|
|
@@ -1,445 +0,0 @@
|
|
|
-// Copyright (c) 2014 Sandstorm Development Group, Inc.
|
|
|
-// Licensed under the MIT License:
|
|
|
-//
|
|
|
-// Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
|
-// of this software and associated documentation files (the "Software"), to deal
|
|
|
-// in the Software without restriction, including without limitation the rights
|
|
|
-// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
|
-// copies of the Software, and to permit persons to whom the Software is
|
|
|
-// furnished to do so, subject to the following conditions:
|
|
|
-//
|
|
|
-// The above copyright notice and this permission notice shall be included in
|
|
|
-// all copies or substantial portions of the Software.
|
|
|
-//
|
|
|
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
|
-// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
-// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
|
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
|
-// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
|
-// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
|
-// THE SOFTWARE.
|
|
|
-
|
|
|
-// Hack around stdlib bug with C++14.
|
|
|
-#include <initializer_list> // force libstdc++ to include its config
|
|
|
-#undef _GLIBCXX_HAVE_GETS // correct broken config
|
|
|
-// End hack.
|
|
|
-
|
|
|
-#include <kj/main.h>
|
|
|
-#include <kj/debug.h>
|
|
|
-#include <kj/io.h>
|
|
|
-#include <kj/async-io.h>
|
|
|
-#include <capnp/rpc-twoparty.h>
|
|
|
-#include <capnp/serialize.h>
|
|
|
-#include <unistd.h>
|
|
|
-#include <stdlib.h>
|
|
|
-#include <stdio.h>
|
|
|
-#include <fcntl.h>
|
|
|
-#include <sys/types.h>
|
|
|
-#include <sys/stat.h>
|
|
|
-#include <dirent.h>
|
|
|
-#include <errno.h>
|
|
|
-
|
|
|
-#include <sandstorm/grain.capnp.h>
|
|
|
-#include <sandstorm/web-session.capnp.h>
|
|
|
-#include <sandstorm/hack-session.capnp.h>
|
|
|
-
|
|
|
-namespace {
|
|
|
-
|
|
|
-#if __QTCREATOR
|
|
|
-#define KJ_MVCAP(var) var
|
|
|
-// QtCreator dosen't understand C++14 syntax yet.
|
|
|
-#else
|
|
|
-#define KJ_MVCAP(var) var = ::kj::mv(var)
|
|
|
-// Capture the given variable by move. Place this in a lambda capture list. Requires C++14.
|
|
|
-//
|
|
|
-// TODO(cleanup): Move to libkj.
|
|
|
-#endif
|
|
|
-
|
|
|
-typedef unsigned int uint;
|
|
|
-typedef unsigned char byte;
|
|
|
-
|
|
|
-// =======================================================================================
|
|
|
-// Utility functions
|
|
|
-//
|
|
|
-// Most of these should be moved to the KJ library someday.
|
|
|
-
|
|
|
-kj::AutoCloseFd createFile(kj::StringPtr name, int flags, mode_t mode = 0666) {
|
|
|
- // Create a file, returning an RAII wrapper around the file descriptor. Errors throw exceptinos.
|
|
|
-
|
|
|
- int fd;
|
|
|
- KJ_SYSCALL(fd = open(name.cStr(), O_CREAT | flags, mode), name);
|
|
|
- return kj::AutoCloseFd(fd);
|
|
|
-}
|
|
|
-
|
|
|
-size_t getFileSize(int fd, kj::StringPtr filename) {
|
|
|
- struct stat stats;
|
|
|
- KJ_SYSCALL(fstat(fd, &stats));
|
|
|
- KJ_REQUIRE(S_ISREG(stats.st_mode), "Not a regular file.", filename);
|
|
|
- return stats.st_size;
|
|
|
-}
|
|
|
-
|
|
|
-kj::Maybe<kj::AutoCloseFd> tryOpen(kj::StringPtr name, int flags, mode_t mode = 0666) {
|
|
|
- // Try to open a file, returning an RAII wrapper around the file descriptor, or null if the
|
|
|
- // file doesn't exist. All other errors throw exceptions.
|
|
|
-
|
|
|
- int fd;
|
|
|
-
|
|
|
- while ((fd = open(name.cStr(), flags, mode)) < 0) {
|
|
|
- int error = errno;
|
|
|
- if (error == ENOENT) {
|
|
|
- return nullptr;
|
|
|
- } else if (error != EINTR) {
|
|
|
- KJ_FAIL_SYSCALL("open(name)", error, name);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- return kj::AutoCloseFd(fd);
|
|
|
-}
|
|
|
-
|
|
|
-bool isDirectory(kj::StringPtr filename) {
|
|
|
- // Return true if the parameter names a directory, false if it's any other kind of node or
|
|
|
- // doesn't exist.
