@synopackageland/cli 0.6.0 → 0.7.0

package/templates/native-go/backend/internal/dsm/admin_linux_test.go

@@ -3,14 +3,23 @@
 package dsm
 
 import (
+	"bytes"
 	"context"
+	"debug/elf"
+	"errors"
 	"golang.org/x/sys/unix"
+	"io"
 	"os"
 	"strings"
 	"testing"
 )
 
 func TestNativeBridgeIsSealedBeforeExecution(t *testing.T) {
+	if fd, err := unix.MemfdCreate("probe", unix.MFD_CLOEXEC); errors.Is(err, unix.ENOSYS) {
+		t.Skip("kernel has no memfd_create; covered by the fallback tests")
+	} else if err == nil {
+		unix.Close(fd)
+	}
 	file, err := sealedBridge([]byte("immutable"))
 	if err != nil {
 		t.Fatal(err)
@@ -28,6 +37,53 @@ func TestNativeBridgeIsSealedBeforeExecution(t *testing.T) {
 	}
 }
 
+func TestEveryShippedArchHasBothBridges(t *testing.T) {
+	for arch, machine := range map[string]elf.Machine{"amd64": elf.EM_X86_64, "arm64": elf.EM_AARCH64, "arm": elf.EM_ARM} {
+		for name, bridges := range map[string]map[string][]byte{"admin": adminBridges, "apppriv": appPrivBridges} {
+			file, err := elf.NewFile(bytes.NewReader(bridges[arch]))
+			if err != nil || file.Machine != machine {
+				t.Fatalf("%s bridge for %s: %v %v", name, arch, file, err)
+			}
+		}
+	}
+}
+
+func withMemfd(t *testing.T, create func(string, int) (int, error), fallback string) {
+	t.Helper()
+	saved, savedDir := memfdCreate, bridgeFallbackDir
+	t.Cleanup(func() { memfdCreate, bridgeFallbackDir = saved, savedDir })
+	memfdCreate = create
+	SetBridgeFallbackDir(fallback)
+}
+
+func TestBridgeFallsBackToPackageTempOnlyWithoutMemfd(t *testing.T) {
+	dir := t.TempDir()
+	withMemfd(t, func(string, int) (int, error) { return -1, unix.ENOSYS }, dir)
+	file, err := sealedBridge([]byte("bridge"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	got, err := io.ReadAll(file)
+	if err != nil || string(got) != "bridge" {
+		t.Fatalf("payload %q %v", got, err)
+	}
+	if entries, _ := os.ReadDir(dir); len(entries) != 0 {
+		t.Fatalf("fallback left %v", entries)
+	}
+}
+
+func TestBridgeRefusesOtherMemfdFailuresAndUnsetFallback(t *testing.T) {
+	withMemfd(t, func(string, int) (int, error) { return -1, unix.EPERM }, t.TempDir())
+	if _, err := sealedBridge([]byte("bridge")); !errors.Is(err, unix.EPERM) {
+		t.Fatalf("EPERM must not fall back: %v", err)
+	}
+	withMemfd(t, func(string, int) (int, error) { return -1, unix.ENOSYS }, "")
+	if _, err := sealedBridge([]byte("bridge")); err == nil {
+		t.Fatal("ENOSYS without a package temp directory must refuse")
+	}
+}
+
 // Read-only device fixture. The runner provides existing principals and executes
 // this test binary from a memfd. No files, users, groups or NAS settings change.
 func TestNativeAdministratorDeviceFixture(t *testing.T) {

package/templates/native-go/backend/internal/dsm/admin_other.go

@@ -9,4 +9,7 @@ import (
 
 // Host tests inject a role provider; DSM native roles require Linux.
 func nativeAdministrator(context.Context, string) (bool, error) { return false, errNativeRole }
-func configureCommand(*exec.Cmd)                                {}
+func nativeAppPrivilege(context.Context, string, string, string) (bool, error) {
+	return false, errNativeAppPriv
+}
+func configureCommand(*exec.Cmd) {}

package/templates/native-go/backend/internal/dsm/apppriv.go

@@ -0,0 +1,30 @@
+package dsm
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"regexp"
+	"time"
+)
+
+var errNativeAppPriv = errors.New("DSM Application Privileges verification unavailable")
+
+// appID is a DSM application ID such as SYNO.SDS.<package>.Instance.
+var appID = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*){1,7}$`)
+
+// AppPrivilege asks DSM's native SDK whether principal may use app from addr.
+// DSM applies its own user, group and everyone rules, deny precedence and IP
+// ranges, and always allows administrators. Unknown results refuse.
+func AppPrivilege(ctx context.Context, principal, app, addr string) (bool, error) {
+	if !validPrincipal(principal) || len(app) > 128 || !appID.MatchString(app) {
+		return false, errNativeAppPriv
+	}
+	ip, err := netip.ParseAddr(addr)
+	if err != nil || ip.Zone() != "" || ip.String() != addr {
+		return false, errNativeAppPriv
+	}
+	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	return nativeAppPrivilege(ctx, principal, app, addr)
+}

