Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dashcaddy-polish
|
a7260436d1 | ||
|
Hermes
|
a4e4b24732 | ||
|
Hermes
|
0086de97da |
@@ -18,7 +18,11 @@ function createDiscoverApp(docker, servicesStateManager) {
|
||||
|
||||
function createDisasterApp(platformPaths, log) {
|
||||
const app = express();
|
||||
app.use(express.json());
|
||||
// Match the production body-parser limit (1 MiB) so the in-handler
|
||||
// DC-079 cap (512 KiB) is actually reachable from tests. The default
|
||||
// express.json() limit is 100 KiB, which would short-circuit the test
|
||||
// with a 413 before the route's defense-in-depth check runs.
|
||||
app.use(express.json({ limit: '1mb' }));
|
||||
const routes = require('../../routes/disaster-recovery');
|
||||
const wrap = (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
|
||||
app.use('/api/v1', routes({ platformPaths, log: log || { info: jest.fn(), error: jest.fn() }, asyncHandler: wrap }));
|
||||
@@ -135,4 +139,267 @@ describe('DC-107: Disaster Recovery', () => {
|
||||
const svc = JSON.parse(fs.readFileSync(path.join(tmpDir, 'services.json'), 'utf8'));
|
||||
expect(svc[0].id).toBe('restored-svc');
|
||||
});
|
||||
|
||||
// DC-079: Caddyfile restore hardening — the live Caddyfile path must
|
||||
// NEVER be written from the disaster-recovery endpoint. The endpoint
|
||||
// stages the candidate file under dataDir/disaster-staged/Caddyfile.candidate
|
||||
// and surfaces a warning that `caddy-apply` is required to apply it.
|
||||
it('DC-079: POST /disaster/restore with caddyfile STAGES instead of writing the live Caddyfile', async () => {
|
||||
// The env var CADDYFILE_PATH is read by the route. Use a sentinel
|
||||
// path that we can prove was NOT written. The route must instead
|
||||
// create <dataDir>/disaster-staged/Caddyfile.candidate.
|
||||
const liveSentinel = path.join(tmpDir, 'LIVE_CADDYFILE_SENTINEL.txt');
|
||||
fs.writeFileSync(liveSentinel, 'do-not-overwrite');
|
||||
|
||||
const candidateCaddyfile =
|
||||
'# staged candidate\n' +
|
||||
'example.com {\n' +
|
||||
' respond "ok"\n' +
|
||||
'}\n';
|
||||
|
||||
const app = createDisasterApp({
|
||||
dataDir: tmpDir,
|
||||
caddyfilePath: liveSentinel, // route reads env or fallback; this is just for the response
|
||||
});
|
||||
// Override process.env.CADDYFILE_PATH so the route picks up our sentinel
|
||||
const prev = process.env.CADDYFILE_PATH;
|
||||
process.env.CADDYFILE_PATH = liveSentinel;
|
||||
try {
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
caddyfile: candidateCaddyfile,
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.status).toBe('success');
|
||||
expect(res.body.caddyfileStaged).toBeTruthy();
|
||||
expect(res.body.caddyfileStaged).toHaveLength(1);
|
||||
expect(res.body.caddyfileStaged[0].file).toBe('Caddyfile');
|
||||
expect(res.body.caddyfileStaged[0].action).toBe('awaiting caddy-apply');
|
||||
expect(res.body.caddyfileStaged[0].stagedPath).toBe(
|
||||
path.join(tmpDir, 'disaster-staged', 'Caddyfile.candidate')
|
||||
);
|
||||
expect(res.body.caddyfileStaged[0].livePath).toBe(liveSentinel);
|
||||
expect(res.body.warning).toMatch(/DC-079/);
|
||||
|
||||
// The live sentinel file is UNTOUCHED — still has its original content.
|
||||
const liveContents = fs.readFileSync(liveSentinel, 'utf8');
|
||||
expect(liveContents).toBe('do-not-overwrite');
|
||||
|
||||
// The candidate file IS staged at the staging path.
|
||||
const stagedContents = fs.readFileSync(
|
||||
path.join(tmpDir, 'disaster-staged', 'Caddyfile.candidate'),
|
||||
'utf8'
|
||||
);
|
||||
expect(stagedContents).toBe(candidateCaddyfile);
|
||||
} finally {
|
||||
if (prev === undefined) delete process.env.CADDYFILE_PATH;
|
||||
else process.env.CADDYFILE_PATH = prev;
|
||||
}
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects non-string caddyfile content', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
caddyfile: { evil: 'object' },
|
||||
});
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/Caddyfile content must be a string/);
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects explicit empty caddyfile string', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
caddyfile: '', // explicit empty payload — rejected
|
||||
});
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/Caddyfile content is empty/);
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects oversized caddyfile content', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
// 512 KiB + 1 byte — over the in-handler cap, under the 1 MB body limit
|
||||
const huge = 'a'.repeat(512 * 1024 + 1);
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
caddyfile: huge,
|
||||
});
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/exceeds 524288 bytes/);
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects forbidden `import` directive (absolute path)', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const evil =
|
||||
'# malicious snapshot\n' +
|
||||
'import /etc/caddy/external.caddy\n' +
|
||||
'example.com { respond "ok" }\n';
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
caddyfile: evil,
|
||||
});
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/forbidden `import` directive/);
|
||||
|
||||
// No staging file should have been created — fail closed.
