merge: integrate proxyctl ticket 07
# Conflicts: # cmd/proxyctl/main.go # internal/securefs/securefs.go
This commit is contained in:
proxyctl coordinator
+38
-5
@@ -4,6 +4,7 @@ import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"proxyctl/internal/profile"
|
||||
"proxyctl/internal/target"
|
||||
@@ -56,10 +57,12 @@ type Module interface {
|
||||
}
|
||||
|
||||
type Application struct {
|
||||
store profile.Store
|
||||
state profile.State
|
||||
targets []target.Target
|
||||
inspections map[string]target.Inspection
|
||||
store profile.Store
|
||||
state profile.State
|
||||
targets []target.Target
|
||||
inspections map[string]target.Inspection
|
||||
mutationLock MutationLock
|
||||
logger OperationLogger
|
||||
}
|
||||
|
||||
func New(store profile.Store) (*Application, error) {
|
||||
@@ -67,11 +70,23 @@ func New(store profile.Store) (*Application, error) {
|
||||
}
|
||||
|
||||
func NewWithTargets(store profile.Store, targets []target.Target) (*Application, error) {
|
||||
return NewWithTargetsAndLock(store, targets, nil)
|
||||
}
|
||||
|
||||
// NewWithTargetsAndLock configures the cross-process lock used by every
|
||||
// Profile or Target mutation. A nil lock is intended only for isolated tests.
|
||||
func NewWithTargetsAndLock(store profile.Store, targets []target.Target, mutationLock MutationLock) (*Application, error) {
|
||||
return NewWithTargetsAndRuntime(store, targets, mutationLock, nil)
|
||||
}
|
||||
|
||||
// NewWithTargetsAndRuntime configures shared mutation serialization and local
|
||||
// operation diagnostics for production callers.
|
||||
func NewWithTargetsAndRuntime(store profile.Store, targets []target.Target, mutationLock MutationLock, logger OperationLogger) (*Application, error) {
|
||||
state, err := store.Load()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
a := &Application{store: store, state: state, targets: append([]target.Target(nil), targets...), inspections: make(map[string]target.Inspection)}
|
||||
a := &Application{store: store, state: state, targets: append([]target.Target(nil), targets...), inspections: make(map[string]target.Inspection), mutationLock: mutationLock, logger: logger}
|
||||
a.refreshTargets()
|
||||
return a, nil
|
||||
}
|
||||
@@ -88,6 +103,13 @@ func (a *Application) Snapshot() Snapshot {
|
||||
}
|
||||
|
||||
func (a *Application) Dispatch(intent Intent) Result {
|
||||
if a.mutationLock != nil {
|
||||
unlock, err := a.mutationLock.Lock(context.Background())
|
||||
if err != nil {
|
||||
return Result{Snapshot: a.Snapshot(), Err: fmt.Errorf("lock proxyctl mutation: %w", err)}
|
||||
}
|
||||
defer unlock()
|
||||
}
|
||||
if intent.Kind == SetTargetDesired {
|
||||
return a.setTargetDesired(intent)
|
||||
}
|
||||
@@ -165,6 +187,17 @@ func (a *Application) setTargetDesired(intent Intent) Result {
|
||||
}
|
||||
result := selected.SetDesired(context.Background(), intent.Enabled, active)
|
||||
a.inspections[selected.ID()] = result.Inspection
|
||||
outcome, detail := "success", result.Inspection.Evidence
|
||||
if result.Err != nil {
|
||||
outcome, detail = "failure", result.Err.Error()
|
||||
}
|
||||
if a.logger != nil {
|
||||
operation := "disable"
|
||||
if intent.Enabled {
|
||||
operation = "enable"
|
||||
}
|
||||
_ = a.logger.Write(LogEntry{Time: time.Now(), Operation: operation, Target: selected.ID(), Result: outcome, Detail: RedactLogDetail(detail)})
|
||||
}
|
||||
notice := ""
|
||||
if result.Err == nil {
|
||||
notice = fmt.Sprintf("%s Target is now %s", selected.Description().Name, result.Inspection.State)
|
||||
|
||||
@@ -0,0 +1,166 @@
|
||||
package app
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"proxyctl/internal/profile"
|
||||
"proxyctl/internal/target"
|
||||
)
|
||||
|
||||
// MutationLock serializes all state-changing operations across processes.
|
||||
type MutationLock interface {
|
||||
Lock(context.Context) (unlock func(), err error)
|
||||
}
|
||||
|
||||
// LogEntry is the privacy-safe operation record written to bounded local logs.
