From 42f01c0968d910bf1a4c0634beaf024a635e8202 Mon Sep 17 00:00:00 2001 From: TapTap Date: Sat, 12 Sep 2026 18:40:21 +0200 Subject: [PATCH] fix(a7-auth): persist dummy key in owner-only sidecar The store-wide dummy key was regenerated on every credentials_load, so an unknown user's dummy salt changed across daemon restarts while a real user's stored salt stayed stable -- a restart-gated username-enumeration oracle. Persist the 32-byte key in a 0600 .dummykey sidecar next to the credential store. An absent sidecar is created with O_EXCL and fsynced; a present sidecar is read only when it is an owner-only regular file of exactly 32 bytes (otherwise the load fails closed). If the sidecar cannot be created (read-only mount, missing directory) fall back to a transient per-run key with a warning. A NULL store path keeps the key ephemeral. --- README.md | 12 ++- RSYNC_COMPAT.md | 4 +- src/shared/credentials.c | 202 +++++++++++++++++++++++++++++++++++++-- src/shared/credentials.h | 9 ++ tests/test_credentials.c | 151 ++++++++++++++++++++++++++++- 5 files changed, 359 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index c6fec51..3919f51 100644 --- a/README.md +++ b/README.md @@ -522,11 +522,13 @@ deterministic per-username dummy challenge, so probing the daemon cannot enumerate users. Store lines are generated with `fastsync-server --hash-credentials ` (see `RSYNC_COMPAT.md`); redirect that output to an owner-only (mode 0600) file, and note that legacy -`user:SHA256HEX` stores are rejected. Two residuals are accepted: the dummy salt -is stable within one daemon lifetime but changes across restarts, so a -restart-gated enumeration channel remains (persisting a dummy key is out of -scope); and the store iteration count is observable pre-auth by design, since -the miss path must match a hit. +`user:SHA256HEX` stores are rejected. FastSync also maintains an owner-only +(mode 0600) `.dummykey` sidecar next to the store: it holds the store-wide +dummy key, is auto-created on first load, and must be preserved across daemon +restarts so the dummy challenge for an unknown user stays stable (the key is +never regenerated while the sidecar exists). One residual is accepted: the store +iteration count is observable pre-auth by design, since the miss path must match +a hit. TLS provides encrypted TCP transport. Supplying `--ca` enables certificate verification; without it, traffic is encrypted but peer identity is not diff --git a/RSYNC_COMPAT.md b/RSYNC_COMPAT.md index 6d74e25..1383666 100644 --- a/RSYNC_COMPAT.md +++ b/RSYNC_COMPAT.md @@ -639,8 +639,8 @@ now transmits targets (the prior behavior was broken/partial); its status moved - **Module selection & confinement:** the client requests a module with an rsync-style `host::module[/path]` destination. The module name crosses the wire as a trailing string on the config frame (bumping `PROTOCOL_VERSION` 2.14.0 → 2.15.0; the bump is required because the config-frame layout changed and the strict same-version handshake is what prevents a peer from desynchronizing on the new trailing field). The daemon looks the module up in ITS OWN config and uses the module's `path` as the authorized root through the exact same `configure_authorization` confinement the standalone server applies to `--destination-root` (`file_open_secure_parent`, `has_path_traversal`, `path_is_within`); the client never supplies the root, every client-chosen-ownership/super-user request is refused unless the module declares `client owner = yes` (the daemon's per-module opt-in, see below), and the operator `--no-super` veto forces super-user activities off for every daemon connection. The client's `/path` part is relative inside the module and is rejected if absolute or if it contains `..