|
|
|
-
|
|
|
- struct stat stats;
|
|
|
- while (stat(filename.cStr(), &stats) < 0) {
|
|
|
- if (errno != EINTR) {
|
|
|
- return false;
|
|
|
- }
|
|
|
- }
|
|
|
- return S_ISDIR(stats.st_mode);
|
|
|
-}
|
|
|
-
|
|
|
-kj::Vector<kj::String> listDirectory(kj::StringPtr dirname) {
|
|
|
- // Return a list of all filenames in the given directory, except "." and "..".
|
|
|
-
|
|
|
- kj::Vector<kj::String> entries;
|
|
|
-
|
|
|
- DIR* dir = opendir(dirname.cStr());
|
|
|
- if (dir == nullptr) {
|
|
|
- KJ_FAIL_SYSCALL("opendir", errno, dirname);
|
|
|
- }
|
|
|
- KJ_DEFER(closedir(dir));
|
|
|
-
|
|
|
- for (;;) {
|
|
|
- errno = 0;
|
|
|
- struct dirent* entry = readdir(dir);
|
|
|
- if (entry == nullptr) {
|
|
|
- int error = errno;
|
|
|
- if (error == 0) {
|
|
|
- break;
|
|
|
- } else {
|
|
|
- KJ_FAIL_SYSCALL("readdir", error, dirname);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- kj::StringPtr name = entry->d_name;
|
|
|
- if (name != "." && name != "..") {
|
|
|
- entries.add(kj::heapString(entry->d_name));
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- return entries;
|
|
|
-}
|
|
|
-
|
|
|
-// =======================================================================================
|
|
|
-// WebSession implementation (interface declared in sandstorm/web-session.capnp)
|
|
|
-
|
|
|
-class WebSessionImpl final: public sandstorm::WebSession::Server {
|
|
|
-public:
|
|
|
- WebSessionImpl(sandstorm::UserInfo::Reader userInfo,
|
|
|
- sandstorm::SessionContext::Client context,
|
|
|
- sandstorm::WebSession::Params::Reader params) {
|
|
|
- // Permission #0 is "write". Check if bit 0 in the PermissionSet is set.
|
|
|
- auto permissions = userInfo.getPermissions();
|
|
|
- canWrite = permissions.size() > 0 && (permissions[0] & 1);
|
|
|
-
|
|
|
- // `UserInfo` is defined in `sandstorm/grain.capnp` and contains info like:
|
|
|
- // - A stable ID for the user, so you can correlate sessions from the same user.
|
|
|
- // - The user's display name, e.g. "Mark Miller", useful for identifying the user to other
|
|
|
- // users.
|
|
|
- // - The user's permissions (seen above).
|
|
|
-
|
|
|
- // `WebSession::Params` is defined in `sandstorm/web-session.capnp` and contains info like:
|
|
|
- // - The hostname where the grain was mapped for this user. Every time a user opens a grain,
|
|
|
- // it is mapped at a new random hostname for security reasons.
|
|
|
- // - The user's User-Agent and Accept-Languages headers.
|
|
|
-
|
|
|
- // `SessionContext` is defined in `sandstorm/grain.capnp` and implements callbacks for
|
|
|
- // sharing/access control and service publishing/discovery.
|
|
|
- }
|
|
|
-
|
|
|
- kj::Promise<void> get(GetContext context) override {
|
|
|
- // HTTP GET request.
|
|
|
-
|
|
|
- auto path = context.getParams().getPath();
|
|
|
- requireCanonicalPath(path);
|
|
|
-
|
|
|
- if (path == "var" || path == "var/") {
|
|
|
- // Return a listing of the directory contents, one per line.
|
|
|
- auto text = kj::strArray(listDirectory("var"), "\n");
|
|
|
- auto response = context.getResults().initContent();
|
|
|
- response.setMimeType("text/plain");
|
|
|
- response.getBody().setBytes(
|
|
|
- kj::arrayPtr(reinterpret_cast<byte*>(text.begin()), text.size()));
|
|
|
- return kj::READY_NOW;
|
|
|
- } else if (path.startsWith("var/")) {
|
|
|
- // Serve all files under /var with type application/octet-stream since it comes from the
|
|
|
- // user. E.g. serving as "text/html" here would allow someone to trivially XSS other users
|
|
|
- // of the grain by PUTing malicious HTML content. (Such an attack wouldn't be a huge deal:
|
|
|
- // it would only allow the attacker to hijack another user's access to this grain, not to
|
|
|
- // Sandstorm in general, and if they attacker already has write access to upload the
|
|
|
- // malicious content, they have little to gain from hijacking another session.)