|
||||
type LogEntry struct {
|
||||
Time time.Time
|
||||
Operation string
|
||||
Target string
|
||||
Result string
|
||||
Detail string
|
||||
}
|
||||
|
||||
type OperationLogger interface{ Write(LogEntry) error }
|
||||
|
||||
type Maintenance struct {
|
||||
state profile.State
|
||||
targets []target.Target
|
||||
lock MutationLock
|
||||
logger OperationLogger
|
||||
}
|
||||
|
||||
func NewMaintenance(state profile.State, targets []target.Target, lock MutationLock, logger OperationLogger) *Maintenance {
|
||||
return &Maintenance{state: state, targets: append([]target.Target(nil), targets...), lock: lock, logger: logger}
|
||||
}
|
||||
|
||||
type Diagnostic struct {
|
||||
TargetID string
|
||||
Check target.Check
|
||||
}
|
||||
|
||||
type DoctorReport struct{ Diagnostics []Diagnostic }
|
||||
|
||||
func (r DoctorReport) Healthy() bool {
|
||||
for _, diagnostic := range r.Diagnostics {
|
||||
if !diagnostic.Check.OK {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
func (r DoctorReport) String() string {
|
||||
var output strings.Builder
|
||||
for _, diagnostic := range r.Diagnostics {
|
||||
status := "OK"
|
||||
if !diagnostic.Check.OK {
|
||||
status = "FAIL"
|
||||
}
|
||||
name := diagnostic.Check.Name
|
||||
if diagnostic.TargetID != "" {
|
||||
name = diagnostic.TargetID + ": " + name
|
||||
}
|
||||
fmt.Fprintf(&output, "[%s] %s — %s\n", status, name, profile.RedactText(diagnostic.Check.Evidence))
|
||||
}
|
||||
return output.String()
|
||||
}
|
||||
|
||||
// Doctor only invokes observational Target methods.
|
||||
func (m *Maintenance) Doctor(ctx context.Context, applicationChecks []target.Check) DoctorReport {
|
||||
report := DoctorReport{}
|
||||
for _, check := range applicationChecks {
|
||||
check.Evidence = profile.RedactText(check.Evidence)
|
||||
report.Diagnostics = append(report.Diagnostics, Diagnostic{Check: check})
|
||||
}
|
||||
active := activeFromState(m.state)
|
||||
for _, adapter := range m.targets {
|
||||
availability := adapter.Availability(ctx)
|
||||
report.Diagnostics = append(report.Diagnostics, Diagnostic{TargetID: adapter.ID(), Check: target.Check{Name: "Target availability", OK: availability.Available, Evidence: availability.Evidence}})
|
||||
inspection := adapter.Inspect(ctx, active)
|
||||
report.Diagnostics = append(report.Diagnostics, Diagnostic{TargetID: adapter.ID(), Check: target.Check{Name: "detected state", OK: inspection.State != target.Drifted, Evidence: string(inspection.State) + ": " + inspection.Evidence}})
|
||||
if diagnosable, ok := adapter.(target.Diagnosable); ok {
|
||||
for _, check := range diagnosable.DiagnosticChecks(ctx, active) {
|
||||
check.Evidence = profile.RedactText(check.Evidence)
|
||||
report.Diagnostics = append(report.Diagnostics, Diagnostic{TargetID: adapter.ID(), Check: check})
|
||||
}
|
||||
}
|
||||
}
|
||||
return report
|
||||
}
|
||||
|
||||
type ResetTargetResult struct {
|
||||
TargetID string
|
||||
Inspection target.Inspection
|
||||
Skipped bool
|
||||
Err error
|
||||
}
|
||||
type ResetResult struct {
|
||||
Cancelled bool
|
||||
Targets []ResetTargetResult
|
||||
Err error
|
||||
}
|
||||
|
||||
func (m *Maintenance) Reset(ctx context.Context, confirmed bool) ResetResult {
|
||||
if !confirmed {
|
||||
return ResetResult{Cancelled: true}
|
||||
}
|
||||
if m.lock == nil {
|
||||
return ResetResult{Err: errors.New("mutation lock is not configured")}
|
||||
}
|
||||
unlock, err := m.lock.Lock(ctx)
|
||||
if err != nil {
|
||||
return ResetResult{Err: fmt.Errorf("lock proxyctl mutation: %w", err)}
|
||||
}
|
||||
defer unlock()
|
||||
active := activeFromState(m.state)
|
||||
result := ResetResult{}
|
||||
for _, adapter := range m.targets {
|
||||
inspection := adapter.Inspect(ctx, active)
|
||||
if inspection.State != target.Enabled && inspection.State != target.Drifted {
|
||||
result.Targets = append(result.Targets, ResetTargetResult{TargetID: adapter.ID(), Inspection: inspection, Skipped: true})
|
||||
continue
|
||||
}
|
||||
operation := adapter.SetDesired(ctx, false, active)
|
||||
detail, outcome := operation.Inspection.Evidence, "success"
|
||||
if operation.Err != nil {
|
||||
outcome = "failure"
|
||||
detail = operation.Err.Error()
|
||||
result.Err = errors.Join(result.Err, fmt.Errorf("reset %s Target: %w", adapter.ID(), redactError(operation.Err)))
|
||||
}
|
||||
detail = RedactLogDetail(detail)
|
||||
if m.logger != nil {
|
||||
_ = m.logger.Write(LogEntry{Time: time.Now(), Operation: "reset", Target: adapter.ID(), Result: outcome, Detail: detail})
|
||||
}
|
||||
result.Targets = append(result.Targets, ResetTargetResult{TargetID: adapter.ID(), Inspection: operation.Inspection, Err: redactError(operation.Err)})
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func activeFromState(state profile.State) *profile.Profile {
|
||||
for i := range state.Profiles {
|
||||
if state.Profiles[i].Name == state.ActiveProfile {
|
||||
value := state.Profiles[i]
|
||||
return &value
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
var authenticatedURL = regexp.MustCompile(`(?i)(?:https?|socks5h?)://[^\s'\"<>]*@[^\s'\"<>]+`)
|
||||
|
||||
// RedactLogDetail omits complete authenticated URLs, not just their passwords.
