0.31.0: hardening and correctness pass across mux, codec, AACS/CSS, UDF/MPLS/CLPI, recovery, drive/SCSI, labels, and I/O
Library-wide review-and-fix pass: tightened AACS keydb/handshake/variant handling and trailing-partial-unit policy, corrected MPLS mark offset and added UDF allocation bounds, hardened the mux/codec framing and M2TS paths, guarded SCSI READ CAPACITY short transfers and unified error mapping, added overflow guards on untrusted disc input, and made prefetch shutdown deterministic. Release profile now builds with thin LTO + single codegen unit.
This commit is contained in:
Matthew Jackson
+211
-34
@@ -5,8 +5,43 @@
|
||||
|
||||
use crate::error::{Error, Result};
|
||||
use std::io::{Read, Write};
|
||||
use std::net::TcpStream;
|
||||
use std::net::{TcpStream, ToSocketAddrs};
|
||||
use std::path::PathBuf;
|
||||
use std::time::Duration;
|
||||
|
||||
/// Network operation timeout (connect / read / write). Keeps the daily
|
||||
/// refresh thread from blocking indefinitely on an unresponsive mirror.
|
||||
const NET_TIMEOUT: Duration = Duration::from_secs(10);
|
||||
|
||||
/// Read timeout — longer than connect/write since the keydb body can be
|
||||
/// several MiB over a slow link.
|
||||
const READ_TIMEOUT: Duration = Duration::from_secs(30);
|
||||
|
||||
/// Maximum redirects to follow before giving up.
|
||||
const MAX_REDIRECTS: usize = 5;
|
||||
|
||||
/// Upper bound on decompressed keydb size. The published keydb is a few
|
||||
/// MiB; 64 MiB is a generous ceiling that still caps a decompression
|
||||
/// bomb (a tiny zip/gz can otherwise inflate to GiB and OOM the daily
|
||||
/// refresh thread).
|
||||
const MAX_KEYDB_BYTES: u64 = 64 * 1024 * 1024;
|
||||
|
||||
/// Read a decompressed stream into a String with a hard size ceiling.
|
||||
/// Returns `Error::KeydbInvalid` if the input exceeds the cap or is not
|
||||
/// valid UTF-8.
|
||||
fn read_capped_to_string<R: Read>(reader: R) -> Result<String> {
|
||||
let mut buf = Vec::new();
|
||||
// Read one byte past the cap so an exactly-at-cap stream is accepted
|
||||
// but anything larger is rejected.
|
||||
reader
|
||||
.take(MAX_KEYDB_BYTES + 1)
|
||||
.read_to_end(&mut buf)
|
||||
.map_err(|_| Error::KeydbParse)?;
|
||||
if buf.len() as u64 > MAX_KEYDB_BYTES {
|
||||
return Err(Error::KeydbInvalid);
|
||||
}
|
||||
String::from_utf8(buf).map_err(|_| Error::KeydbParse)
|
||||
}
|
||||
|
||||
/// Standard keydb storage path.
|
||||
pub fn default_path() -> Result<PathBuf> {
|
||||
@@ -30,13 +65,11 @@ pub fn save(data: &[u8]) -> Result<UpdateResult> {
|
||||
let text = if data.starts_with(b"PK\x03\x04") {
|
||||
extract_zip(data)?
|
||||
} else if data.starts_with(&[0x1f, 0x8b]) {
|
||||
let mut dec = flate2::read::GzDecoder::new(data);
|
||||
let mut out = String::new();
|
||||
dec.read_to_string(&mut out)
|
||||
.map_err(|_| Error::KeydbParse)?;
|
||||
out
|
||||
read_capped_to_string(flate2::read::GzDecoder::new(data))?
|
||||
} else {
|
||||
String::from_utf8(data.to_vec()).map_err(|_| Error::KeydbParse)?
|
||||
std::str::from_utf8(data)
|
||||
.map(str::to_string)
|
||||
.map_err(|_| Error::KeydbParse)?