|
|
|
- return readFile(path, context, "application/octet-stream");
|
|
|
- } else if (path == ".can-write") {
|
|
|
- // Fetch "/.can-write" to determine if the user has write permission, so you can show them
|
|
|
- // a different UI if not.
|
|
|
- auto response = context.getResults().initContent();
|
|
|
- response.setMimeType("text/plain");
|
|
|
- response.getBody().setBytes(kj::str(canWrite).asBytes());
|
|
|
- return kj::READY_NOW;
|
|
|
- } else if (path == "" || path.endsWith("/")) {
|
|
|
- // A directory. Serve "index.html".
|
|
|
- return readFile(kj::str("client/", path, "ssindex.html"), context, "text/html; charset=UTF-8");
|
|
|
- } else {
|
|
|
- // Request for a static file. Look for it under "client/".
|
|
|
- auto filename = kj::str("client/", path);
|
|
|
-
|
|
|
- // Check if it's a directory.
|
|
|
- if (isDirectory(filename)) {
|
|
|
- // It is. Return redirect to add '/'.
|
|
|
- auto redirect = context.getResults().initRedirect();
|
|
|
- redirect.setIsPermanent(true);
|
|
|
- redirect.setSwitchToGet(true);
|
|
|
- redirect.setLocation(kj::str(path, '/'));
|
|
|
- return kj::READY_NOW;
|
|
|
- }
|
|
|
-
|
|
|
- // Regular file (or non-existent).
|
|
|
- return readFile(kj::mv(filename), context, inferContentType(path));
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- kj::Promise<void> put(PutContext context) override {
|
|
|
- // HTTP PUT request.
|
|
|
-
|
|
|
- auto params = context.getParams();
|
|
|
- auto path = params.getPath();
|
|
|
- requireCanonicalPath(path);
|
|
|
-
|
|
|
- KJ_REQUIRE(path.startsWith("var/"), "PUT only supported under /var.");
|
|
|
-
|
|
|
- if (!canWrite) {
|
|
|
- context.getResults().initClientError()
|
|
|
- .setStatusCode(sandstorm::WebSession::Response::ClientErrorCode::FORBIDDEN);
|
|
|
- } else {
|
|
|
- auto tempPath = kj::str(path, ".uploading");
|
|
|
- auto data = params.getContent().getContent();
|
|
|
-
|
|
|
- kj::FdOutputStream(createFile(tempPath, O_WRONLY | O_TRUNC))
|
|
|
- .write(data.begin(), data.size());
|
|
|
-
|
|
|
- KJ_SYSCALL(rename(tempPath.cStr(), path.cStr()));
|
|
|
- context.getResults().initNoContent();
|
|
|
- }
|
|
|
-
|
|
|
- return kj::READY_NOW;
|
|
|
- }
|
|
|
-
|
|
|
- kj::Promise<void> delete_(DeleteContext context) override {
|
|
|
- // HTTP DELETE request.
|
|
|
-
|
|
|
- auto path = context.getParams().getPath();
|
|
|
- requireCanonicalPath(path);
|
|
|
-
|
|
|
- KJ_REQUIRE(path.startsWith("var/"), "DELETE only supported under /var.");
|
|
|
-
|
|
|
- if (!canWrite) {
|
|
|
- context.getResults().initClientError()
|
|
|
- .setStatusCode(sandstorm::WebSession::Response::ClientErrorCode::FORBIDDEN);
|
|
|
- } else {
|
|
|
- while (unlink(path.cStr()) != 0) {
|
|
|
- int error = errno;
|
|
|
- if (error == ENOENT) {
|
|
|
- // Ignore file-not-found for idempotency.
|
|
|
- break;
|
|
|
- } else if (error != EINTR) {
|
|
|
- KJ_FAIL_SYSCALL("unlink", error);
|
|
|
- }
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- return kj::READY_NOW;
|
|
|
- }
|
|
|
-
|
|
|
-private:
|
|
|
- bool canWrite;
|
|
|
- // True if the user has write permission.