|
||||
func RedactLogDetail(value string) string {
|
||||
value = authenticatedURL.ReplaceAllString(value, "[REDACTED AUTHENTICATED URL]")
|
||||
return profile.RedactText(value)
|
||||
}
|
||||
func redactError(err error) error {
|
||||
if err == nil {
|
||||
return nil
|
||||
}
|
||||
return errors.New(profile.RedactText(err.Error()))
|
||||
}
|
||||
@@ -0,0 +1,141 @@
|
||||
package app_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"proxyctl/internal/app"
|
||||
"proxyctl/internal/profile"
|
||||
"proxyctl/internal/target"
|
||||
)
|
||||
|
||||
type maintenanceTarget struct {
|
||||
id string
|
||||
available target.Availability
|
||||
inspection target.Inspection
|
||||
checks []target.Check
|
||||
disableErr error
|
||||
disableCalls int
|
||||
}
|
||||
|
||||
func (f *maintenanceTarget) ID() string { return f.id }
|
||||
func (f *maintenanceTarget) Description() target.Description {
|
||||
return target.Description{Name: strings.ToUpper(f.id)}
|
||||
}
|
||||
func (f *maintenanceTarget) Availability(context.Context) target.Availability { return f.available }
|
||||
func (f *maintenanceTarget) Confirmation(bool) string { return "" }
|
||||
func (f *maintenanceTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
|
||||
return f.inspection
|
||||
}
|
||||
func (f *maintenanceTarget) SetDesired(_ context.Context, enabled bool, _ *profile.Profile) target.OperationResult {
|
||||
if !enabled {
|
||||
f.disableCalls++
|
||||
if f.disableErr == nil {
|
||||
f.inspection = target.Inspection{State: target.Disabled, Evidence: "managed state removed"}
|
||||
}
|
||||
}
|
||||
return target.OperationResult{Inspection: f.inspection, Err: f.disableErr}
|
||||
}
|
||||
func (f *maintenanceTarget) DiagnosticChecks(context.Context, *profile.Profile) []target.Check {
|
||||
return append([]target.Check(nil), f.checks...)
|
||||
}
|
||||
|
||||
type recordingLock struct{ held, acquired int }
|
||||
|
||||
func (l *recordingLock) Lock(context.Context) (func(), error) {
|
||||
l.held++
|
||||
l.acquired++
|
||||
return func() { l.held-- }, nil
|
||||
}
|
||||
|
||||
type recordingLog struct{ entries []app.LogEntry }
|
||||
|
||||
func (l *recordingLog) Write(entry app.LogEntry) error {
|
||||
l.entries = append(l.entries, entry)
|
||||
return nil
|
||||
}
|
||||
|
||||
func TestDoctorReportsReadOnlyChecksEvidenceAndRedactsCredentials(t *testing.T) {
|
||||
adapter := &maintenanceTarget{
|
||||
id: "fake", available: target.Availability{Available: true, Evidence: "fake command found"},
|
||||
inspection: target.Inspection{State: target.External, Evidence: "found http://alice:secret@proxy.example:8080 in fake settings"},
|
||||
checks: []target.Check{{Name: "required commands", OK: false, Evidence: "helper failed for https://bob:hunter2@proxy.example/path"}, {Name: "write authority", OK: true, Evidence: "settings directory is writable"}},
|
||||
}
|
||||
maintenance := app.NewMaintenance(profile.State{}, []target.Target{adapter}, nil, nil)
|
||||
|
||||
report := maintenance.Doctor(context.Background(), []target.Check{{Name: "Profile configuration", OK: true, Evidence: "valid"}, {Name: "identity resolution", OK: true, Evidence: "tester (1000)"}})
|
||||
|
||||
if adapter.disableCalls != 0 {
|
||||
t.Fatalf("doctor mutated Target %d times", adapter.disableCalls)
|
||||
}
|
||||
text := report.String()
|
||||
for _, want := range []string{"Profile configuration", "identity resolution", "Target availability", "External", "required commands", "write authority", "found http://alice:REDACTED@proxy.example:8080"} {
|
||||
if !strings.Contains(text, want) {
|
||||
t.Errorf("doctor report missing %q: %s", want, text)
|
||||
}
|
||||
}
|
||||
for _, secret := range []string{"secret", "hunter2"} {
|
||||
if strings.Contains(text, secret) {
|
||||
t.Errorf("doctor leaked %q: %s", secret, text)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplicationSerializesAndLogsTargetMutations(t *testing.T) {
|
||||
adapter := &maintenanceTarget{id: "fake", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.External}}
|
||||
lock := &recordingLock{}
|
||||
log := &recordingLog{}
|
||||
application, err := app.NewWithTargetsAndRuntime(profile.NewFileStore(filepath.Join(t.TempDir(), "profiles.json")), []target.Target{adapter}, lock, log)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if result := application.Dispatch(app.Intent{Kind: app.CreateProfile, Profile: profile.Profile{Name: "office", SingleURL: "http://proxy.test:8080"}}); result.Err != nil {
|
||||
t.Fatal(result.Err)
|
||||
}
|
||||
if result := application.Dispatch(app.Intent{Kind: app.ActivateProfile, Name: "office"}); result.Err != nil {
|
||||
t.Fatal(result.Err)
|
||||
}
|
||||
adapter.disableErr = errors.New("failed http://alice:secret@proxy.test/private")
|
||||
result := application.Dispatch(app.Intent{Kind: app.SetTargetDesired, TargetID: "fake", Enabled: false})
|
||||
if result.Err == nil {
|
||||
t.Fatal("Target failure reported success")
|
||||
}
|
||||
if lock.acquired != 3 || lock.held != 0 {
|
||||
t.Fatalf("all mutation lock acquired=%d held=%d", lock.acquired, lock.held)
|
||||
}
|
||||
if len(log.entries) != 1 || log.entries[0].Operation != "disable" || strings.Contains(log.entries[0].Detail, "secret") || strings.Contains(log.entries[0].Detail, "proxy.test/private") {
|
||||
t.Fatalf("Target operation log = %#v", log.entries)
|
||||
}
|
||||
}
|