|
||||
expect(fs.existsSync(path.join(tmpDir, 'disaster-staged', 'Caddyfile.candidate'))).toBe(false);
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects forbidden `import` with relative-path escape', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const evil =
|
||||
'# malicious snapshot\n' +
|
||||
'import ../../../etc/passwd\n' +
|
||||
'example.com { respond "ok" }\n';
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
caddyfile: evil,
|
||||
});
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/forbidden `import` directive/);
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects URL-encoded import payload', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const evil =
|
||||
'import %2fetc%2fcaddy%2fevil.caddy\n' +
|
||||
'example.com { respond "ok" }\n';
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
caddyfile: evil,
|
||||
});
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.error).toMatch(/forbidden `import` directive/);
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore without caddyfile field succeeds and stages nothing', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
files: {
|
||||
services: [{ id: 'no-caddy' }],
|
||||
},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.caddyfileStaged).toBeUndefined();
|
||||
expect(res.body.warning).toBeUndefined();
|
||||
});
|
||||
|
||||
// DC-079 follow-up (GLM round-2 BLOCKING): assets/themes path traversal.
|
||||
// Without the assertSafeAssetKey / assertSafeThemeName + path.resolve
|
||||
// checks, an attacker can POST `{assets: {"../../etc/caddy/Caddyfile":
|
||||
// "<base64-evil>"}}` and overwrite the live Caddyfile via the dataDir
|
||||
// bind-mount. These tests prove the fix.
|
||||
it('DC-079: POST /disaster/restore rejects assets with path-traversal key', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
assets: {
|
||||
'../../etc/caddy/Caddyfile': Buffer.from('EVIL_BASE64_PAYLOAD').toString('base64'),
|
||||
'custom-logo.png': Buffer.from('legit-logo').toString('base64'),
|
||||
},
|
||||
});
|
||||
|
||||
// The traversal key is rejected (added to errors), the legit key
|
||||
// still works. Status is success-or-partial, never 500.
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.status).toBe('partial'); // one error
|
||||
const erroredFile = res.body.errors.find(e => e.file && e.file.includes('../../etc/caddy/Caddyfile'));
|
||||
expect(erroredFile).toBeTruthy();
|
||||
expect(erroredFile.error).toMatch(/forbidden characters or path segments/);
|
||||
|
||||
// The legit logo DID get written.
|
||||
const legitPath = path.join(tmpDir, 'assets', 'custom-logo.png');
|
||||
expect(fs.existsSync(legitPath)).toBe(true);
|
||||
|
||||
// The traversal target was NEVER written.
|
||||
const escapePath = path.join(tmpDir, 'assets', '../../etc/caddy/Caddyfile');
|
||||
// Resolve to absolute path — should be outside tmpDir/assets.
|
||||
const resolvedEsc = path.resolve(escapePath);
|
||||
expect(fs.existsSync(resolvedEsc)).toBe(false);
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects assets with absolute path key', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
assets: {
|
||||
'/etc/passwd': Buffer.from('evil').toString('base64'),
|
||||
},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.status).toBe('partial');
|
||||
const erroredFile = res.body.errors.find(e => e.file && e.file.includes('/etc/passwd'));
|
||||
expect(erroredFile).toBeTruthy();
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects themes with path-traversal name', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
themes: {
|
||||
'../../../etc/caddy/evil.json': { evil: true },
|
||||
'legit-theme.json': { ok: true },
|
||||
},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.status).toBe('partial');
|
||||
const erroredFile = res.body.errors.find(e => e.file && e.file.includes('../../../etc/caddy/evil.json'));
|
||||
expect(erroredFile).toBeTruthy();
|
||||
expect(erroredFile.error).toMatch(/must match/);
|
||||
|
||||
// The legit theme DID get written.
|
||||
expect(fs.existsSync(path.join(tmpDir, 'themes', 'legit-theme.json'))).toBe(true);
|
||||
});
|
||||
|
||||
it('DC-079: POST /disaster/restore rejects themes without .json extension', async () => {
|
||||
const app = createDisasterApp({ dataDir: tmpDir });
|
||||
const res = await request(app)
|
||||
.post('/api/v1/disaster/restore')
|
||||
.send({
|
||||
version: '1.0',
|
||||
themes: {
|
||||
'no-extension': { ok: true },
|
||||
},
|
||||
});
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.status).toBe('partial');
|
||||
const erroredFile = res.body.errors.find(e => e.file && e.file.includes('no-extension'));
|
||||
expect(erroredFile).toBeTruthy();
|
||||
expect(erroredFile.error).toMatch(/must match/);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -125,6 +125,239 @@ describe('UpdateManager — Docker image update lifecycle', () => {
|
||||
});
|
||||
});
|
||||
|
||||
// ─── DC-078: registry digest probe reliability hardening ──────────────────
|
||||
// Verifies that getLatestImageDigest / getDockerHubDigest / getGhcrDigest /
|
||||
// fetchWithReliability all apply the IPv4-only + timeout + transient-retry
|
||||
// policy. Without these guards, the per-hour checkForUpdates() loop on DNS2
|
||||
// surfaces AggregateError [ETIMEDOUT] in error.log because the container's
|
||||
// /etc/resolv.conf returns AAAA records from Technitium whose IPv6 path to
|
||||
// public registries (Docker Hub, ghcr.io) is intermittently unreachable.