package/templates/native-go/backend/internal/dsm/bridge_file.go

@@ -0,0 +1,75 @@
+package dsm
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// bridgeFallbackDir is where a kernel without memfd_create (DSM 7 platforms on
+// Linux 3.10) stages the bridge. Empty refuses, as before the fallback existed.
+var bridgeFallbackDir string
+
+// SetBridgeFallbackDir names the package's own temp directory,
+// /var/packages/<package>/tmp. main calls it once, before serving.
+func SetBridgeFallbackDir(dir string) { bridgeFallbackDir = dir }
+
+var errBridgeDir = errors.New("bridge fallback directory must be a private absolute directory")
+
+// unlinkedBridge stages payload in a fresh 0700 directory under dir and returns
+// a read-only descriptor whose name is already gone. /tmp is noexec on DSM, so
+// dir is the package's own exec-capable temp. Unlike a sealed memfd, a process
+// running as the same package account could rewrite the file before it is
+// unlinked; that account already controls the CGI, so the trust is unchanged.
+func unlinkedBridge(dir string, payload []byte) (*os.File, error) {
+	if err := privateDir(dir); err != nil {
+		return nil, err
+	}
+	stage, err := os.MkdirTemp(dir, "bridge-")
+	if err != nil {
+		return nil, err
+	}
+	defer os.RemoveAll(stage)
+	path := filepath.Join(stage, "bridge")
+	writer, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	_, err = writer.Write(payload)
+	if closeErr := writer.Close(); err == nil {
+		err = closeErr
+	}
+	if err == nil {
+		err = os.Chmod(path, 0o500)
+	}
+	if err != nil {
+		return nil, err
+	}
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	if err = os.Remove(path); err != nil {
+		file.Close()
+		return nil, err
+	}
+	return file, nil
+}
+
+// privateDir accepts an absolute directory owned by this account and writable
+// by no one else. It follows links: DSM's /var/packages/<pkg>/tmp is one.
+func privateDir(dir string) error {
+	if !filepath.IsAbs(dir) {
+		return errBridgeDir
+	}
+	info, err := os.Stat(dir)
+	if err != nil {
+		return err
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !info.IsDir() || info.Mode().Perm()&0o022 != 0 || !ok || int(st.Uid) != os.Geteuid() {
+		return errBridgeDir
+	}
+	return nil
+}

package/templates/native-go/backend/internal/dsm/bridge_file_test.go

@@ -0,0 +1,57 @@
+package dsm
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestUnlinkedBridgeLeavesOnlyAReadOnlyDescriptor(t *testing.T) {
+	dir := t.TempDir()
+	file, err := unlinkedBridge(dir, []byte("bridge"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	got, err := io.ReadAll(file)
+	if err != nil || string(got) != "bridge" {
+		t.Fatalf("payload %q %v", got, err)
+	}
+	if _, err = file.Seek(0, io.SeekStart); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = file.Write([]byte("attack")); err == nil {
+		t.Fatal("bridge descriptor is writable")
+	}
+	info, err := file.Stat()
+	if err != nil || info.Mode().Perm() != 0o500 {
+		t.Fatalf("mode %v %v", info.Mode(), err)
+	}
+	if entries, err := os.ReadDir(dir); err != nil || len(entries) != 0 {
+		t.Fatalf("bridge left a name behind: %v %v", entries, err)
+	}
+}
+
+func TestUnlinkedBridgeRefusesWithoutAPrivateDirectory(t *testing.T) {
+	shared := t.TempDir()
+	if err := os.Chmod(shared, 0o777); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(t.TempDir(), "link")
+	if err := os.Symlink(t.TempDir(), link); err != nil {
+		t.Fatal(err)
+	}
+	for name, dir := range map[string]string{"unset": "", "relative": "tmp", "missing": filepath.Join(shared, "none"), "shared": shared} {
+		if file, err := unlinkedBridge(dir, []byte("bridge")); err == nil {
+			file.Close()
+			t.Fatalf("%s directory accepted", name)
+		}
+	}
+	// DSM's /var/packages/<pkg>/tmp is a root-owned link to @apptemp/<pkg>.
+	file, err := unlinkedBridge(link, []byte("bridge"))
+	if err != nil {
+		t.Fatalf("linked private directory refused: %v", err)
+	}
+	file.Close()
+}