||||
|
||||
func TestResetRequiresConfirmationAndReportsTruthfulPartialResults(t *testing.T) {
|
||||
good := &maintenanceTarget{id: "good", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
|
||||
failure := errors.New("remove https://alice:secret@proxy.example failed: permission denied")
|
||||
bad := &maintenanceTarget{id: "bad", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Drifted, Evidence: "managed fragment remains"}, disableErr: failure}
|
||||
external := &maintenanceTarget{id: "external", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.External, Evidence: "user owned"}}
|
||||
lock := &recordingLock{}
|
||||
log := &recordingLog{}
|
||||
maintenance := app.NewMaintenance(profile.State{}, []target.Target{good, bad, external}, lock, log)
|
||||
|
||||
cancelled := maintenance.Reset(context.Background(), false)
|
||||
if !cancelled.Cancelled || cancelled.Err != nil || good.disableCalls+bad.disableCalls+external.disableCalls != 0 || lock.acquired != 0 {
|
||||
t.Fatalf("cancelled reset = %#v, calls %d/%d/%d lock=%d", cancelled, good.disableCalls, bad.disableCalls, external.disableCalls, lock.acquired)
|
||||
}
|
||||
|
||||
result := maintenance.Reset(context.Background(), true)
|
||||
if result.Err == nil || len(result.Targets) != 3 || good.disableCalls != 1 || bad.disableCalls != 1 || external.disableCalls != 0 {
|
||||
t.Fatalf("confirmed reset = %#v, calls %d/%d/%d", result, good.disableCalls, bad.disableCalls, external.disableCalls)
|
||||
}
|
||||
if result.Targets[0].Inspection.State != target.Disabled || result.Targets[1].Inspection.State != target.Drifted || !result.Targets[2].Skipped {
|
||||
t.Fatalf("reset did not preserve per-Target truth: %#v", result.Targets)
|
||||
}
|
||||
if lock.acquired != 1 || lock.held != 0 {
|
||||
t.Fatalf("lock lifecycle acquired=%d held=%d", lock.acquired, lock.held)
|
||||
}
|
||||
if len(log.entries) != 2 || strings.Contains(log.entries[1].Detail, "secret") {
|
||||
t.Fatalf("redacted operation log = %#v", log.entries)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
// Package operationlock serializes proxyctl state mutations across processes.
|
||||
package operationlock
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"path/filepath"
|
||||
"time"
|
||||
|
||||
"golang.org/x/sys/unix"
|
||||
|
||||
"proxyctl/internal/securefs"
|
||||
)
|
||||
|
||||
type Lock struct {
|
||||
path string
|
||||
uid int
|
||||
gid int
|
||||
owned bool
|
||||
}
|
||||
|
||||
func New(path string) *Lock { return &Lock{path: path} }
|
||||
func NewOwned(path string, uid, gid int) *Lock {
|
||||
return &Lock{path: path, uid: uid, gid: gid, owned: true}
|
||||
}
|
||||
|
||||
func (l *Lock) Lock(ctx context.Context) (func(), error) {
|
||||
if !filepath.IsAbs(l.path) {
|
||||
return nil, errors.New("operation lock path must be absolute")
|
||||
}
|
||||
store := securefs.Store{TrustedRoot: securefs.ExistingTrustedRoot(l.path)}
|
||||
if l.owned {
|
||||
store.Owner = &securefs.Owner{UID: l.uid, GID: l.gid}
|
||||
}
|
||||
file, err := store.OpenRegular(l.path, unix.O_CREAT|unix.O_RDWR|unix.O_NONBLOCK, 0o600)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("open operation lock securely: %w", err)
|
||||
}
|
||||
for {
|
||||
err = unix.Flock(int(file.Fd()), unix.LOCK_EX|unix.LOCK_NB)
|
||||
if err == nil {
|
||||
break
|
||||
}
|
||||
if !errors.Is(err, unix.EWOULDBLOCK) && !errors.Is(err, unix.EAGAIN) {
|
||||
file.Close()
|
||||
return nil, fmt.Errorf("acquire operation lock: %w", err)
|
||||
}
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
file.Close()
|
||||
return nil, ctx.Err()
|
||||
case <-time.After(10 * time.Millisecond):
|
||||
}
|
||||
}
|
||||
return func() { _ = unix.Flock(int(file.Fd()), unix.LOCK_UN); _ = file.Close() }, nil
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
package operationlock_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"proxyctl/internal/operationlock"
|
||||
)
|
||||
|
||||
func TestLockRejectsSymlinkedStateAncestor(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
victim := filepath.Join(root, "victim")
|
||||
if err := os.Mkdir(victim, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.Symlink(victim, filepath.Join(root, "state")); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
lock := operationlock.New(filepath.Join(root, "state", "proxyctl", "operation.lock"))
|
||||
if _, err := lock.Lock(context.Background()); err == nil {
|
||||
t.Fatal("lock followed a symlinked state ancestor")
|
||||
}
|
||||
entries, err := os.ReadDir(victim)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(entries) != 0 {
|
||||
t.Fatalf("victim changed: %v", entries)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLockSerializesIndependentInstancesAndHonorsContext(t *testing.T) {
|
||||
path := t.TempDir() + "/proxyctl.lock"
|
||||
first := operationlock.New(path)
|
||||
second := operationlock.New(path)
|
||||
unlock, err := first.Lock(context.Background())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
|
||||
defer cancel()
|
||||
if _, err := second.Lock(ctx); err == nil {
|
||||
t.Fatal("second lock acquired while first held")
|
||||
}
|
||||
unlock()
|
||||
unlockSecond, err := second.Lock(context.Background())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
unlockSecond()
|
||||
}
|
||||
@@ -0,0 +1,109 @@
|
||||
// Package oplog writes bounded, privacy-safe local operation logs.