|
||||
describe('DC-078 registry reliability', () => {
|
||||
// Use real timers — fetchWithReliability's retry uses setTimeout for
|
||||
// backoff, which jest's fake timers would block indefinitely.
|
||||
beforeEach(() => {
|
||||
jest.useRealTimers();
|
||||
});
|
||||
afterEach(() => {
|
||||
jest.useFakeTimers({ doNotFake: ['setImmediate', 'queueMicrotask', 'nextTick'] });
|
||||
});
|
||||
|
||||
it('_httpsRequestOnce sets family: 4 and timeout on the request options', async () => {
|
||||
let capturedOptions = null;
|
||||
const req = {
|
||||
on: jest.fn(),
|
||||
end: jest.fn(),
|
||||
destroy: jest.fn(),
|
||||
};
|
||||
https.request.mockImplementation((options, cb) => {
|
||||
capturedOptions = options;
|
||||
// Return a 200 immediately so the promise resolves cleanly.
|
||||
const res = {
|
||||
statusCode: 200,
|
||||
headers: {},
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
}),
|
||||
};
|
||||
setImmediate(() => cb(res));
|
||||
return req;
|
||||
});
|
||||
|
||||
await updateManager._httpsRequestOnce({
|
||||
hostname: 'registry-1.docker.io',
|
||||
path: '/v2/library/nginx/manifests/latest',
|
||||
headers: { Accept: 'application/vnd.docker.distribution.manifest.v2+json' },
|
||||
maxBodyBytes: 65536,
|
||||
});
|
||||
expect(capturedOptions).not.toBeNull();
|
||||
expect(capturedOptions.family).toBe(4);
|
||||
expect(capturedOptions.timeout).toBeGreaterThan(0);
|
||||
expect(capturedOptions.method).toBe('GET');
|
||||
});
|
||||
|
||||
it('fetchWithReliability retries on transient ETIMEDOUT and eventually succeeds', async () => {
|
||||
let attempts = 0;
|
||||
https.request.mockImplementation((options, cb) => {
|
||||
attempts += 1;
|
||||
if (attempts === 1) {
|
||||
// First attempt: emit ETIMEDOUT via the request 'error' event
|
||||
const reqErr = new Error('request timeout');
|
||||
reqErr.code = 'ETIMEDOUT';
|
||||
const req = {
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'error') setImmediate(() => handler(reqErr));
|
||||
}),
|
||||
end: jest.fn(),
|
||||
destroy: jest.fn(),
|
||||
};
|
||||
return req;
|
||||
}
|
||||
// Second attempt: 200 OK with a digest header
|
||||
const res = {
|
||||
statusCode: 200,
|
||||
headers: { 'docker-content-digest': 'sha256:abc123def456' },
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
}),
|
||||
};
|
||||
setImmediate(() => cb(res));
|
||||
return { on: jest.fn(), end: jest.fn(), destroy: jest.fn() };
|
||||
});
|
||||
|
||||
const result = await updateManager.fetchWithReliability({
|
||||
hostname: 'registry-1.docker.io',
|
||||
path: '/v2/library/nginx/manifests/latest',
|
||||
});
|
||||
expect(attempts).toBe(2);
|
||||
expect(result.statusCode).toBe(200);
|
||||
expect(result.headers['docker-content-digest']).toBe('sha256:abc123def456');
|
||||
});
|
||||
|
||||
it('fetchWithReliability does NOT retry on non-transient HTTP errors', async () => {
|
||||
let attempts = 0;
|
||||
https.request.mockImplementation((options, cb) => {
|
||||
attempts += 1;
|
||||
const res = {
|
||||
statusCode: 500,
|
||||
headers: {},
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
}),
|
||||
};
|
||||
setImmediate(() => cb(res));
|
||||
return { on: jest.fn(), end: jest.fn(), destroy: jest.fn() };
|
||||
});
|
||||
const result = await updateManager.fetchWithReliability({
|
||||
hostname: 'registry-1.docker.io',
|
||||
path: '/v2/library/nginx/manifests/latest',
|
||||
});
|
||||
expect(attempts).toBe(1);
|
||||
expect(result.statusCode).toBe(500);
|
||||
});
|
||||
|
||||
it('fetchWithReliability retries up to REGISTRY_MAX_RETRIES then throws', async () => {
|
||||
let attempts = 0;
|
||||
https.request.mockImplementation(() => {
|
||||
attempts += 1;
|
||||
const reqErr = new Error('connect ETIMEDOUT');
|
||||
reqErr.code = 'ETIMEDOUT';