|
||||
};
|
||||
|
||||
let entries = text
|
||||
@@ -82,16 +115,25 @@ pub struct UpdateResult {
|
||||
fn http_get(url: &str) -> Result<Vec<u8>> {
|
||||
let (mut host, mut port, mut path) = parse_url(url)?;
|
||||
|
||||
for _ in 0..5 {
|
||||
let addr = format!("{host}:{port}");
|
||||
let mut stream =
|
||||
TcpStream::connect(&addr).map_err(|_| Error::KeydbConnect { host: host.clone() })?;
|
||||
stream
|
||||
.set_read_timeout(Some(std::time::Duration::from_secs(30)))
|
||||
.ok();
|
||||
for _ in 0..MAX_REDIRECTS {
|
||||
// Resolve to a concrete socket address so we can bound the connect
|
||||
// with connect_timeout (plain connect() uses the OS default, which
|
||||
// can be minutes).
|
||||
let addr = (host.as_str(), port)
|
||||
.to_socket_addrs()
|
||||
.ok()
|
||||
.and_then(|mut it| it.next())
|
||||
.ok_or_else(|| Error::KeydbConnect { host: host.clone() })?;
|
||||
let mut stream = TcpStream::connect_timeout(&addr, NET_TIMEOUT)
|
||||
.map_err(|_| Error::KeydbConnect { host: host.clone() })?;
|
||||
stream.set_read_timeout(Some(READ_TIMEOUT)).ok();
|
||||
stream.set_write_timeout(Some(NET_TIMEOUT)).ok();
|
||||
|
||||
// HTTP/1.0 forces close-delimited framing: the server cannot reply
|
||||
// with Transfer-Encoding: chunked, so the raw body is the keydb
|
||||
// bytes with no chunk-size lines to de-frame.
|
||||
let request = format!(
|
||||
"GET {path} HTTP/1.1\r\nHost: {host}\r\nConnection: close\r\nAccept-Encoding: identity\r\n\r\n"
|
||||
"GET {path} HTTP/1.0\r\nHost: {host}\r\nConnection: close\r\nAccept-Encoding: identity\r\n\r\n"
|
||||
);
|
||||
stream
|
||||
.write_all(request.as_bytes())
|
||||
@@ -104,18 +146,27 @@ fn http_get(url: &str) -> Result<Vec<u8>> {
|
||||
.map_err(|_| Error::KeydbConnect { host: host.clone() })?;
|
||||
|
||||
let header_end = find_header_end(&response).ok_or(Error::KeydbParse)?;
|
||||
let headers = std::str::from_utf8(&response[..header_end]).unwrap_or("");
|
||||
// Lossy: a stray non-UTF-8 byte in the header block must not blank
|
||||
// out the whole status line / Location header (which would surface
|
||||
// as an undiagnosable KeydbHttp{status:0}).
|
||||
let headers = String::from_utf8_lossy(&response[..header_end]);
|
||||
let body = &response[header_end + 4..];
|
||||
|
||||
if let Some(location) = extract_header(headers, "Location") {
|
||||
let parsed = parse_url(&location)?;
|
||||
host = parsed.0;
|
||||
port = parsed.1;
|
||||
path = parsed.2;
|
||||
let status = parse_status(&headers);
|
||||
|
||||
// Only treat a Location header as a redirect when the status is
|
||||
// actually 3xx; a 200 carrying a stray Location (some proxies) is
|
||||
// not a redirect, and a 3xx without Location is a malformed redirect.
|
||||
if (300..=399).contains(&status) {
|
||||
let location =
|
||||
extract_header(&headers, "Location").ok_or(Error::KeydbHttp { status })?;
|
||||
let (next_host, next_port, next_path) = resolve_redirect(&location, &host, port)?;
|
||||
host = next_host;
|
||||
port = next_port;
|
||||
path = next_path;
|
||||
continue;
|
||||
}
|
||||
|
||||
let status = parse_status(headers);
|
||||
if status != 200 {
|
||||
return Err(Error::KeydbHttp { status });
|
||||
}
|
||||
@@ -123,17 +174,66 @@ fn http_get(url: &str) -> Result<Vec<u8>> {
|
||||
return Ok(body.to_vec());
|
||||
}
|
||||
|
||||
Err(Error::KeydbHttp { status: 302 })
|
||||
Err(Error::KeydbTooManyRedirects)
|
||||
}
|
||||
|
||||
/// Resolve a `Location` value against the current request target.