|
|
|
-
|
|
|
- void requireCanonicalPath(kj::StringPtr path) {
|
|
|
- // Require that the path doesn't contain "." or ".." or consecutive slashes, to prevent path
|
|
|
- // injection attacks.
|
|
|
- //
|
|
|
- // Note that such attacks wouldn't actually accomplish much since everything outside /var
|
|
|
- // is a read-only filesystem anyway, containing the app package contents which are non-secret.
|
|
|
-
|
|
|
- KJ_REQUIRE(!path.startsWith("/"));
|
|
|
- KJ_REQUIRE(!path.startsWith("./") && path != ".");
|
|
|
- KJ_REQUIRE(!path.startsWith("../") && path != "..");
|
|
|
-
|
|
|
- KJ_IF_MAYBE(slashPos, path.findFirst('/')) {
|
|
|
- requireCanonicalPath(path.slice(*slashPos + 1));
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- kj::StringPtr inferContentType(kj::StringPtr filename) {
|
|
|
- if (filename.endsWith(".html")) {
|
|
|
- return "text/html; charset=UTF-8";
|
|
|
- } else if (filename.endsWith(".js")) {
|
|
|
- return "text/javascript; charset=UTF-8";
|
|
|
- } else if (filename.endsWith(".css")) {
|
|
|
- return "text/css; charset=UTF-8";
|
|
|
- } else if (filename.endsWith(".png")) {
|
|
|
- return "image/png";
|
|
|
- } else if (filename.endsWith(".gif")) {
|
|
|
- return "image/gif";
|
|
|
- } else if (filename.endsWith(".jpg") || filename.endsWith(".jpeg")) {
|
|
|
- return "image/jpeg";
|
|
|
- } else if (filename.endsWith(".svg")) {
|
|
|
- return "image/svg+xml; charset=UTF-8";
|
|
|
- } else if (filename.endsWith(".txt")) {
|
|
|
- return "text/plain; charset=UTF-8";
|
|
|
- } else {
|
|
|
- return "application/octet-stream";
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- kj::Promise<void> readFile(
|
|
|
- kj::StringPtr filename, GetContext context, kj::StringPtr contentType) {
|
|
|
- // Do we support compression?
|
|
|
- bool canGzip = false;
|
|
|
- for (auto accept: context.getParams().getContext().getAcceptEncoding()) {
|
|
|
- if (accept.getContentCoding() == "gzip") {
|
|
|
- canGzip = true;
|
|
|
- break;
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- // If compression is supported, look for file with .gz extension.
|
|
|
- kj::Maybe<kj::AutoCloseFd> maybeFd;
|
|
|
- bool isGzipped = false;
|
|
|
- if (canGzip) {
|
|
|
- maybeFd = tryOpen(kj::str(filename, ".gz"), O_RDONLY);
|
|
|
- isGzipped = maybeFd != nullptr;
|
|
|
- }
|
|
|
-
|
|
|
- // If we haven't found a suitable file yet, look for the uncompressed version.
|
|
|
- if (maybeFd == nullptr) {
|
|
|
- maybeFd = tryOpen(filename, O_RDONLY);
|
|
|
- }
|
|
|
-
|
|
|
- // Serve it.
|
|
|
- KJ_IF_MAYBE(fd, kj::mv(maybeFd)) {
|
|
|
- auto size = getFileSize(*fd, filename);
|
|
|
- kj::FdInputStream stream(kj::mv(*fd));
|
|
|
- auto response = context.getResults(capnp::MessageSize { size / sizeof(capnp::word) + 32, 0 });
|
|
|
- auto content = response.initContent();
|
|
|
- content.setStatusCode(sandstorm::WebSession::Response::SuccessCode::OK);
|
|
|
- content.setMimeType(contentType);
|
|
|
- if (isGzipped) {
|
|
|
- content.setEncoding("gzip");
|
|
|
- }
|
|
|
- stream.read(content.getBody().initBytes(size).begin(), size);
|
|
|
- return kj::READY_NOW;
|
|
|
- } else {
|
|
|
- auto error = context.getResults().initClientError();
|
|
|
- error.setStatusCode(sandstorm::WebSession::Response::ClientErrorCode::NOT_FOUND);
|
|
|
- return kj::READY_NOW;
|
|
|
- }
|
|
|
- }
|
|
|
-};
|
|
|
-
|
|
|
-// =======================================================================================
|
|
|
-// UiView implementation (interface declared in sandstorm/grain.capnp)
|
|
|
-
|
|
|
-class UiViewImpl final: public sandstorm::UiView::Server {
|
|
|
-public:
|
|
|
- kj::Promise<void> getViewInfo(GetViewInfoContext context) override {
|
|
|
- auto viewInfo = context.initResults();
|
|
|
-
|
|
|
- // Define a "write" permission, and then define roles "editor" and "viewer" where only "editor"
|
|
|
- // has the "write" permission. This will allow people to share read-only.