|
||||
const req = {
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'error') setImmediate(() => handler(reqErr));
|
||||
}),
|
||||
end: jest.fn(),
|
||||
destroy: jest.fn(),
|
||||
};
|
||||
return req;
|
||||
});
|
||||
await expect(updateManager.fetchWithReliability({
|
||||
hostname: 'registry-1.docker.io',
|
||||
path: '/v2/library/nginx/manifests/latest',
|
||||
})).rejects.toMatchObject({ code: 'ETIMEDOUT' });
|
||||
// 1 initial attempt + REGISTRY_MAX_RETRIES retries
|
||||
expect(attempts).toBe(1 + 1);
|
||||
});
|
||||
|
||||
it('getDockerHubDigest returns digest on 200', async () => {
|
||||
https.request.mockImplementation((options, cb) => {
|
||||
const res = {
|
||||
statusCode: 200,
|
||||
headers: { 'docker-content-digest': 'sha256:hubdigest9999' },
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
}),
|
||||
};
|
||||
setImmediate(() => cb(res));
|
||||
return { on: jest.fn(), end: jest.fn(), destroy: jest.fn() };
|
||||
});
|
||||
const digest = await updateManager.getDockerHubDigest('nginx', 'latest');
|
||||
expect(digest).toBe('sha256:hubdigest9999');
|
||||
});
|
||||
|
||||
it('getDockerHubDigest acquires bearer token on 401 then returns digest', async () => {
|
||||
let calls = 0;
|
||||
https.request.mockImplementation((options, cb) => {
|
||||
calls += 1;
|
||||
if (calls === 1) {
|
||||
// First call to registry-1.docker.io returns 401 with WWW-Authenticate
|
||||
const res = {
|
||||
statusCode: 401,
|
||||
headers: {
|
||||
'www-authenticate': 'Bearer realm="https://auth.example.com/token",service="registry.docker.io",scope="repository:library/nginx:pull"',
|
||||
},
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
}),
|
||||
};
|
||||
setImmediate(() => cb(res));
|
||||
} else if (calls === 2) {
|
||||
// Second call: auth.example.com returns the token JSON
|
||||
const res = {
|
||||
statusCode: 200,
|
||||
headers: {},
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'data') handler(Buffer.from(JSON.stringify({ token: 'jwt-token-xyz' })));
|
||||
if (event === 'end') setImmediate(handler);
|
||||
}),
|
||||
};
|
||||
setImmediate(() => cb(res));
|
||||
} else {
|
||||
// Third call: registry-1.docker.io with Bearer header returns the digest
|
||||
expect(options.headers['Authorization']).toBe('Bearer jwt-token-xyz');
|
||||
const res = {
|
||||
statusCode: 200,
|
||||
headers: { 'docker-content-digest': 'sha256:autheddigest7777' },
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
}),
|
||||
};
|
||||
setImmediate(() => cb(res));
|
||||
}
|
||||
return { on: jest.fn(), end: jest.fn(), destroy: jest.fn() };
|
||||
});
|
||||
const digest = await updateManager.getDockerHubDigest('nginx', 'latest');
|
||||
expect(digest).toBe('sha256:autheddigest7777');
|
||||
expect(calls).toBe(3);
|
||||
});
|
||||
|
||||
it('getGhcrDigest returns digest on 200', async () => {
|
||||
https.request.mockImplementation((options, cb) => {
|
||||
expect(options.hostname).toBe('ghcr.io');
|
||||
const res = {
|
||||
statusCode: 200,
|
||||
headers: { 'docker-content-digest': 'sha256:ghcrdigest1234' },
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
}),
|
||||
};
|
||||
setImmediate(() => cb(res));
|
||||
return { on: jest.fn(), end: jest.fn(), destroy: jest.fn() };
|
||||
});
|
||||
const digest = await updateManager.getGhcrDigest('ghcr.io/some/repo', 'latest');
|
||||
expect(digest).toBe('sha256:ghcrdigest1234');
|
||||
});
|
||||
|
||||
it('getLatestImageDigest returns null on transient errors after retries (registry unavailable)', async () => {
|
||||
// Simulate a totally-down registry: every attempt fails with ETIMEDOUT.
|
||||
// After REGISTRY_MAX_RETRIES the error propagates to getLatestImageDigest's
|
||||
// catch arm, which logs and returns null (matches old behavior).