`. Unknown modules are refused before any data moves (the run fails cleanly at the config handshake). An absolute destination and a module request against a non-daemon server are also refused. - **`client owner` (client-chosen-ownership opt-in):** by default a daemon module refuses every request that would let the client pick an owner or ask for super-user activities — `--numeric-ids`, `--chown`, `--usermap`/`--groupmap`, `--fake-super`, `--copy-as`, and an explicit `--super` — at the config handshake (before `STATUS_OK`), because a daemon has no per-module opt-in for client-chosen ownership and any anonymous client could otherwise force arbitrary owner ids inside the module root. `client owner = yes` opts a single module in, allowing those requests within that module's root (the standalone listener and the SSH `--stdio` server always honor them for their single operator-authorized root). Without the opt-in the daemon also forces super-user **device** activity off for that connection — char/block device-node creation (`--devices`) and `--write-devices` — even under the default `AUTO` mode, so a non-opted module can never be made to `mknod` or write a raw device; those entries are skipped (not refused) so an ordinary `-a` push still succeeds without device nodes. The opt-in does **not** lift the privilege requirement: `--copy-as` still needs a root receiver, and the operator `--no-super` veto still forces super-user activities off for every connection. The daemon logs a prominent startup warning for each `client owner = yes` module so the operator's deliberate choice is visible. - **`read only` safe default:** every network transfer FastSync currently supports is a push that writes under the module root, so a `read only` module refuses the connection (clear server log "module is read only"; the client exits non-zero, nothing is transferred). A future pull/list operation can be opened up when it exists; the knob is already stored. -- **`auth users` (A7 SCRAM-SHA-256 authentication):** a module that declares `auth users` requires the client to present credentials. The config frame carries ONLY the username; the daemon answers an auth-required module with `STATUS_AUTH_CHALLENGE` (PBKDF2 iteration count, 16-byte salt, 32-byte server nonce), the client answers with `STATUS_AUTH_RESPONSE` (fresh 32-byte client nonce + a 32-byte ClientProof), and the daemon accepts only when the proof verifies **and** the username is **on the module's `auth users` list** and has a store entry, replying `STATUS_AUTH_OK` with a 32-byte ServerSignature the client verifies before proceeding. Verification is constant-time over fixed 32-byte keys (the compare runs even for a miss), username membership uses a constant-time full-length scan, and an unknown/off-list user still receives a challenge and runs the same math against a dummy verifier: a deterministic per-username salt (`HMAC-SHA256(store dummy key, username)`), the store-wide uniform iteration count and dummy keys. Re-probing the same unknown username therefore yields an identical salt and iteration count while a different username yields a different salt, so there is no user-enumeration or timing oracle. The daemon logs the username but **never the password, proof or keys**. A module WITHOUT `auth users` stays open (legitimate rsync configuration); credentials sent to such a module are ignored. Read-only is orthogonal: even a correctly authenticated push to a `read only` module is still refused (all FastSync network transfers write). Fail-closed policy: a daemon whose config declares `auth users` on any module refuses to start unless a credential store was given (`--password-file` and/or `--early-input`); a missing or empty store is never silently treated as "open". A failed handshake (missing credentials, unknown/off-list user, wrong proof or malformed data) yields a single generic `STATUS_AUTH_FAILED` and the daemon closes before any data moves. Two residuals are accepted: the dummy salt is stable within one daemon lifetime but changes across restarts, leaving a restart-gated enumeration channel (persisting the dummy key is out of scope); and the store