|
||||
package oplog
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/fs"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"proxyctl/internal/app"
|
||||
"proxyctl/internal/securefs"
|
||||
)
|
||||
|
||||
type Logger struct {
|
||||
path string
|
||||
maxBytes int64
|
||||
rotations int
|
||||
uid int
|
||||
gid int
|
||||
owned bool
|
||||
}
|
||||
|
||||
func New(path string, maxBytes int64, rotations int) *Logger {
|
||||
return &Logger{path: path, maxBytes: maxBytes, rotations: rotations}
|
||||
}
|
||||
func NewOwned(path string, maxBytes int64, rotations, uid, gid int) *Logger {
|
||||
return &Logger{path: path, maxBytes: maxBytes, rotations: rotations, uid: uid, gid: gid, owned: true}
|
||||
}
|
||||
|
||||
func (l *Logger) Write(entry app.LogEntry) error {
|
||||
if l.maxBytes <= 0 {
|
||||
return nil
|
||||
}
|
||||
detail := strings.NewReplacer("\n", " ", "\r", " ").Replace(app.RedactLogDetail(entry.Detail))
|
||||
if entry.Time.IsZero() {
|
||||
entry.Time = time.Now()
|
||||
}
|
||||
line := fmt.Sprintf("time=%s operation=%s target=%s result=%s detail=%s\n", entry.Time.UTC().Format("2006-01-02T15:04:05Z"), field(entry.Operation), field(entry.Target), field(entry.Result), detail)
|
||||
if int64(len(line)) > l.maxBytes {
|
||||
truncated := []byte(line[:l.maxBytes])
|
||||
if len(truncated) > 0 {
|
||||
truncated[len(truncated)-1] = '\n'
|
||||
}
|
||||
line = string(truncated)
|
||||
}
|
||||
store := l.store()
|
||||
current, err := readOptional(store, l.path)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read operation log securely: %w", err)
|
||||
}
|
||||
if int64(len(current)+len(line)) > l.maxBytes {
|
||||
if err := l.rotate(store, current); err != nil {
|
||||
return err
|
||||
}
|
||||
current = nil
|
||||
}
|
||||
current = append(current, line...)
|
||||
if err := store.AtomicWrite(l.path, current, 0o600); err != nil {
|
||||
return fmt.Errorf("write operation log atomically: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (l *Logger) store() securefs.Store {
|
||||
store := securefs.Store{TrustedRoot: securefs.ExistingTrustedRoot(l.path)}
|
||||
if l.owned {
|
||||
store.Owner = &securefs.Owner{UID: l.uid, GID: l.gid}
|
||||
}
|
||||
return store
|
||||
}
|
||||
|
||||
func field(value string) string {
|
||||
return strings.NewReplacer(" ", "_", "\n", "_", "\r", "_").Replace(value)
|
||||
}
|
||||
|
||||
func (l *Logger) rotate(store securefs.Store, current []byte) error {
|
||||
if l.rotations <= 0 {
|
||||
return nil
|
||||
}
|
||||
for i := l.rotations; i >= 2; i-- {
|
||||
previous := fmt.Sprintf("%s.%d", l.path, i-1)
|
||||
data, err := readOptional(store, previous)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read rotated operation log: %w", err)
|
||||
}
|
||||
if data == nil {
|
||||
continue
|
||||
}
|
||||
if err := store.AtomicWrite(fmt.Sprintf("%s.%d", l.path, i), data, 0o600); err != nil {
|
||||
return fmt.Errorf("rotate operation log: %w", err)
|
||||
}
|
||||
}
|
||||
if current != nil {
|
||||
if err := store.AtomicWrite(l.path+".1", current, 0o600); err != nil {
|
||||
return fmt.Errorf("rotate operation log: %w", err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func readOptional(store securefs.Store, path string) ([]byte, error) {
|
||||
data, err := store.ReadFile(path)
|
||||
if errors.Is(err, fs.ErrNotExist) || errors.Is(err, os.ErrNotExist) {
|
||||
return nil, nil
|
||||
}
|
||||
return data, err
|
||||
}
|
||||
@@ -0,0 +1,71 @@
|
||||
package oplog_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"proxyctl/internal/app"
|
||||
"proxyctl/internal/oplog"
|
||||
)
|
||||
|
||||
func TestLoggerRejectsSymlinkedStateAncestor(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
victim := filepath.Join(root, "victim")
|
||||
if err := os.Mkdir(victim, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := os.Symlink(victim, filepath.Join(root, "state")); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
logger := oplog.New(filepath.Join(root, "state", "proxyctl", "operations.log"), 1024, 1)
|
||||
if err := logger.Write(app.LogEntry{Operation: "reset", Result: "failure"}); err == nil {
|
||||
t.Fatal("logger followed a symlinked state ancestor")
|
||||
}
|
||||
entries, err := os.ReadDir(victim)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(entries) != 0 {
|
||||
t.Fatalf("victim changed: %v", entries)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoggerRotatesAtBoundAndNeverStoresAuthenticatedURL(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "state", "proxyctl.log")
|
||||
logger := oplog.New(path, 180, 2)
|
||||
for i := 0; i < 20; i++ {
|
||||
