || errors.Is(err, api.ErrNoSession) {
-		t.Fatalf("err = %v, want unavailable", err)
+		t.Fatalf("err=%v, want unavailable", err)
 	}
 }
 
@@ -137,3 +127,33 @@ type exitError struct{}
 
 func (*exitError) Error() string { return "exit status 1" }
 func (*exitError) ExitCode() int { return 1 }
+
+func TestAdministratorMembershipIsQueriedEachRequestAndNotAnAccountName(t *testing.T) {
+	runner := &fakeRunner{out: "admin"}
+	a := newTestAuth(t, runner)
+	currentAdmin := false
+	calls := 0
+	a.isAdministrator = func(context.Context, string) (bool, error) { calls++; return currentAdmin, nil }
+	id, err := a.Authenticate(sessionRequest())
+	if err != nil || id.Admin {
+		t.Fatalf("account name granted privileges: %+v %v", id, err)
+	}
+	runner.out, currentAdmin = "alice", true
+	id, err = a.Authenticate(sessionRequest())
+	if err != nil || !id.Admin {
+		t.Fatalf("native administrator refused: %+v %v", id, err)
+	}
+	currentAdmin = false
+	id, err = a.Authenticate(sessionRequest())
+	if err != nil || id.Admin || calls != 3 {
+		t.Fatalf("stale role retained: %+v %v calls=%d", id, err, calls)
+	}
+}
+
+func TestDirectoryAdministratorMustUseDSMRoleProvider(t *testing.T) {
+	a := newTestAuth(t, &fakeRunner{out: `CORP\alice`})
+	id, err := a.Authenticate(sessionRequest())
+	if err != nil || !id.Admin {
+		t.Fatalf("DSM directory administrator refused: %+v %v", id, err)
+	}
+}

package/templates/native-go/backend/internal/dsm/native/admin_check.c

@@ -0,0 +1,28 @@
+// Minimal DSM SDK bridge: the Go CGI remains static. No group names, UID
+// shortcuts, environment-based library selection or application policy here.
+#include <dlfcn.h>
+#include <stdio.h>
+#include <string.h>
+
+#ifndef DSM_SDK_LIBRARY
+#define DSM_SDK_LIBRARY "/usr/lib/libsynosdk.so"
+#endif
+
+// ABI from synosdk/group_p.h: int (const char *, BOOL), BOOL is a 32-bit int.
+// Keep the bridge limited to this primitive ABI instead of copying SDK structs.
+typedef int (*admin_check_fn)(const char *, int);
+_Static_assert(sizeof(int) == 4, "DSM BOOL ABI requires a 32-bit int");
+
+int main(int argc, char **argv) {
+    if (argc != 2 || argv[1][0] == '\0' || strlen(argv[1]) > 1024) return 2;
+    void *library = dlopen(DSM_SDK_LIBRARY, RTLD_NOW | RTLD_LOCAL);
+    if (!library) return 2;
+    admin_check_fn check = (admin_check_fn)dlsym(library, "SLIBGroupIsAdminGroupMem");
+    if (!check) { dlclose(library); return 2; }
+    // TRUE bypasses DSM's directory-admin cache; DSM resolves local/domain/LDAP
+    // identity and configured administrator groups itself.
+    int result = check(argv[1], 1);
+    dlclose(library);
+    if (result != 0 && result != 1) return 2;
+    return printf("%d\n", result) == 2 ? 0 : 2;
+}

package/templates/native-go/backend/internal/dsm/native/build.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+# Zig 0.16.0 cross-compiles this small libc/dlopen bridge. No proprietary SDK
+# headers or libraries are distributed. GNU ABI 2.17 covers both DSM targets.
+cd "$(dirname "$0")"
+[ "$(zig version)" = "0.16.0" ] || { echo 'requires Zig 0.16.0' >&2; exit 2; }
+for arch in x86_64 aarch64; do
+  zig cc admin_check.c -target "$arch-linux-gnu.2.17" -std=c11 -O2 -Wall -Wextra -Werror -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wl,-z,relro,-z,now -Wl,--build-id=none -s -ldl -o "admin-$arch.elf"
+done