iteration count is observable pre-auth by design, since the miss path must match a hit. -- **Credential store format:** server `--password-file`/`--early-input` files are line-based `user:$fastsync$1$pbkdf2-sha256$$$$`, one per line (standard base64; 16-byte salt, 32-byte keys; `iters` in `[100000, 10000000]`, default 600000). Every entry in the resulting store must agree on `iters` (a store whose entries disagree, or where a layered `--early-input` disagrees with `--password-file`, is rejected). Generate lines with `fastsync-server --hash-credentials FILE [--iterations N]`; the emitted lines are secret material, so redirect them to an owner-only (mode 0600) file (the tool warns on stderr if stdout is a group/other-accessible regular file). Blank lines and lines starting with `#`/`;` are comments; the parser is strict (a malformed line fails the whole load, so a typo can never let a different set of users in). **The legacy `user:SHA256HEX` form is hard-rejected** with an actionable "legacy" error; there is no auto-upgrade, so a replayable bearer digest can never be loaded by a 2.19.0 daemon. The client `--password-file` holds `user:password` on its first meaningful line (the literal password, used only for the handshake then burned); keep both files readable only by their owner (mode 0600). Per-username wire length is bounded (256 chars) and every decoded salt/key length is validated. +- **`auth users` (A7 SCRAM-SHA-256 authentication):** a module that declares `auth users` requires the client to present credentials. The config frame carries ONLY the username; the daemon answers an auth-required module with `STATUS_AUTH_CHALLENGE` (PBKDF2 iteration count, 16-byte salt, 32-byte server nonce), the client answers with `STATUS_AUTH_RESPONSE` (fresh 32-byte client nonce + a 32-byte ClientProof), and the daemon accepts only when the proof verifies **and** the username is **on the module's `auth users` list** and has a store entry, replying `STATUS_AUTH_OK` with a 32-byte ServerSignature the client verifies before proceeding. Verification is constant-time over fixed 32-byte keys (the compare runs even for a miss), username membership uses a constant-time full-length scan, and an unknown/off-list user still receives a challenge and runs the same math against a dummy verifier: a deterministic per-username salt (`HMAC-SHA256(store dummy key, username)`), the store-wide uniform iteration count and dummy keys. Re-probing the same unknown username therefore yields an identical salt and iteration count while a different username yields a different salt, so there is no user-enumeration or timing oracle. The daemon logs the username but **never the password, proof or keys**. A module WITHOUT `auth users` stays open (legitimate rsync configuration); credentials sent to such a module are ignored. Read-only is orthogonal: even a correctly authenticated push to a `read only` module is still refused (all FastSync network transfers write). Fail-closed policy: a daemon whose config declares `auth users` on any module refuses to start unless a credential store was given (`--password-file` and/or `--early-input`); a missing or empty store is never silently treated as "open". A failed handshake (missing credentials, unknown/off-list user, wrong proof or malformed data) yields a single generic `STATUS_AUTH_FAILED` and the daemon closes before any data moves. The dummy key is persisted in an owner-only `.dummykey` sidecar (auto-created on first load, mode 0600) so the dummy salt stays stable across daemon restarts, closing the restart-gated enumeration channel. One residual is accepted: the store iteration count is observable pre-auth by design, since the miss path must match a hit. +- **Credential store format:** server `--password-file`/`--early-input` files are line-based `user:$fastsync$1$pbkdf2-sha256$$$$`, one per line (standard base64; 16-byte salt, 32-byte keys; `iters` in `[100000, 10000000]`, default 