err := logger.Write(app.LogEntry{Time: time.Unix(int64(i), 0), Operation: "reset", Target: "fake", Result: "failure", Detail: "request http://alice:secret@proxy.example:8080/private failed"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
for _, candidate := range []string{path, path + ".1", path + ".2"} {
|
||||
data, err := os.ReadFile(candidate)
|
||||
if os.IsNotExist(err) {
|
||||
continue
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(data) > 180 {
|
||||
t.Errorf("%s has %d bytes, max 180", filepath.Base(candidate), len(data))
|
||||
}
|
||||
text := string(data)
|
||||
if strings.Contains(text, "secret") || strings.Contains(text, "proxy.example:8080/private") {
|
||||
t.Errorf("log leaked authenticated URL: %q", text)
|
||||
}
|
||||
if !strings.Contains(text, "operation=reset") || !strings.Contains(text, "target=fake") || !strings.Contains(text, "result=failure") {
|
||||
t.Errorf("log lacks operation fields: %q", text)
|
||||
}
|
||||
}
|
||||
matches, err := filepath.Glob(path + "*")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(matches) > 3 {
|
||||
t.Fatalf("retained %d logs, want at most 3: %v", len(matches), matches)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
package profile
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"io/fs"
|
||||
"os"
|
||||
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
// ReadOnlyLoad reads and validates Profile configuration without creating,
|
||||
// chmodding, chowning, locking, or replacing any filesystem object.
|
||||
func (s *FileStore) ReadOnlyLoad() (State, error) {
|
||||
file, err := os.OpenFile(s.path, unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK, 0)
|
||||
if errors.Is(err, fs.ErrNotExist) {
|
||||
return State{}, nil
|
||||
}
|
||||
if err != nil {
|
||||
return State{}, fmt.Errorf("open Profile configuration read-only: %w", err)
|
||||
}
|
||||
defer file.Close()
|
||||
info, err := file.Stat()
|
||||
if err != nil {
|
||||
return State{}, fmt.Errorf("inspect Profile configuration: %w", err)
|
||||
}
|
||||
if !info.Mode().IsRegular() {
|
||||
return State{}, errors.New("Profile configuration is not a regular file")
|
||||
}
|
||||
data, err := io.ReadAll(file)
|
||||
if err != nil {
|
||||
return State{}, fmt.Errorf("read Profile configuration: %w", err)
|
||||
}
|
||||
var state State
|
||||
if err := json.Unmarshal(data, &state); err != nil {
|
||||
return State{}, fmt.Errorf("parse Profile configuration: %w", err)
|
||||
}
|
||||
for _, candidate := range state.Profiles {
|
||||
if _, err := ValidateAndNormalize(candidate); err != nil {
|
||||
return State{}, fmt.Errorf("Profile %q is invalid: %w", candidate.Name, err)
|
||||
}
|
||||
}
|
||||
if state.ActiveProfile != "" && indexProfile(state.Profiles, state.ActiveProfile) < 0 {
|
||||
return State{}, fmt.Errorf("Active Profile %q does not exist", state.ActiveProfile)
|
||||
}
|
||||
return state, nil
|
||||
}
|
||||
|
||||
func indexProfile(profiles []Profile, name string) int {
|
||||
for i := range profiles {
|
||||
if profiles[i].Name == name {
|
||||
return i
|
||||
}
|
||||
}
|
||||
return -1
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
package profile_test
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"proxyctl/internal/profile"
|
||||
)
|
||||
|
||||
func TestReadOnlyLoadValidatesWithoutRepairingOrCreatingStorage(t *testing.T) {
|
||||
directory := filepath.Join(t.TempDir(), "proxyctl")
|
||||
if err := os.MkdirAll(directory, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
path := filepath.Join(directory, "profiles.json")
|
||||
if err := os.WriteFile(path, []byte(`{"profiles":[{"name":"office","mode":"single","singleUrl":"http://proxy.test:8080","httpUrl":"http://proxy.test:8080","httpsUrl":"http://proxy.test:8080","allUrl":"http://proxy.test:8080"}],"activeProfile":"office"}`), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
store := profile.NewFileStore(path)
|
||||
state, err := store.ReadOnlyLoad()
|
||||
if err != nil || state.ActiveProfile != "office" {
|
||||
t.Fatalf("read-only load state=%#v err=%v", state, err)
|
||||
}
|
||||
info, err := os.Stat(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if info.Mode().Perm() != 0o644 {
|
||||
t.Fatalf("read-only load changed mode to %o", info.Mode().Perm())
|
||||
}
|
||||
if _, err := os.Stat(path + ".lock"); !os.IsNotExist(err) {
|
||||
t.Fatalf("read-only load created lock: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -18,6 +18,22 @@ import (
|
||||
|
||||
type Owner struct{ UID, GID int }
|
||||
|
||||
// ExistingTrustedRoot returns the nearest existing ancestor without resolving
|
||||
// symlinks. Descriptor traversal will subsequently reject a symlink ancestor.