package/templates/native-go/backend/internal/dsm/entry.go

@@ -0,0 +1,177 @@
+package dsm
+
+// The entry gate decides who may use the app at all, before any route policy.
+// It wraps the session authenticator, so every API method, transfer and the
+// window's own calls share one decision; apps never implement it themselves.
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+const (
+	// EntryAdminOnly admits only DSM administrators.
+	EntryAdminOnly = "admin-only"
+	// EntryAppPrivilege admits administrators and any account that DSM's
+	// Control Panel > Application Privileges allows for this app.
+	EntryAppPrivilege = "app-privilege"
+
+	// EntryCacheTTL bounds how long a privilege change can take to apply.
+	EntryCacheTTL = 30 * time.Second
+	// EntryCacheMaxEntries bounds the cache file whatever the traffic.
+	EntryCacheMaxEntries = 256
+
+	entryCacheFile = "entry-cache.json"
+)
+
+var packageName = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`)
+
+// EntryGate is an api.Authenticator that admits a verified caller only when
+// the app's entry mode allows it.
+type EntryGate struct {
+	next    api.Authenticator
+	mode    string
+	app     string
+	dir     string
+	now     func() time.Time
+	allowed func(ctx context.Context, principal, app, addr string) (bool, error)
+}
+
+// NewEntryGate wraps next for the build-time entry mode. An empty mode keeps
+// next unchanged: the route policy alone decides, as before entry modes.
+// dataDir holds the short-lived decision cache shared by CGI processes.
+func NewEntryGate(next api.Authenticator, mode, packageID, dataDir string) (api.Authenticator, error) {
+	if next == nil {
+		return nil, errors.New("entry gate needs an authenticator")
+	}
+	switch mode {
+	case "":
+		return next, nil
+	case EntryAdminOnly, EntryAppPrivilege:
+	default:
+		return nil, fmt.Errorf("unknown entry mode %q", mode)
+	}
+	if !packageName.MatchString(packageID) {
+		return nil, fmt.Errorf("invalid package ID %q", packageID)
+	}
+	return &EntryGate{next: next, mode: mode, app: "SYNO.SDS." + packageID + ".Instance", dir: filepath.Join(dataDir, "entry"), now: time.Now, allowed: AppPrivilege}, nil
+}
+
+func (g *EntryGate) Authenticate(r *http.Request) (api.Identity, error) {
+	id, err := g.next.Authenticate(r)
+	if err != nil || id.Admin {
+		return id, err
+	}
+	if g.mode == EntryAdminOnly {
+		return api.Identity{}, api.ErrAdminRequired
+	}
+	addr, err := clientAddress(r)
+	if err != nil {
+		return api.Identity{}, err
+	}
+	allowed, err := g.decide(r.Context(), id.User, addr)
+	if err != nil {
+		return api.Identity{}, err
+	}
+	if !allowed {
+		return api.Identity{}, api.ErrAppPrivilegeDenied
+	}
+	return id, nil
+}
+
+// clientAddress is the browser's address as DSM's web server reported it
+// (REMOTE_ADDR); DSM's IP rules are evaluated against it.
+func clientAddress(r *http.Request) (string, error) {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return "", errors.New("client address unavailable")
+	}
+	return ip.String(), nil
+}
+
+type cachedDecision struct {
+	Allowed bool  `json:"allowed"`
+	At      int64 `json:"at"`
+}
+
+func (g *EntryGate) decide(ctx context.Context, principal, addr string) (bool, error) {
+	sum := sha256.Sum256([]byte(principal + "\x00" + g.app + "\x00" + addr))
+	key := hex.EncodeToString(sum[:])
+	now := g.now().Unix()
+	entries, _ := g.readCache()
+	if d, ok := entries[key]; ok && d.At <= now && now-d.At < int64(EntryCacheTTL/time.Second) {
+		return d.Allowed, nil
+	}
+	allowed, err := g.allowed(ctx, principal, g.app, addr)
+	if err != nil {
+		return false, err
+	}
+	if entries == nil {
+		entries = map[string]cachedDecision{}
+	}
+	entries[key] = cachedDecision{Allowed: allowed, At: now}
+	g.writeCache(entries, now)
+	return allowed, nil
+}
+
+func (g *EntryGate) readCache() (map[string]cachedDecision, error) {
+	data, err := os.ReadFile(filepath.Join(g.dir, entryCacheFile))
+	if err != nil {
+		return nil, err
+	}
+	var entries map[string]cachedDecision
+	if err := json.Unmarshal(data, &entries); err != nil {
+		return nil, err
+	}
+	return entries, nil
+}
+
+// writeCache keeps only fresh entries, newest first, up to the bound. A failed
+// write only costs the next request a fresh lookup.
+func (g *EntryGate) writeCache(entries map[string]cachedDecision, now int64) {
+	keys := make([]string, 0, len(entries))
+	for k, d := range entries {
+		if d.At <= now && now-d.At < int64(EntryCacheTTL/time.Second) {
+			keys = append(keys, k)
+		}
+	}
+	sort.Slice(keys, func(i, j int) bool { return entries[keys[i]].At > entries[keys[j]].At })
+	if len(keys) > EntryCacheMaxEntries {
+		keys = keys[:EntryCacheMaxEntries]
+	}
+	kept := make(map[string]cachedDecision, len(keys))
+	for _, k := range keys {
+		kept[k] = entries[k]
+	}
+	data, err := json.Marshal(kept)
+	if err != nil || os.MkdirAll(g.dir, 0o700) != nil {
+		return
+	}
+	tmp, err := os.CreateTemp(g.dir, entryCacheFile+".*")
+	if err != nil {
+		return
+	}
+	defer os.Remove(tmp.Name())
+	if _, err := tmp.Write(data); err != nil || tmp.Close() != nil {
+		tmp.Close()
+		return
+	}
+	os.Rename(tmp.Name(), filepath.Join(g.dir, entryCacheFile))
+}