|
||||
https.request.mockImplementation(() => {
|
||||
const reqErr = new Error('connect ETIMEDOUT');
|
||||
reqErr.code = 'ETIMEDOUT';
|
||||
const req = {
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'error') setImmediate(() => handler(reqErr));
|
||||
}),
|
||||
end: jest.fn(),
|
||||
destroy: jest.fn(),
|
||||
};
|
||||
return req;
|
||||
});
|
||||
const digest = await updateManager.getLatestImageDigest('nginx:latest');
|
||||
expect(digest).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
describe('parseAuthHeader', () => {
|
||||
it('parses Docker Hub Bearer auth header', () => {
|
||||
const header = 'Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:library/nginx:pull"';
|
||||
@@ -481,7 +714,9 @@ describe('UpdateManager — Docker image update lifecycle', () => {
|
||||
setImmediate(() => cb({
|
||||
statusCode: 200,
|
||||
headers: { 'docker-content-digest': 'sha256:fromregistry' },
|
||||
on: jest.fn()
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
})
|
||||
}));
|
||||
return { on: jest.fn(), end: jest.fn() };
|
||||
});
|
||||
@@ -495,7 +730,9 @@ describe('UpdateManager — Docker image update lifecycle', () => {
|
||||
setImmediate(() => cb({
|
||||
statusCode: 401,
|
||||
headers: {},
|
||||
on: jest.fn()
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
})
|
||||
}));
|
||||
return { on: jest.fn(), end: jest.fn() };
|
||||
});
|
||||
@@ -504,6 +741,9 @@ describe('UpdateManager — Docker image update lifecycle', () => {
|
||||
});
|
||||
|
||||
it('rejects on https request error', async () => {
|
||||
// ECONNREFUSED is in REGISTRY_TRANSIENT_ERROR_CODES, so this would retry.
|
||||
// Use a non-transient code (or no code) for the test to propagate.
|
||||
jest.useRealTimers();
|
||||
https.request.mockImplementation(() => {
|
||||
const req = { on: jest.fn(), end: jest.fn() };
|
||||
// Trigger error event asynchronously
|
||||
@@ -516,6 +756,7 @@ describe('UpdateManager — Docker image update lifecycle', () => {
|
||||
|
||||
await expect(updateManager.getDockerHubDigest('nginx', 'latest'))
|
||||
.rejects.toThrow('connection refused');
|
||||
jest.useFakeTimers({ doNotFake: ['setImmediate', 'queueMicrotask', 'nextTick'] });
|
||||
});
|
||||
|
||||
it('normalizes library/ prefix for official images', async () => {
|
||||
@@ -525,7 +766,9 @@ describe('UpdateManager — Docker image update lifecycle', () => {
|
||||
setImmediate(() => cb({
|
||||
statusCode: 200,
|
||||
headers: { 'docker-content-digest': 'sha256:digest' },
|
||||
on: jest.fn()
|
||||
on: jest.fn((event, handler) => {
|
||||
if (event === 'end') setImmediate(handler);
|
||||
})
|
||||
}));
|
||||
return { on: jest.fn(), end: jest.fn() };
|
||||
});
|
||||
|
||||
@@ -37,6 +37,81 @@ const BACKUP_FILES = [
|
||||
|
||||
const ASSET_FILES = ['custom-logo.png', 'custom-favicon.png', 'custom-logo.svg'];
|
||||
|
||||
// DC-079: Restrict restored assets to the hardcoded ASSET_FILES allowlist.
|
||||
// The asset KEYS in the snapshot are user-controlled JSON, so iterating
|
||||
// `Object.entries(snapshot.assets)` and writing each name verbatim into
|
||||
// `path.join(assetsDir, name)` lets an attacker POST `{assets: {"../../etc/caddy/Caddyfile":
|
||||
// "<base64-evil>"}}` and overwrite the live Caddyfile via the bind-mount
|
||||
// (path.join('/app/data/assets', '../../etc/caddy/Caddyfile') resolves
|
||||
// to /etc/caddy/Caddyfile). This bypasses the caddyfile-staging gate
|
||||
// above because the dataDir bind-mount can write to /etc/caddy on the host.
|
||||
const ASSET_KEY_RE = /^[a-zA-Z0-9._-]+$/;
|
||||
const ASSET_PATH_TRAVERSAL_RE = /(^|\/)\.\.($|\/)|^\//;
|
||||
|
||||
// DC-079: Caddyfile content safety limits for disaster-recovery restore.
|
||||
// The live Caddyfile on DNS2 is ~17 KB and grows linearly with vhost count.
|
||||
// Express's default JSON body parser limit (1 MB) is the outer gate; this
|
||||
// in-handler cap is defense-in-depth against either a future body-limit
|
||||
// raise or a custom body parser. Cap well below the body-parser ceiling.
|
||||
const MAX_CADDYFILE_BYTES = 512 * 1024; // 512 KiB — 30x the live file, far below 1 MB body limit
|
||||
|
||||
// DC-079: theme filenames must match this pattern. No slashes (no path
|
||||
// traversal), no `..`, must end in `.json`, and only filename-safe chars.
|
||||
// Themes are written to <dataDir>/themes/<name>; we also defense-in-depth
|
||||
// check the resolved path stays inside that dir.
|
||||
const THEME_NAME_RE = /^[a-zA-Z0-9._-]+\.json$/;
|
||||
|
||||
function assertSafeAssetKey(key) {
|
||||
if (typeof key !== 'string' || key.length === 0 || key.length > 128) {
|
||||
throw new Error(`asset key must be a non-empty string up to 128 chars`);
|
||||
}
|
||||
if (ASSET_PATH_TRAVERSAL_RE.test(key) || !ASSET_KEY_RE.test(key)) {
|
||||
throw new Error(`asset key contains forbidden characters or path segments`);
|
||||
}
|
||||
}
|
||||
|
||||
function assertSafeThemeName(name) {
|
||||
if (typeof name !== 'string' || name.length === 0 || name.length > 128) {
|
||||
throw new Error(`theme name must be a non-empty string up to 128 chars`);
|
||||
}
|
||||
if (!THEME_NAME_RE.test(name)) {
|
||||
throw new Error(`theme name must match ${THEME_NAME_RE} (alphanum / dot / dash / underscore, ending in .json)`);
|
||||
}
|
||||
}
|
||||
|
||||
// Reject Caddyfile content that smuggles in arbitrary `import` directives.