|
|
|
- auto perms = viewInfo.initPermissions(1);
|
|
|
- perms[0].setName("write");
|
|
|
- auto write = perms[0];
|
|
|
- write.setName("write");
|
|
|
- write.initTitle().setDefaultText("write");
|
|
|
-
|
|
|
- auto roles = viewInfo.initRoles(2);
|
|
|
- auto editor = roles[0];
|
|
|
- editor.initTitle().setDefaultText("editor");
|
|
|
- editor.initVerbPhrase().setDefaultText("can edit");
|
|
|
- editor.initPermissions(1).set(0, true); // has "write" permission
|
|
|
- auto viewer = roles[1];
|
|
|
- viewer.initTitle().setDefaultText("viewer");
|
|
|
- viewer.initVerbPhrase().setDefaultText("can view");
|
|
|
- viewer.initPermissions(1).set(0, false); // does not have "write" permission
|
|
|
-
|
|
|
- return kj::READY_NOW;
|
|
|
- }
|
|
|
-
|
|
|
- kj::Promise<void> newSession(NewSessionContext context) override {
|
|
|
- auto params = context.getParams();
|
|
|
-
|
|
|
- KJ_REQUIRE(params.getSessionType() == capnp::typeId<sandstorm::WebSession>(),
|
|
|
- "Unsupported session type.");
|
|
|
-
|
|
|
- context.getResults().setSession(
|
|
|
- kj::heap<WebSessionImpl>(params.getUserInfo(), params.getContext(),
|
|
|
- params.getSessionParams().getAs<sandstorm::WebSession::Params>()));
|
|
|
-
|
|
|
- return kj::READY_NOW;
|
|
|
- }
|
|
|
-};
|
|
|
-
|
|
|
-// =======================================================================================
|
|
|
-// Program main
|
|
|
-
|
|
|
-class ServerMain {
|
|
|
-public:
|
|
|
- ServerMain(kj::ProcessContext& context): context(context), ioContext(kj::setupAsyncIo()) {}
|
|
|
-
|
|
|
- kj::MainFunc getMain() {
|
|
|
- return kj::MainBuilder(context, "Sandstorm Thin Server",
|
|
|
- "Intended to be run as the root process of a Sandstorm app.")
|
|
|
- .callAfterParsing(KJ_BIND_METHOD(*this, run))
|
|
|
- .build();
|
|
|
- }
|
|
|
-
|
|
|
- kj::MainBuilder::Validity run() {
|
|
|
- // Set up RPC on file descriptor 3.
|
|
|
- auto stream = ioContext.lowLevelProvider->wrapSocketFd(3);
|
|
|
- capnp::TwoPartyVatNetwork network(*stream, capnp::rpc::twoparty::Side::CLIENT);
|
|
|
- auto rpcSystem = capnp::makeRpcServer(network, kj::heap<UiViewImpl>());
|
|
|
-
|
|
|
- // Get the SandstormApi default capability from the supervisor.
|
|
|
- // TODO(soon): We don't use this, but for some reason the connection doesn't come up if we
|
|
|
- // don't do this restore. Cap'n Proto bug? v8capnp bug? Shell bug?
|
|
|
- {
|
|
|
- capnp::MallocMessageBuilder message;
|
|
|
- auto vatId = message.getRoot<capnp::rpc::twoparty::VatId>();
|
|
|
- vatId.setSide(capnp::rpc::twoparty::Side::SERVER);
|
|
|
- sandstorm::SandstormApi<>::Client api =
|
|
|
- rpcSystem.bootstrap(vatId).castAs<sandstorm::SandstormApi<>>();
|
|
|
- }
|
|
|
-
|
|
|
- kj::NEVER_DONE.wait(ioContext.waitScope);
|
|
|
- }
|
|
|
-
|
|
|
-private:
|
|
|
- kj::ProcessContext& context;
|
|
|
- kj::AsyncIoContext ioContext;
|
|
|
-};
|
|
|
-
|
|
|
-} // anonymous namespace
|
|
|
-
|
|
|
-KJ_MAIN(ServerMain)
|
David Benson