600000). Every entry in the resulting store must agree on `iters` (a store whose entries disagree, or where a layered `--early-input` disagrees with `--password-file`, is rejected). Generate lines with `fastsync-server --hash-credentials FILE [--iterations N]`; the emitted lines are secret material, so redirect them to an owner-only (mode 0600) file (the tool warns on stderr if stdout is a group/other-accessible regular file). Blank lines and lines starting with `#`/`;` are comments; the parser is strict (a malformed line fails the whole load, so a typo can never let a different set of users in). **The legacy `user:SHA256HEX` form is hard-rejected** with an actionable "legacy" error; there is no auto-upgrade, so a replayable bearer digest can never be loaded by a 2.19.0 daemon. The client `--password-file` holds `user:password` on its first meaningful line (the literal password, used only for the handshake then burned); keep both files readable only by their owner (mode 0600). Per-username wire length is bounded (256 chars) and every decoded salt/key length is validated. Loading the store also maintains an owner-only `.dummykey` sidecar (auto-created, mode 0600, exactly 32 bytes) holding the store-wide dummy key that shapes unknown-user challenges; persist it across daemon restarts so those challenges stay stable, and treat a sidecar with the wrong owner, permissions, size or type as a fatal load error (fail closed). - **Plaintext caveat:** over a plaintext (non-TLS) daemon a sniffer can read the challenge and response and mount an **offline dictionary attack** against a weak password, so use `--tls` for any real deployment. Unlike the old challenge-less exchange there is **no replay**: the proof is bound to the fresh per-connection server nonce, so a captured `STATUS_AUTH_RESPONSE` cannot be reused on another connection (an integration test proxies the daemon and proves this). The daemon logs a warning when an auth-required module is reached over plaintext. TLS client-CN (`--client-cn`) is an independent transport identity check and composes with password auth: both may be required on the same connection. - **Wire/protocol:** the config-frame auth block is now `[int present][str_redacted username]` (the old digest field is gone), and the frame stream gains the challenge/response (`STATUS_AUTH_CHALLENGE` → `STATUS_AUTH_RESPONSE` → `STATUS_AUTH_OK`/`STATUS_AUTH_FAILED`) between the config frame and the `STATUS_OK` ack. Both are wire-layout changes, so `PROTOCOL_VERSION` is bumped **2.18.0 → 2.19.0** (see the A7 note in `src/shared/config.h`); the strict same-version handshake keeps a 2.19 client and a 2.18 server from desynchronizing. - **Client side:** `host::module/path` selects the TCP transport and connects to `--server-port`; `host:path` stays the SSH transport; plain paths stay local TCP. The daemon username comes from `--password-file` (first `user:password` line), and `--password-file` without a `host::module/path` destination is a client error (fail fast). A `user@host::module` form is rejected with a pointer to `--password-file`. The client's plaintext password is wiped from memory (`config_burn_auth`) at transfer teardown. diff --git a/src/shared/credentials.c b/src/shared/credentials.c index 5971a26..36dd004 100644 --- a/src/shared/credentials.c +++ b/src/shared/credentials.c @@ -1,4 +1,5 @@ #include "credentials.h" +#include "log.h" #include "utils.h" #include #include @@ -35,16 +36,22 @@ struct CredentialStore { * challenged with the same count as a hit and the count itself never leaks * membership. Unused (0) for an empty store. */ uint32_t iters; - /* Random secret generated once at load. The dummy salt handed out for an - * unknown/off-list user is HMAC-SHA256(dummy_key, username)[:SALT_LEN], so - * repeated probes of the same username always see an identical challenge - * while different usernames differ -- with no fresh-random tell. */ + /* Store-wide secret loaded