|
||||
/// Handles absolute `http://` URLs, scheme-relative `//host/path`,
|
||||
/// absolute paths `/path`, and rejects unsupported schemes (e.g.
|
||||
/// `https://`, which this dependency-light client cannot fetch) with a
|
||||
/// diagnosable error rather than a generic parse failure.
|
||||
fn resolve_redirect(
|
||||
location: &str,
|
||||
cur_host: &str,
|
||||
cur_port: u16,
|
||||
) -> Result<(String, u16, String)> {
|
||||
let loc = location.trim();
|
||||
|
||||
if let Some(rest) = loc.strip_prefix("//") {
|
||||
// Scheme-relative: //host[:port]/path — inherit http.
|
||||
return parse_url(&format!("http://{rest}"));
|
||||
}
|
||||
if loc.starts_with('/') {
|
||||
// Absolute path on the same host/port.
|
||||
return Ok((cur_host.to_string(), cur_port, loc.to_string()));
|
||||
}
|
||||
if let Some(scheme) = loc.split("://").next() {
|
||||
if loc.contains("://") && !scheme.eq_ignore_ascii_case("http") {
|
||||
return Err(Error::KeydbUnsupportedScheme {
|
||||
scheme: scheme.to_string(),
|
||||
});
|
||||
}
|
||||
}
|
||||
parse_url(loc)
|
||||
}
|
||||
|
||||
fn parse_url(url: &str) -> Result<(String, u16, String)> {
|
||||
// Reject non-http(s) up front so the caller gets a scheme diagnostic
|
||||
// rather than an opaque parse error.
|
||||
if let Some(scheme) = url.split("://").next() {
|
||||
if url.contains("://") && !scheme.eq_ignore_ascii_case("http") {
|
||||
return Err(Error::KeydbUnsupportedScheme {
|
||||
scheme: scheme.to_string(),
|
||||
});
|
||||
}
|
||||
}
|
||||
let url = url.strip_prefix("http://").ok_or(Error::KeydbParse)?;
|
||||
let (host_port, path) = match url.find('/') {
|
||||
Some(i) => (&url[..i], &url[i..]),
|
||||
None => (url, "/"),
|
||||
};
|
||||
let (host, port) = match host_port.find(':') {
|
||||
Some(i) => (&host_port[..i], host_port[i + 1..].parse().unwrap_or(80)),
|
||||
Some(i) => {
|
||||
let port_str = &host_port[i + 1..];
|
||||
// A non-empty-but-unparseable port is a malformed URL; only an
|
||||
// omitted port defaults to 80.
|
||||
let port = if port_str.is_empty() {
|
||||
80
|
||||
} else {
|
||||
port_str.parse().map_err(|_| Error::KeydbParse)?
|
||||
};
|
||||
(&host_port[..i], port)
|
||||
}
|
||||
None => (host_port, 80u16),
|
||||
};
|
||||
Ok((host.to_string(), port, path.to_string()))
|
||||
@@ -153,12 +253,15 @@ fn find_header_end(data: &[u8]) -> Option<usize> {
|
||||
}
|
||||
|
||||
fn extract_header(headers: &str, name: &str) -> Option<String> {
|
||||
// Split on the first ':' rather than byte-indexing at name.len(),
|
||||
// which would panic on a multibyte UTF-8 codepoint straddling that
|
||||
// offset (headers are decoded from untrusted network bytes). Also
|
||||
// accepts single-character values (e.g. "Location:x").
