Merge fix/security-hardening into dev

fixes #254 (receiver queue byte-budget) #258 (inplace setuid/truncate) # Conflicts: # src/shared/multiprocessing.c
2026-09-05 13:12:31 +02:00
parent 11c591c5aa 2234879b2f
commit 68e7ed57d0
8 changed files with 364 additions and 11 deletions
@@ -5,6 +5,7 @@
 #include "utils.h"
 #include "protocol.h"
 #include "test_utils.h"
+#include <fcntl.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
@@ -730,6 +731,161 @@ static void test_file_send_single_calls_metadata_and_path() {
  }
 }

+static void test_inplace_overwrite_clears_special_mode_bits() {
+  const char* root = "test_inplace_tmp";
+  const char* path = "test_inplace_tmp/priv.txt";
+  const char* content = "olddata";
+  unlink(path);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0700), 0);
+
+  /* Create a destination carrying setuid + sticky bits. */
+  int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0644);
+  EXPECT_TRUE(fd >= 0);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (fd < 0) {
+    rmdir(root);
+    return;
+  }
+  EXPECT_EQ_INT((int)write(fd, content, strlen(content)), (int)strlen(content));
+  EXPECT_EQ_INT(fchmod(fd, S_ISUID | S_ISVTX | 0755), 0);
+  EXPECT_EQ_INT(close(fd), 0);
+
+  /* Overwrite in place without metadata: the mode must be normalized to a
+     safe default (0644) and the setuid/sticky bits must be gone. */
+  File* f = file_create("priv.txt");
+  EXPECT_NOT_NULL(f);
+  const char* new_content = "newdata";
+  f->data->data = malloc(strlen(new_content));
+  EXPECT_NOT_NULL(f->data->data);
+  memcpy(f->data->data, new_content, strlen(new_content));
+  f->data->size = strlen(new_content);
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->inplace = true;
+  EXPECT_TRUE(file_save_to_disk(root, f, cfg));
+  file_destroy(f);
+  config_delete(cfg);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT((int)(st.st_mode & (S_ISUID | S_ISGID | S_ISVTX)), 0);
+  EXPECT_EQ_INT((int)(st.st_mode & 0777), 0644);
+  FILE* stream = fopen(path, "rb");
+  char buf[16] = {0};
+  EXPECT_NOT_NULL(stream);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (stream) {
+    size_t nread = fread(buf, 1, sizeof(buf) - 1, stream);
+    fclose(stream);
+    EXPECT_EQ_INT((int)nread, (int)strlen(new_content));
+  }
+  EXPECT_EQ_STR(buf, new_content);
+
+  unlink(path);
+  rmdir(root);
+}
+
+static void test_inplace_overwrite_metadata_strips_special_bits() {
+  const char* root = "test_inplace_meta_tmp";
+  const char* path = "test_inplace_meta_tmp/meta.txt";
+  const char* source = "test_inplace_meta_source.txt";
+  unlink(path);
+  unlink(source);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0700), 0);
+
+  /* Existing destination with setuid+sticky set. */
+  int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0644);
+  EXPECT_TRUE(fd >= 0);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (fd < 0) {
+    rmdir(root);
+    return;
+  }
+  EXPECT_EQ_INT((int)write(fd, "olddata", 7), 7);
+  EXPECT_EQ_INT(fchmod(fd, S_ISUID | S_ISVTX | 0755), 0);
+  EXPECT_EQ_INT(close(fd), 0);
+
+  /* Build source metadata carrying a plain executable mode (no specials). */
+  EXPECT_TRUE(file_write_to_disk(source, "source", 6, false, false));
+  EXPECT_EQ_INT(chmod(source, 0755), 0);
+  struct stat source_st;
+  EXPECT_EQ_INT(stat(source, &source_st), 0);
+
+  File* f = file_create("meta.txt");
+  EXPECT_NOT_NULL(f);
+  const char* new_content = "meta";
+  f->data->data = malloc(strlen(new_content));
+  EXPECT_NOT_NULL(f->data->data);
+  memcpy(f->data->data, new_content, strlen(new_content));
+  f->data->size = strlen(new_content);
+  f->metadata = file_metadata_create(&source_st);
+  EXPECT_NOT_NULL(f->metadata);
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->inplace = true;
+  EXPECT_TRUE(file_save_to_disk(root, f, cfg));
+  file_destroy(f);
+  config_delete(cfg);
+  unlink(source);
+
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  /* Metadata-derived mode is applied and never includes setuid/setgid/sticky. */
+  EXPECT_EQ_INT((int)(st.st_mode & (S_ISUID | S_ISGID | S_ISVTX)), 0);
+  EXPECT_EQ_INT((int)(st.st_mode & 0777), 0755);
+
+  unlink(path);
+  rmdir(root);
+}
+
+static void test_inplace_overwrite_truncates_shorter_payload() {
+  const char* root = "test_inplace_trunc_tmp";
+  const char* path = "test_inplace_trunc_tmp/big.txt";
+  unlink(path);
+  rmdir(root);
+  EXPECT_EQ_INT(mkdir(root, 0700), 0);
+
+  const char* old_content = "0123456789abcdef"; /* 16 bytes */
+  EXPECT_TRUE(file_write_to_disk(path, old_content, strlen(old_content), false, false));
+
+  File* f = file_create("big.txt");
+  EXPECT_NOT_NULL(f);
+  const char* new_content = "hi";
+  f->data->data = malloc(strlen(new_content));
+  EXPECT_NOT_NULL(f->data->data);
+  memcpy(f->data->data, new_content, strlen(new_content));
+  f->data->size = strlen(new_content);
+
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->inplace = true;
+  EXPECT_TRUE(file_save_to_disk(root, f, cfg));
+  file_destroy(f);
+  config_delete(cfg);
+
+  /* A shorter payload must truncate the file: no stale trailing bytes. */
+  struct stat st;
+  EXPECT_EQ_INT(stat(path, &st), 0);
+  EXPECT_EQ_INT((int)st.st_size, (int)strlen(new_content));
+  FILE* stream = fopen(path, "rb");
+  char buf[32] = {0};
+  EXPECT_NOT_NULL(stream);
+  // cppcheck-suppress knownConditionTrueFalse
+  if (stream) {
+    size_t nread = fread(buf, 1, sizeof(buf) - 1, stream);
+    fclose(stream);
+    EXPECT_EQ_INT((int)nread, (int)strlen(new_content));
+  }
+  EXPECT_EQ_STR(buf, new_content);
+
+  unlink(path);
+  rmdir(root);
+}
+
 void test_file() {
  test_file_create();
  test_file_destroy_null();
@@ -762,4 +918,7 @@ void test_file() {
    test_file_send_single_calls_metadata_and_path();
  }
  test_file_metadata_create();
+  test_inplace_overwrite_clears_special_mode_bits();
+  test_inplace_overwrite_metadata_strips_special_bits();
+  test_inplace_overwrite_truncates_shorter_payload();
 }
@@ -250,6 +250,87 @@ static void test_write_thread_done() {
  config_delete(cfg);
 }