from (or created in) the owner-only + * `.dummykey` sidecar, so it also survives a daemon restart. The + * dummy salt handed out for an unknown/off-list user is + * HMAC-SHA256(dummy_key, username)[:SALT_LEN], so repeated probes of the same + * username always see an identical challenge while different usernames differ + * -- with no fresh-random tell, and cross-restart stability hides the + * restart-gated enumeration oracle. */ uint8_t dummy_key[CREDENTIAL_KEY_LEN]; }; /* Exact marker prefix of the new store verifier field. */ #define CREDENTIAL_STORE_PREFIX "$fastsync$1$pbkdf2-sha256$" #define CREDENTIAL_AUTH_PREFIX "FastSync-Auth-v1" +/* Owner-only sidecar holding the persistent store-wide dummy key, placed next to + * the credential store (`.dummykey`). */ +#define CREDENTIAL_DUMMY_KEY_SUFFIX ".dummykey" /* Fixed dummy keys used when a user is unknown or off the module's list. They * can never authenticate because acceptance additionally requires found=true. */ @@ -583,6 +590,178 @@ static CredentialStore* load_store_file(const char* path, char* err, size_t err_ return store; } +/* Validate and read an already-open `.dummykey` sidecar. Fails closed on + * anything that is not an owner-only (0600) regular file of exactly + * CREDENTIAL_KEY_LEN bytes, so a loosened, swapped or truncated file can never + * silently change the dummy challenge. */ +static bool read_dummy_key_fd(int fd, const char* path, uint8_t out[CREDENTIAL_KEY_LEN], char* err, + size_t err_size) { + struct stat st; + if (fstat(fd, &st) != 0) { + set_error(err, err_size, "cannot stat dummy key file '%s': %s", path, strerror(errno)); + return false; + } + if (!S_ISREG(st.st_mode) || st.st_uid != geteuid() || (st.st_mode & (S_IRWXG | S_IRWXO)) != 0 || + st.st_size != (off_t)CREDENTIAL_KEY_LEN) { + set_error(err, err_size, + "refusing to read dummy key file '%s': it must be an owner-only (0600) regular file " + "of exactly %d bytes", + path, CREDENTIAL_KEY_LEN); + return false; + } + size_t got = 0; + while (got < CREDENTIAL_KEY_LEN) { + ssize_t n = read(fd, out + got, CREDENTIAL_KEY_LEN - got); + if (n < 0) { + if (errno == EINTR) + continue; + set_error(err, err_size, "cannot read dummy key file '%s': %s", path, strerror(errno)); + return false; + } + if (n == 0) + break; + got += (size_t)n; + } + if (got != CREDENTIAL_KEY_LEN) { + set_error(err, err_size, "dummy key file '%s' is truncated", path); + return false; + } + return true; +} + +/* Load the persistent dummy key for `store_path` from its `.dummykey` + * sidecar, creating it (mode 0600, 32 random bytes) if absent. A NULL + * store_path (empty store) yields a fresh ephemeral key. Reading an existing + * sidecar fails CLOSED on any validation error; only the CREATE path degrades + * to an ephemeral key (with a warning) when the filesystem cannot hold the + * sidecar (e.g. read-only mount), so a daemon still starts. Returns false only + * when the CSPRNG itself fails (or a present-but-invalid sidecar is found). */ +static bool load_or_create_dummy_key(const char* store_path, uint8_t out[CREDENTIAL_KEY_LEN], + char* err, size_t err_size) { + if (!store_path) { + if (!credentials_random_bytes(out, CREDENTIAL_KEY_LEN)) { + set_error(err, err_size, "failed to generate the credential store dummy key"); + return false; + } + return true; + } + + size_t path_len = strlen(store_path); + size_t suffix_len = sizeof(CREDENTIAL_DUMMY_KEY_SUFFIX); /* includes the NUL */ + if (path_len > SIZE_MAX - suffix_len) { + set_error(err, err_size, "credential store path is too long to build a dummy key path"); + return false; + } + char* sidecar = malloc(path_len + suffix_len); + if (!sidecar) { + set_error(err, err_size, "out of memory building the dummy key path"); + return false; + } + int n = snprintf(sidecar, path_len + suffix_len, "%s%s", store_path, CREDENTIAL_DUMMY_KEY_SUFFIX); + if (n < 0 || (size_t)n >= path_len + suffix_len) { + set_error(err, err_size, "credential store path