|
||||
func ExistingTrustedRoot(path string) string {
|
||||
candidate := filepath.Dir(filepath.Clean(path))
|
||||
for {
|
||||
if _, err := os.Lstat(candidate); err == nil || !errors.Is(err, fs.ErrNotExist) {
|
||||
return candidate
|
||||
}
|
||||
parent := filepath.Dir(candidate)
|
||||
if parent == candidate {
|
||||
return candidate
|
||||
}
|
||||
candidate = parent
|
||||
}
|
||||
}
|
||||
|
||||
func OpenNoFollow(path string, flags int, mode uint32) (*os.File, error) {
|
||||
fd, err := unix.Open(path, flags|unix.O_CLOEXEC|unix.O_NOFOLLOW, mode)
|
||||
if err != nil {
|
||||
@@ -55,6 +71,45 @@ type Store struct {
|
||||
Owner *Owner
|
||||
}
|
||||
|
||||
// OpenRegular opens a regular file through a descriptor-anchored parent path.
|
||||
// Parent components and the final file are never followed through symlinks.
|
||||
func (s Store) OpenRegular(path string, flags int, mode os.FileMode) (*os.File, error) {
|
||||
directory, base, err := s.openParent(path, flags&unix.O_CREAT != 0)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := directory.Chmod(0o700); err != nil {
|
||||
_ = directory.Close()
|
||||
return nil, err
|
||||
}
|
||||
if s.Owner != nil && (s.Owner.UID != os.Geteuid() || s.Owner.GID != os.Getegid()) {
|
||||
if err := directory.Chown(s.Owner.UID, s.Owner.GID); err != nil {
|
||||
_ = directory.Close()
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
file, err := OpenAt(directory, base, flags, uint32(mode.Perm()))
|
||||
_ = directory.Close()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := regular(file); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, err
|
||||
}
|
||||
if err := file.Chmod(mode.Perm()); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, err
|
||||
}
|
||||
if s.Owner != nil && (s.Owner.UID != os.Geteuid() || s.Owner.GID != os.Getegid()) {
|
||||
if err := file.Chown(s.Owner.UID, s.Owner.GID); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
return file, nil
|
||||
}
|
||||
|
||||
type fileLock struct{ file *os.File }
|
||||
|
||||
func (l *fileLock) Close() error {
|
||||
@@ -66,32 +121,12 @@ func (l *fileLock) Close() error {
|
||||
return closeErr
|
||||
}
|
||||
|
||||
// LockFile acquires an exclusive advisory lock without following symbolic
|
||||
// links. The returned closer releases the lock and closes its descriptor.
|
||||
// LockFile acquires an exclusive advisory lock without following symlinks.
|
||||
func (s Store) LockFile(path string) (io.Closer, error) {
|
||||
directory, base, err := s.openParent(path, true)
|
||||
file, err := s.OpenRegular(path, unix.O_CREAT|unix.O_RDWR, 0o600)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer directory.Close()
|
||||
file, err := OpenAt(directory, base, unix.O_CREAT|unix.O_RDWR, 0o600)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := regular(file); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, err
|
||||
}
|
||||
if s.Owner != nil && (s.Owner.UID != os.Geteuid() || s.Owner.GID != os.Getegid()) {
|
||||
if err := file.Chown(s.Owner.UID, s.Owner.GID); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if err := file.Chmod(0o600); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, err
|
||||
}
|
||||
if err := unix.Flock(int(file.Fd()), unix.LOCK_EX); err != nil {
|
||||
_ = file.Close()
|
||||
return nil, err
|
||||
|
||||
+45
-1
@@ -14,6 +14,8 @@ import (
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/sys/unix"
|
||||
|
||||
"proxyctl/internal/profile"
|
||||
"proxyctl/internal/securefs"
|
||||
"proxyctl/internal/target"
|
||||
@@ -188,6 +190,46 @@ func (a *Adapter) EnvironmentPath() string { return a.configuration.Environment
|
||||
func (a *Adapter) RecoveryPath() string { return a.configuration.RecoveryFile }
|
||||
func (a *Adapter) StartupPath() string { return a.configuration.StartupFile }
|
||||
|
||||
// DiagnosticChecks performs no writes or command execution.