+typedef struct {
+  PipelineContextReceiver* context;
+  File* file;
+  atomic_bool* done;
+  atomic_bool* result;
+} ByteBudgetEnqueueArg;
+
+static int byte_budget_enqueue_worker(void* arg) {
+  ByteBudgetEnqueueArg* worker = arg;
+  bool ok = pipeline_context_receiver_enqueue_file(worker->context, worker->file);
+  atomic_store(worker->result, ok);
+  atomic_store(worker->done, true);
+  return thrd_success;
+}
+
+/* A receiver must not buffer more decompressed/copied payload bytes ahead of
+   the (slow) disk writer than the configured byte budget: an enqueue that
+   would exceed the budget blocks until the writer releases bytes. */
+static void test_receiver_enqueue_byte_budget() {
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  free(cfg->version);
+  cfg->version = str_dup(PROTOCOL_VERSION);
+  cfg->send_directory = str_dup("/src");
+  cfg->receive_root_directory = str_dup("/dst");
+  cfg->save_to_disk = false;
+
+  Queue* q = queue_create(16, file_destroy);
+  EXPECT_NOT_NULL(q);
+  PipelineContextReceiver* ctx = pipeline_context_receiver_create(cfg, q, -1, NULL);
+  EXPECT_NOT_NULL(ctx);
+  pipeline_context_receiver_set_queue_byte_limit(ctx, 3000);
+  ctx->receiver_done = false;
+
+  File* first = file_create("budget_file_1");
+  EXPECT_NOT_NULL(first);
+  first->data->size = 2000;
+  EXPECT_TRUE(pipeline_context_receiver_enqueue_file(ctx, first));
+  EXPECT_EQ_INT((int)ctx->queued_bytes, 2000);
+
+  /* Second 2000-byte payload would push the pipeline to 4000 > 3000 budget,
+     so the enqueue must block until the first payload is released. */
+  File* second = file_create("budget_file_2");
+  EXPECT_NOT_NULL(second);
+  second->data->size = 2000;
+  atomic_bool done;
+  atomic_bool result;
+  atomic_init(&done, false);
+  atomic_init(&result, false);
+  ByteBudgetEnqueueArg arg = {ctx, second, &done, &result};
+  thrd_t enqueuer;
+  EXPECT_EQ_INT(thrd_create(&enqueuer, byte_budget_enqueue_worker, &arg), thrd_success);
+
+  /* Give a broken (unbounded) implementation every chance to enqueue. */
+  struct timespec wait = {0, 200 * 1000000L};
+  thrd_sleep(&wait, NULL);
+  EXPECT_FALSE(atomic_load(&done));
+  EXPECT_EQ_INT((int)ctx->queued_bytes, 2000); /* budget still honored */
+
+  /* Simulate the disk writer: dequeue + destroy + release the first file. */
+  File* drained = queue_dequeue_multithreaded(q, &ctx->mutex, &ctx->condition_not_empty,
+                                              &ctx->condition_not_full, &ctx->receiver_done);
+  EXPECT_NOT_NULL(drained);
+  file_destroy(drained);
+  pipeline_context_receiver_note_bytes_released(ctx, 2000);
+  EXPECT_EQ_INT((int)ctx->queued_bytes, 0);
+
+  EXPECT_EQ_INT(thrd_join(enqueuer, NULL), thrd_success);
+  EXPECT_TRUE(atomic_load(&done));
+  EXPECT_TRUE(atomic_load(&result));
+  EXPECT_EQ_INT((int)ctx->queued_bytes, 2000); /* second payload now in flight */
+
+  /* Tear down: the second file is still queued and is freed by queue_destroy. */
+  mtx_destroy(&ctx->mutex);
+  cnd_destroy(&ctx->condition_not_full);
+  cnd_destroy(&ctx->condition_not_empty);
+  free(ctx);
+  queue_destroy(q);
+  config_delete(cfg);
+}
+
 void test_multiprocessing() {
  test_sender_create_destroy();
  test_receiver_create_destroy();
@@ -261,4 +342,5 @@ void test_multiprocessing() {
    test_receive_thread_failure_wakes_writer();
  }
  test_write_thread_done();
+  test_receiver_enqueue_byte_budget();
 }