is too long to build a dummy key path"); + free(sidecar); + return false; + } + + int fd = open(sidecar, O_RDONLY | O_CLOEXEC); + if (fd >= 0) { + bool ok = read_dummy_key_fd(fd, sidecar, out, err, err_size); + close(fd); + free(sidecar); + return ok; + } + if (errno != ENOENT) { + /* The sidecar exists but cannot be opened for reading (e.g. EACCES): fail + * closed rather than substituting a different key. */ + set_error(err, err_size, "cannot open dummy key file '%s': %s", sidecar, strerror(errno)); + free(sidecar); + return false; + } + + uint8_t fresh[CREDENTIAL_KEY_LEN]; + if (!credentials_random_bytes(fresh, CREDENTIAL_KEY_LEN)) { + set_error(err, err_size, "failed to generate the credential store dummy key"); + free(sidecar); + return false; + } + fd = open(sidecar, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC, 0600); + if (fd < 0) { + int open_errno = errno; + if (open_errno == EEXIST) { + /* A racing instance created the sidecar first; adopt its key. */ + int rfd = open(sidecar, O_RDONLY | O_CLOEXEC); + if (rfd < 0) { + set_error(err, err_size, "cannot open dummy key file '%s': %s", sidecar, strerror(errno)); + free(sidecar); + credentials_burn((char*)fresh, sizeof(fresh)); + return false; + } + bool ok = read_dummy_key_fd(rfd, sidecar, out, err, err_size); + close(rfd); + free(sidecar); + credentials_burn((char*)fresh, sizeof(fresh)); + return ok; + } + /* Creation failed for another reason (read-only filesystem, missing + * directory, ...). Warn and fall back to an ephemeral key: unknown-user + * challenges stay deterministic within this daemon lifetime but will change + * on the next restart. */ + char* escaped = output_escape(sidecar, log_get_8_bit_output()); + log_message(LOG_LEVEL_WARNING, + "cannot create dummy key file %s: %s; using a transient dummy key so unknown-user " + "challenges will change across restarts", + escaped ? escaped : sidecar, strerror(open_errno)); + free(escaped); + memcpy(out, fresh, CREDENTIAL_KEY_LEN); + free(sidecar); + credentials_burn((char*)fresh, sizeof(fresh)); + return true; + } + + size_t written = 0; + bool write_ok = true; + while (written < CREDENTIAL_KEY_LEN) { + ssize_t w = write(fd, fresh + written, CREDENTIAL_KEY_LEN - written); + if (w < 0) { + if (errno == EINTR) + continue; + write_ok = false; + break; + } + if (w == 0) { + write_ok = false; + break; + } + written += (size_t)w; + } + int write_errno = errno; + if (write_ok && fsync(fd) != 0) { + write_ok = false; + write_errno = errno; + } + close(fd); + if (!write_ok) { + /* Do not leave a truncated sidecar behind that would fail-closed a later + * restart; fall back to an ephemeral key instead. */ + unlink(sidecar); + char* escaped = output_escape(sidecar, log_get_8_bit_output()); + log_message(LOG_LEVEL_WARNING, + "cannot write dummy key file %s: %s; using a transient dummy key so unknown-user " + "challenges will change across restarts", + escaped ? escaped : sidecar, strerror(write_errno)); + free(escaped); + memcpy(out, fresh, CREDENTIAL_KEY_LEN); + free(sidecar); + credentials_burn((char*)fresh, sizeof(fresh)); + return true; + } + memcpy(out, fresh, CREDENTIAL_KEY_LEN); + free(sidecar); + credentials_burn((char*)fresh, sizeof(fresh)); + return true; +} + CredentialStore* credentials_load(const char* password_file, const char* early_input_file, char* err, size_t err_size) { if (err && err_size) @@ -590,12 +769,15 @@ CredentialStore* credentials_load(const char* password_file, const char* early_i CredentialStore* store = load_store_file(password_file, err, err_size); if (!store) return NULL; - /* Generate the store-wide dummy key once for the final (possibly merged) - * store. It makes an unknown-user challenge deterministic, so fail the load - * if the CSPRNG is unavailable rather than degrading the anti-enumeration - * property. */ - if (!credentials_random_bytes(store->dummy_key, sizeof(store->dummy_key))) { - set_error(err, err_size, "failed to generate the