|
||||
// caddy-apply expects the single top-level Caddyfile; any `import` to an
|
||||
// absolute path means "load another file from disk at Caddy reload time" —
|
||||
// that's a classic injection vector (an attacker can craft a snapshot whose
|
||||
// `import /etc/caddy/external.caddy` reads any file Caddy can read).
|
||||
// We allow the relative-style `import <snippet>` form ONLY if the snippet
|
||||
// name matches a small allowlist of well-known Caddy snippet names (none
|
||||
// today; add explicit names if a future snippet module is needed).
|
||||
const FORBIDDEN_IMPORT_RE = /^\s*import\s+(["']|\/|\.\.|~\/|%[A-F0-9]{2})/im;
|
||||
|
||||
function validateCaddyfileContent(content) {
|
||||
if (typeof content !== 'string') {
|
||||
return { ok: false, error: 'Caddyfile content must be a string' };
|
||||
}
|
||||
if (content.length === 0) {
|
||||
return { ok: false, error: 'Caddyfile content is empty' };
|
||||
}
|
||||
if (Buffer.byteLength(content, 'utf8') > MAX_CADDYFILE_BYTES) {
|
||||
return { ok: false, error: `Caddyfile content exceeds ${MAX_CADDYFILE_BYTES} bytes` };
|
||||
}
|
||||
if (FORBIDDEN_IMPORT_RE.test(content)) {
|
||||
// Allow the canonical single-quoted snippet import form ONLY if the
|
||||
// snippet name is on the explicit allowlist (currently empty). This
|
||||
// catches absolute paths, ../, ~/, and URL-encoded payloads while
|
||||
// leaving room for future snippet additions without touching this gate.
|
||||
return {
|
||||
ok: false,
|
||||
error: 'Caddyfile contains forbidden `import` directive (absolute path, encoded, or non-allowlisted snippet)'
|
||||
};
|
||||
}
|
||||
return { ok: true };
|
||||
}
|
||||
|
||||
module.exports = function({ servicesStateManager, platformPaths, log, asyncHandler }) {
|
||||
const wrap = asyncHandler || ((fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next));
|
||||
const router = express.Router();
|
||||
@@ -44,6 +119,15 @@ module.exports = function({ servicesStateManager, platformPaths, log, asyncHandl
|
||||
let lastBackupStatus = { timestamp: null, status: null, size: null };
|
||||
let lastRestoreStatus = { timestamp: null, status: null };
|
||||
|
||||
// DC-079: Staging dir for the candidate Caddyfile. The disaster-recovery
|
||||
// restore endpoint stages here instead of writing directly to the live
|
||||
// Caddyfile path. The operator must run `caddy-apply` (or its equivalent)
|
||||
// to validate + reload + git-commit the staged file. This keeps the live
|
||||
// Caddyfile under the same atomic-commit guard as every other edit.
|
||||
function getStagedCaddyfileDir(dataDir) {
|
||||
return path.join(dataDir, 'disaster-staged');
|
||||
}
|
||||
|
||||
/**
|
||||
* POST /api/v1/disaster/backup
|
||||
* Creates a complete system snapshot as a downloadable JSON file.
|
||||
@@ -175,13 +259,64 @@ module.exports = function({ servicesStateManager, platformPaths, log, asyncHandl
|
||||
}
|
||||
}
|
||||
|
||||
// Restore Caddyfile
|
||||
if (snapshot.caddyfile) {
|
||||
// DC-079: Stage the Caddyfile to a staging path inside dataDir
|
||||
// instead of writing directly to caddyfilePath (which is the LIVE
|
||||
// /etc/caddy/Caddyfile bind-mounted into the container as /caddyfile).
|
||||
//
|
||||
// Threat model (defense-in-depth, mirrors DC-070 / DC-074 / DC-076):
|
||||
// the endpoint is TOTP-gated, but a compromised operator / phished
|
||||
// session / pivot path could POST a snapshot with `caddyfile: <evil>`
|
||||
// and the pre-fix code would call `fsp.writeFile(caddyfilePath, ...)`
|
||||
// which writes the attacker-controlled string straight to the live
|
||||
// Caddyfile. Caddy then reads that file on the next reload (which can
|
||||
// be triggered by ACME renewals, health probes, or any admin API
|
||||
// touch), executing whatever directives the attacker embedded:
|
||||
// - `admin off` + arbitrary config write
|
||||
// - `import /etc/caddy/<anything-caddy-can-read>` for content theft
|
||||
// - `reverse_proxy` to attacker-controlled upstreams
|
||||
// - `acme_ca` override to attacker CA
|
||||
// - `log` directives to attacker-writable paths
|
||||
//
|
||||
// The Caddyfile is managed by the `caddy-apply` wrapper (validates +
|
||||
// reloads + git-commits atomically — see CLAUDE.md hard rule). This
|
||||
// endpoint previously bypassed that wrapper. The fix stages the
|
||||
// candidate file under dataDir/disaster-staged/Caddyfile.candidate and
|
||||
// returns the path so the operator can apply it via the normal flow.
