Raven Scott
caa60e3167
Allow SFTP clients to reach the same logical paths as the shell (system image, pseudo, home, mounts), deny mutating OPEN on typical read-only prefixes, merge file/dir handle IDs to avoid collisions, implement FSTAT, stat-based READDIR NAME attrs/longnames, and improve REALPATH. Add brittle tests for path policy and wire test.bare-openssh-sftp.js into npm test.
83 lines
2.1 KiB
JavaScript
83 lines
2.1 KiB
JavaScript
import test from 'brittle'
|
|
import {
|
|
bareOsSftpAllowedLogicalPath,
|
|
bareOsSftpDeniesWriteOpen
|
|
} from './lib/bare-openssh-sftp.js'
|
|
|
|
const OPEN_MODE = {
|
|
READ: 0x00000001,
|
|
WRITE: 0x00000002,
|
|
APPEND: 0x00000004,
|
|
CREAT: 0x00000008,
|
|
TRUNC: 0x00000010
|
|
}
|
|
|
|
const home = '/home/guest'
|
|
|
|
test('bareOsSftpAllowedLogicalPath allows /lib and /home', (t) => {
|
|
t.ok(bareOsSftpAllowedLogicalPath('/lib/bare/bare-module-manifest.json', home))
|
|
t.ok(bareOsSftpAllowedLogicalPath('/bin/sh', home))
|
|
t.ok(bareOsSftpAllowedLogicalPath('/home/guest/x', home))
|
|
t.ok(bareOsSftpAllowedLogicalPath('/proc/version', home))
|
|
t.ok(bareOsSftpAllowedLogicalPath('/mnt/d0', home))
|
|
})
|
|
|
|
test('bareOsSftpAllowedLogicalPath rejects unknown top-level', (t) => {
|
|
t.absent(bareOsSftpAllowedLogicalPath('/nope/file', home))
|
|
})
|
|
|
|
test('bareOsSftpDeniesWriteOpen blocks /lib mutating open', (t) => {
|
|
t.ok(
|
|
bareOsSftpDeniesWriteOpen(
|
|
'/lib/bare/x',
|
|
home,
|
|
OPEN_MODE.WRITE,
|
|
OPEN_MODE
|
|
)
|
|
)
|
|
t.ok(
|
|
bareOsSftpDeniesWriteOpen(
|
|
'/lib/bare/x',
|
|
home,
|
|
OPEN_MODE.CREAT,
|
|
OPEN_MODE
|
|
)
|
|
)
|
|
t.absent(
|
|
bareOsSftpDeniesWriteOpen(
|
|
'/lib/bare/x',
|
|
home,
|
|
OPEN_MODE.READ,
|
|
OPEN_MODE
|
|
)
|
|
)
|
|
})
|
|
|
|
test('bareOsSftpDeniesWriteOpen allows writes under HOME', (t) => {
|
|
t.absent(
|
|
bareOsSftpDeniesWriteOpen(
|
|
'/home/guest/a.txt',
|
|
home,
|
|
OPEN_MODE.WRITE | OPEN_MODE.CREAT,
|
|
OPEN_MODE
|
|
)
|
|
)
|
|
})
|
|
|
|
test('bareOsSftpDeniesWriteOpen allows writes under /tmp', (t) => {
|
|
t.absent(
|
|
bareOsSftpDeniesWriteOpen('/tmp/a', home, OPEN_MODE.WRITE, OPEN_MODE)
|
|
)
|
|
})
|
|
|
|
/*
|
|
* If `ssh`/`cat` against the guest still kills the Pear host with
|
|
* `bad_optional_access was thrown in -fno-exceptions mode`, that abort comes
|
|
* from native code (typically libc++/optional under -fno-exceptions), not from
|
|
* this SFTP shim. Bisect Pear/Bare/hyperdrive versions and try disabling
|
|
* BARE_OS_VFS_BIN_CACHE_BLAKE2B / BARE_OS_VFS_LIB_BARE_CACHE when reproducing.
|
|
*
|
|
* Manual SFTP check: `sftp -P <port> [email protected]` then
|
|
* `ls -l /lib/bare`, `get /lib/bare/bare-module-manifest.json`, `stat` an open file.
|
|
*/
|