credential store dummy key"); + /* Load (or create) the store-wide dummy key once for the final (possibly + * merged) store. It makes an unknown-user challenge deterministic AND + * stable across daemon restarts, so a restart cannot be used as a + * username-enumeration oracle. It is persisted in an owner-only sidecar next + * to the credential store; a NULL store path (empty store) keeps it + * ephemeral. Fail the load if the CSPRNG is unavailable rather than + * degrading the anti-enumeration property. */ + const char* store_path = password_file ? password_file : early_input_file; + if (!load_or_create_dummy_key(store_path, store->dummy_key, err, err_size)) { credentials_free(store); return NULL; } diff --git a/src/shared/credentials.h b/src/shared/credentials.h index 9742ea9..d6314b2 100644 --- a/src/shared/credentials.h +++ b/src/shared/credentials.h @@ -26,6 +26,15 @@ * hard-rejected with an actionable "legacy" error; there is no auto-upgrade. * Use `fastsync-server --hash-credentials` to generate new-format lines. * + * Alongside the store, credentials_load maintains an owner-only (0600) + * `.dummykey` sidecar holding the store-wide random dummy key. It + * is auto-created on first load and MUST be preserved across restarts: it makes + * the dummy challenge for an unknown user stable for the life of the store, so + * a daemon restart cannot be used as a username-enumeration oracle. A sidecar + * that is not an owner-only regular file of exactly 32 bytes fails the load + * (fail closed); if it cannot be created (e.g. a read-only mount) the daemon + * warns and uses a transient per-run key instead. + * * Client --password-file format: the FIRST meaningful (non-comment, non-blank) * line is `user:password`, holding the literal password. The client keeps it * only for the duration of the handshake and wipes it at teardown; the file diff --git a/tests/test_credentials.c b/tests/test_credentials.c index 425a715..658cc9c 100644 --- a/tests/test_credentials.c +++ b/tests/test_credentials.c @@ -70,8 +70,28 @@ static char* make_tmp_file(const char* contents) { } static void rm_temp(const char* path) { - if (path) - unlink(path); + if (!path) + return; + unlink(path); + /* Every successfully loaded store auto-creates an owner-only + * `.dummykey` sidecar; remove it too so tests leave no stray key. */ + size_t n = strlen(path) + strlen(".dummykey") + 1; + char* sidecar = malloc(n); + if (sidecar) { + snprintf(sidecar, n, "%s.dummykey", path); + unlink(sidecar); + free(sidecar); + } +} + +/* `.dummykey` sidecar path (caller frees). */ +static char* dummy_sidecar_path(const char* store_path) { + size_t n = strlen(store_path) + strlen(".dummykey") + 1; + char* out = malloc(n); + if (!out) + return NULL; + snprintf(out, n, "%s.dummykey", store_path); + return out; } /* Build a valid new-format line for user/password at iters. */ @@ -745,6 +765,130 @@ static void test_credentials_rejects_group_or_other_accessible() { free(path); } +/* Loading a store auto-creates an owner-only `.dummykey` sidecar whose + * key is stable across reloads, so an unknown-user dummy salt is identical + * across two loads (the anti-restart enumeration property). */ +static void test_credentials_dummy_key_persisted() { + char line[CREDENTIAL_MAX_LINE]; + EXPECT_TRUE(make_store_line("alice", KAT_PASSWORD, CREDENTIAL_MIN_ITERS, line, sizeof(line))); + char contents[CREDENTIAL_MAX_LINE + 2]; + snprintf(contents, sizeof(contents), "%s\n", line); + char* path = make_tmp_file(contents); + EXPECT_NOT_NULL(path); + char* sidecar = dummy_sidecar_path(path); + EXPECT_NOT_NULL(sidecar); + + char err[512]; + CredentialStore* store = credentials_load(path, NULL, err, sizeof(err)); + EXPECT_NOT_NULL(store); + + struct stat st; + EXPECT_EQ_INT(stat(sidecar, &st), 0); + EXPECT_TRUE(S_ISREG(st.st_mode)); + EXPECT_TRUE((st.st_mode & (S_IRWXG | S_IRWXO)) == 0); + EXPECT_EQ_INT((int)(st.st_mode & 07777), 