|
||||
const caddyfileStaged = [];
|
||||
// DC-079: handle three cases for the caddyfile field:
|
||||
// - absent/null/undefined: back-compat — no Caddyfile in snapshot
|
||||
// - empty string "": explicit empty payload is suspicious — reject
|
||||
// - non-string (object/array/number): type confusion attempt — reject
|
||||
// - valid string: stage to dataDir/disaster-staged/Caddyfile.candidate
|
||||
if (snapshot.caddyfile !== undefined && snapshot.caddyfile !== null) {
|
||||
const validation = validateCaddyfileContent(snapshot.caddyfile);
|
||||
if (!validation.ok) {
|
||||
return errorResponse(res, 400, `Invalid Caddyfile in snapshot: ${validation.error}`, {
|
||||
code: ErrorCodes.BACKUP.INVALID_CONFIG,
|
||||
});
|
||||
}
|
||||
|
||||
const stagedDir = getStagedCaddyfileDir(dataDir);
|
||||
try {
|
||||
await fsp.writeFile(caddyfilePath, snapshot.caddyfile);
|
||||
restored.push('Caddyfile');
|
||||
await fsp.mkdir(stagedDir, { recursive: true });
|
||||
const stagedPath = path.join(stagedDir, 'Caddyfile.candidate');
|
||||
// Atomic write: write to .candidate.tmp then rename. The live
|
||||
// Caddyfile is NEVER touched from this endpoint.
|
||||
const tmpPath = stagedPath + '.tmp';
|
||||
await fsp.writeFile(tmpPath, snapshot.caddyfile, { mode: 0o644 });
|
||||
await fsp.rename(tmpPath, stagedPath);
|
||||
caddyfileStaged.push({
|
||||
file: 'Caddyfile',
|
||||
stagedPath,
|
||||
action: 'awaiting caddy-apply',
|
||||
livePath: caddyfilePath,
|
||||
});
|
||||
if (log) log.info('disaster-recovery', 'Caddyfile staged (not applied)', {
|
||||
stagedPath,
|
||||
size: Buffer.byteLength(snapshot.caddyfile, 'utf8'),
|
||||
});
|
||||
} catch (err) {
|
||||
errors.push({ file: 'Caddyfile', error: err.message });
|
||||
errors.push({ file: 'Caddyfile (staging)', error: err.message });
|
||||
}
|
||||
}
|
||||
|
||||
@@ -189,8 +324,20 @@ module.exports = function({ servicesStateManager, platformPaths, log, asyncHandl
|
||||
const assetsDir = platformPaths?.resolveAssetsPath?.() || path.join(dataDir, 'assets');
|
||||
for (const [name, base64] of Object.entries(snapshot.assets || {})) {
|
||||
try {
|
||||
// DC-079: assets directory is the first attack surface that
|
||||
// bypasses the Caddyfile-staging gate. `name` is a user-supplied
|
||||
// JSON key; without validation, `path.join(assetsDir, name)` lets
|
||||
// an attacker escape to /etc/caddy via path traversal.
|
||||
assertSafeAssetKey(name);
|
||||
const resolved = path.resolve(assetsDir, name);
|
||||
// Defense-in-depth: even after charset checks, the resolved path
|
||||
// MUST stay inside assetsDir. If it doesn't, refuse the write.
|
||||
if (!resolved.startsWith(path.resolve(assetsDir) + path.sep) &&
|
||||
resolved !== path.resolve(assetsDir)) {
|
||||
throw new Error(`asset path resolves outside assets directory`);
|
||||
}
|
||||
await fsp.mkdir(assetsDir, { recursive: true });
|
||||
await fsp.writeFile(path.join(assetsDir, name), Buffer.from(base64, 'base64'));
|
||||
await fsp.writeFile(resolved, Buffer.from(base64, 'base64'));
|
||||
restored.push(`assets/${name}`);
|
||||
} catch (err) {
|
||||
errors.push({ file: `assets/${name}`, error: err.message });
|
||||
@@ -203,8 +350,21 @@ module.exports = function({ servicesStateManager, platformPaths, log, asyncHandl
|
||||
try {
|
||||
await fsp.mkdir(themesDir, { recursive: true });
|
||||
for (const [name, content] of Object.entries(snapshot.themes)) {
|
||||
await fsp.writeFile(path.join(themesDir, name), JSON.stringify(content, null, 2));
|
||||
restored.push(`themes/${name}`);
|
||||
// DC-079: same path-traversal vector as assets — keys are
|
||||
// user-controlled JSON. Validate the name AND confirm the
|
||||
// resolved path stays inside themesDir.