|
||||
func (a *Adapter) DiagnosticChecks(_ context.Context, _ *profile.Profile) []target.Check {
|
||||
paths := []string{a.configuration.EnvironmentFile, a.configuration.RecoveryFile}
|
||||
writable := true
|
||||
var evidence []string
|
||||
for _, path := range paths {
|
||||
ok, detail := writablePath(path)
|
||||
writable = writable && ok
|
||||
evidence = append(evidence, detail)
|
||||
}
|
||||
return []target.Check{
|
||||
{Name: "required commands", OK: true, Evidence: "Shell Target requires no external commands"},
|
||||
{Name: "write authority", OK: writable, Evidence: strings.Join(evidence, "; ")},
|
||||
}
|
||||
}
|
||||
|
||||
func writablePath(path string) (bool, string) {
|
||||
candidate := path
|
||||
for {
|
||||
info, err := os.Stat(candidate)
|
||||
if err == nil {
|
||||
if !info.IsDir() {
|
||||
candidate = filepath.Dir(candidate)
|
||||
}
|
||||
if err := unix.Access(candidate, unix.W_OK); err != nil {
|
||||
return false, candidate + " is not writable: " + err.Error()
|
||||
}
|
||||
return true, candidate + " is writable"
|
||||
}
|
||||
if !errors.Is(err, fs.ErrNotExist) {
|
||||
return false, candidate + " cannot be inspected: " + err.Error()
|
||||
}
|
||||
parent := filepath.Dir(candidate)
|
||||
if parent == candidate {
|
||||
return false, path + " has no writable existing ancestor"
|
||||
}
|
||||
candidate = parent
|
||||
}
|
||||
}
|
||||
|
||||
func (a *Adapter) Inspect(_ context.Context, active *profile.Profile) target.Inspection {
|
||||
metadata, managed, metadataErr := a.readRecovery()
|
||||
generated, generatedErr := a.files.ReadFile(a.configuration.EnvironmentFile)
|
||||
@@ -215,7 +257,9 @@ func (a *Adapter) Inspect(_ context.Context, active *profile.Profile) target.Ins
|
||||
}
|
||||
|
||||
func (a *Adapter) SetDesired(ctx context.Context, enabled bool, active *profile.Profile) target.OperationResult {
|
||||
if !a.Availability(ctx).Available {
|
||||
// Enabling requires a supported current Shell, but disabling must remain
|
||||
// available so reset can remove managed state after the user's Shell changes.
|
||||
if enabled && !a.Availability(ctx).Available {
|
||||
return target.OperationResult{Inspection: a.Inspect(ctx, active), Err: errors.New("Shell Target is unavailable: Bash or Zsh was not detected")}
|
||||
}
|
||||
if enabled && active == nil {
|
||||
|
||||
@@ -472,6 +472,21 @@ func TestRecoveryAndGeneratedFilesAreAtomicOwnerOnly(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestDisableManagedShellAfterCurrentShellBecomesUnsupported(t *testing.T) {
|
||||
root := t.TempDir()
|
||||
configuration := shell.Configuration{Shell: "/bin/bash", StartupFile: filepath.Join(root, ".bashrc"), EnvironmentFile: filepath.Join(root, "config", "shell.env"), RecoveryFile: filepath.Join(root, "state", "shell.json")}
|
||||
enabled := shell.New(configuration, shell.OSFileSystem{}, shell.MapEnvironment{})
|
||||
if result := enabled.SetDesired(context.Background(), true, activeProfile()); result.Err != nil {
|
||||
t.Fatal(result.Err)
|
||||
}
|
||||
configuration.Shell = "/bin/fish"
|
||||
unsupported := shell.New(configuration, shell.OSFileSystem{}, shell.MapEnvironment{})
|
||||
result := unsupported.SetDesired(context.Background(), false, nil)
|
||||
if result.Err != nil || result.Inspection.State != target.Disabled {
|
||||
t.Fatalf("disable from unsupported Shell = %#v", result)
|
||||
}
|
||||
}
|
||||
|
||||
func activeProfile() *profile.Profile {
|
||||
return &profile.Profile{Name: "office", Mode: profile.AdvancedMode, HTTPURL: "http://alice:secret@proxy.example:8080", HTTPSURL: "https://proxy.example:8443", AllURL: "socks5h://proxy.example:1080", Bypass: []string{"localhost", ".example.com", "10.0.0.0/8"}}
|
||||
}
|
||||
|
||||
@@ -38,6 +38,19 @@ type OperationResult struct {
|
||||
Err error
|
||||
}
|
||||
|
||||
// Check is one read-only diagnostic observation with the evidence behind it.
|
||||
type Check struct {
|
||||
Name string
|
||||
OK bool
|
||||
Evidence string
|
||||
}
|
||||
|
||||
// Diagnosable is the optional Target capability for command and write-authority
|
||||
// checks which cannot be inferred from availability and inspection alone.
|
||||
type Diagnosable interface {
|
||||
DiagnosticChecks(context.Context, *profile.Profile) []Check
|
||||
}
|
||||
|
||||
// Target hides platform paths and commands from the application and TUI.
|
||||
type Target interface {
|
||||
ID() string
|
||||
|
||||
Reference in New Issue
Block a user