0600); + EXPECT_EQ_INT((int)st.st_size, CREDENTIAL_KEY_LEN); + + CredentialVerifier v1; + EXPECT_TRUE(credentials_get_verifier(store, "unknown-user", NULL, 0, &v1)); + EXPECT_FALSE(v1.found); + credentials_free(store); + + store = credentials_load(path, NULL, err, sizeof(err)); + EXPECT_NOT_NULL(store); + CredentialVerifier v2; + EXPECT_TRUE(credentials_get_verifier(store, "unknown-user", NULL, 0, &v2)); + EXPECT_FALSE(v2.found); + EXPECT_TRUE(memcmp(v1.salt, v2.salt, sizeof(v1.salt)) == 0); + credentials_free(store); + + rm_temp(path); + free(path); + free(sidecar); +} + +/* A sidecar that is group/other accessible, the wrong size, or not a regular + * file must fail the load closed. */ +static void test_credentials_dummy_key_rejects_bad_sidecar() { + char err[512]; + char line[CREDENTIAL_MAX_LINE]; + EXPECT_TRUE(make_store_line("alice", KAT_PASSWORD, CREDENTIAL_MIN_ITERS, line, sizeof(line))); + char contents[CREDENTIAL_MAX_LINE + 2]; + snprintf(contents, sizeof(contents), "%s\n", line); + + /* Group/other permission bits on the sidecar. */ + char* path = make_tmp_file(contents); + EXPECT_NOT_NULL(path); + char* sidecar = dummy_sidecar_path(path); + EXPECT_NOT_NULL(sidecar); + uint8_t key[CREDENTIAL_KEY_LEN]; + memset(key, 0x5a, sizeof(key)); + FILE* fp = fopen(sidecar, "wb"); + EXPECT_NOT_NULL(fp); + EXPECT_TRUE(fwrite(key, 1, sizeof(key), fp) == sizeof(key)); + fclose(fp); + EXPECT_EQ_INT(chmod(sidecar, 0640), 0); + EXPECT_NULL(credentials_load(path, NULL, err, sizeof(err))); + EXPECT_TRUE(err[0] != '\0'); + rm_temp(path); + free(path); + free(sidecar); + + /* Wrong size (not exactly 32 bytes). */ + path = make_tmp_file(contents); + EXPECT_NOT_NULL(path); + sidecar = dummy_sidecar_path(path); + EXPECT_NOT_NULL(sidecar); + fp = fopen(sidecar, "wb"); + EXPECT_NOT_NULL(fp); + EXPECT_TRUE(fwrite(key, 1, CREDENTIAL_SALT_LEN, fp) == CREDENTIAL_SALT_LEN); + fclose(fp); + EXPECT_EQ_INT(chmod(sidecar, 0600), 0); + EXPECT_NULL(credentials_load(path, NULL, err, sizeof(err))); + EXPECT_TRUE(err[0] != '\0'); + rm_temp(path); + free(path); + free(sidecar); + + /* Non-regular file (a directory at the sidecar path). */ + path = make_tmp_file(contents); + EXPECT_NOT_NULL(path); + sidecar = dummy_sidecar_path(path); + EXPECT_NOT_NULL(sidecar); + EXPECT_EQ_INT(mkdir(sidecar, 0700), 0); + EXPECT_NULL(credentials_load(path, NULL, err, sizeof(err))); + EXPECT_TRUE(err[0] != '\0'); + rmdir(sidecar); + rm_temp(path); + free(path); + free(sidecar); +} + +/* A NULL store path has nowhere to persist a key, so each load gets a fresh + * ephemeral key (and creates no sidecar). */ +static void test_credentials_dummy_key_null_store_ephemeral() { + char err[512]; + CredentialStore* store = credentials_load(NULL, NULL, err, sizeof(err)); + EXPECT_NOT_NULL(store); + CredentialVerifier v1; + CredentialVerifier v1b; + EXPECT_TRUE(credentials_get_verifier(store, "nobody", NULL, 0, &v1)); + EXPECT_FALSE(v1.found); + /* Within one store the dummy challenge is still deterministic. */ + EXPECT_TRUE(credentials_get_verifier(store, "nobody", NULL, 0, &v1b)); + EXPECT_TRUE(memcmp(v1.salt, v1b.salt, sizeof(v1.salt)) == 0); + credentials_free(store); + + store = credentials_load(NULL, NULL, err, sizeof(err)); + EXPECT_NOT_NULL(store); + CredentialVerifier v2; + EXPECT_TRUE(credentials_get_verifier(store, "nobody", NULL, 0, &v2)); + /* No persistence path, so the second load's random key differs (and with it + * the dummy salt). */ + EXPECT_TRUE(memcmp(v1.salt, v2.salt, sizeof(v1.salt)) != 0); + credentials_free(store); +} + static void test_credentials_burn() { char secret[32]; memcpy(secret, "supersecretvalue", 17); @@ -777,5 +921,8 @@ void test_credentials(void) { test_credentials_read_secret_file_bad(); test_credentials_hash_file(); test_credentials_rejects_group_or_other_accessible(); + test_credentials_dummy_key_persisted(); + test_credentials_dummy_key_rejects_bad_sidecar(); + test_credentials_dummy_key_null_store_ephemeral(); test_credentials_burn(); }