|
||||
for line in headers.lines() {
|
||||
if line.len() > name.len() + 2
|
||||
&& line[..name.len()].eq_ignore_ascii_case(name)
|
||||
&& line.as_bytes()[name.len()] == b':'
|
||||
{
|
||||
return Some(line[name.len() + 1..].trim().to_string());
|
||||
if let Some((key, value)) = line.split_once(':') {
|
||||
if key.trim().eq_ignore_ascii_case(name) {
|
||||
return Some(value.trim().to_string());
|
||||
}
|
||||
}
|
||||
}
|
||||
None
|
||||
@@ -169,14 +272,88 @@ fn extract_zip(data: &[u8]) -> Result<String> {
|
||||
let mut archive = zip::ZipArchive::new(cursor).map_err(|_| Error::KeydbParse)?;
|
||||
|
||||
for i in 0..archive.len() {
|
||||
let mut file = archive.by_index(i).map_err(|_| Error::KeydbParse)?;
|
||||
let file = archive.by_index(i).map_err(|_| Error::KeydbParse)?;
|
||||
if file.name().ends_with(".cfg") || file.name().ends_with(".CFG") {
|
||||
let mut text = String::new();
|
||||
file.read_to_string(&mut text)
|
||||
.map_err(|_| Error::KeydbParse)?;
|
||||
return Ok(text);
|
||||
return read_capped_to_string(file);
|
||||
}
|
||||
}
|
||||
|
||||
Err(Error::KeydbInvalid)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn parse_url_defaults_and_paths() {
|
||||
let (h, p, path) = parse_url("http://example.com/keydb.zip").unwrap();
|
||||
assert_eq!(
|
||||
(h.as_str(), p, path.as_str()),
|
||||
("example.com", 80, "/keydb.zip")
|
||||
);
|
||||
|
||||
let (h, p, path) = parse_url("http://example.com:8080").unwrap();
|
||||
assert_eq!((h.as_str(), p, path.as_str()), ("example.com", 8080, "/"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_url_rejects_https_scheme() {
|
||||
// TLS is unsupported by this client; surface a scheme diagnostic
|
||||
// rather than a generic parse error.
|
||||
assert!(matches!(
|
||||
parse_url("https://example.com/k.zip"),
|
||||
Err(Error::KeydbUnsupportedScheme { .. })
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_url_rejects_malformed_port() {
|
||||
// Non-empty-but-unparseable port must error, not silently fall to 80.
|
||||
assert!(matches!(
|
||||
parse_url("http://example.com:abc/path"),
|
||||
Err(Error::KeydbParse)
|
||||
));
|
||||
// An empty port still defaults to 80.
|
||||
let (_, p, _) = parse_url("http://example.com:/path").unwrap();
|
||||
assert_eq!(p, 80);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn redirect_to_https_is_unsupported_scheme_not_parse_error() {
|
||||
// The bplaced-style mirror enabling TLS on a redirect must produce a
|
||||
// diagnosable scheme error, not KeydbParse.
|
||||
assert!(matches!(
|
||||
resolve_redirect("https://mirror.example/keydb.zip", "old.host", 80),
|
||||
Err(Error::KeydbUnsupportedScheme { .. })
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn redirect_scheme_relative_and_absolute_path() {
|
||||
// Scheme-relative //host/path inherits http.
|
||||
let (h, p, path) = resolve_redirect("//mirror.example/a.zip", "old.host", 80).unwrap();
|
||||
assert_eq!(
|
||||
(h.as_str(), p, path.as_str()),
|
||||
("mirror.example", 80, "/a.zip")
|
||||
);
|
||||
|
||||
// Absolute path stays on the current host/port.
|
||||
let (h, p, path) = resolve_redirect("/new/path.zip", "cur.host", 8080).unwrap();
|
||||
assert_eq!(
|
||||
(h.as_str(), p, path.as_str()),
|
||||
("cur.host", 8080, "/new/path.zip")
|
||||
);
|
||||
|
||||
// Absolute http URL is followed normally.
|
||||
let (h, _, path) = resolve_redirect("http://other.host/x.zip", "cur.host", 80).unwrap();
|
||||
assert_eq!((h.as_str(), path.as_str()), ("other.host", "/x.zip"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_status_extracts_code() {
|
||||
assert_eq!(parse_status("HTTP/1.0 200 OK\r\nFoo: bar"), 200);
|
||||
assert_eq!(parse_status("HTTP/1.1 301 Moved Permanently"), 301);
|
||||
assert_eq!(parse_status("garbage"), 0);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user