|
||||
try {
|
||||
assertSafeThemeName(name);
|
||||
const resolved = path.resolve(themesDir, name);
|
||||
if (!resolved.startsWith(path.resolve(themesDir) + path.sep) &&
|
||||
resolved !== path.resolve(themesDir)) {
|
||||
throw new Error(`theme path resolves outside themes directory`);
|
||||
}
|
||||
await fsp.writeFile(resolved, JSON.stringify(content, null, 2));
|
||||
restored.push(`themes/${name}`);
|
||||
} catch (err) {
|
||||
errors.push({ file: `themes/${name}`, error: err.message });
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
errors.push({ file: 'themes', error: err.message });
|
||||
@@ -215,19 +375,33 @@ module.exports = function({ servicesStateManager, platformPaths, log, asyncHandl
|
||||
timestamp: new Date().toISOString(),
|
||||
status: errors.length === 0 ? 'success' : 'partial',
|
||||
restored: restored.length,
|
||||
staged: caddyfileStaged.length,
|
||||
errors: errors.length,
|
||||
};
|
||||
|
||||
if (log) log.info('disaster-recovery', 'Restore completed', lastRestoreStatus);
|
||||
|
||||
ok(res, {
|
||||
// DC-079: Surface the staged-Caddyfile warning in the response body so
|
||||
// the UI / operator can see that the Caddyfile is NOT yet live. The
|
||||
// restore endpoint stages under dataDir/disaster-staged/Caddyfile.candidate
|
||||
// and the operator must run `caddy-apply` (or its equivalent) to
|
||||
// validate + reload + git-commit the staged file. The live Caddyfile
|
||||
// is owned by the caddy-apply wrapper per CLAUDE.md hard rule.
|
||||
const responseBody = {
|
||||
status: errors.length === 0 ? 'success' : 'partial',
|
||||
restored,
|
||||
errors,
|
||||
message: errors.length === 0
|
||||
? `Successfully restored ${restored.length} files. Restart DashCaddy to apply.`
|
||||
? `Successfully restored ${restored.length} files${caddyfileStaged.length > 0 ? ` (Caddyfile staged — ${caddyfileStaged[0].stagedPath}; run caddy-apply to apply)` : ''}. Restart DashCaddy to apply.`
|
||||
: `Restored ${restored.length} files with ${errors.length} errors. Check error details.`,
|
||||
});
|
||||
};
|
||||
|
||||
if (caddyfileStaged.length > 0) {
|
||||
responseBody.caddyfileStaged = caddyfileStaged;
|
||||
responseBody.warning = '[DC-079] Caddyfile is STAGED, not applied. Live /etc/caddy/Caddyfile was NOT modified by this restore. Run `caddy-apply <reason>` (or equivalent) to validate + reload + git-commit the staged candidate.';
|
||||
}
|
||||
|
||||
ok(res, responseBody);
|
||||
}));
|
||||
|
||||
/**
|
||||
|
||||
@@ -18,6 +18,30 @@ const UPDATE_CONFIG_FILE = process.env.UPDATE_CONFIG_FILE || path.join(platformP
|
||||
const UPDATE_HISTORY_FILE = process.env.UPDATE_HISTORY_FILE || path.join(platformPaths.dataDir, 'update-history.json');
|
||||
const CHECK_INTERVAL = parseInt(process.env.UPDATE_CHECK_INTERVAL || '3600000', 10); // 1 hour
|
||||
|
||||
// DC-078: registry probe reliability knobs. The container's /etc/resolv.conf points
|
||||
// at Technitium (100.121.150.22) which sometimes returns a mix of A and AAAA
|
||||
// records even when the host's IPv6 path to public registries (Docker Hub,
|
||||
// ghcr.io) is broken or slow. Without `family: 4` Node defaults to dual-stack,
|
||||
// every `https.request` to a registry races dual-stack DNS and stalls 30+ seconds
|
||||
// per ENETUNREACH on the unreachable family. Without an explicit request timeout
|
||||
// the entire `checkForUpdates()` loop (5+ containers) blocks for minutes per
|
||||
// tick — visible in error.log as AggregateError [ETIMEDOUT] with a stack like
|
||||
// `at internalConnectMultiple (node:net:1114:18)`.
|
||||
//
|
||||
// TUNABLES — keep conservative; the digest check is a background poll, not
|
||||
// user-facing. Worst-case latency per query:
|
||||
// 1st attempt: REGISTRY_REQUEST_TIMEOUT_MS (10s)
|
||||
// 1st retry : REGISTRY_RETRY_BACKOFF_MS + REGISTRY_REQUEST_TIMEOUT_MS (10.5s)
|
||||
// ─────────────────────────────────────────────────────────────────────
|
||||
// per-container ceiling: 20.5s (REGISTRY_MAX_RETRIES=1)
|
||||
const REGISTRY_REQUEST_TIMEOUT_MS = 10000; // hard per-request socket timeout
|
||||
const REGISTRY_MAX_RETRIES = 1; // extra attempts after first failure
|
||||
const REGISTRY_RETRY_BACKOFF_MS = 500; // delay before retry (transient blips)
|
||||
const REGISTRY_TRANSIENT_ERROR_CODES = new Set([
|
||||
'ETIMEDOUT', 'ENOTFOUND', 'ENETUNREACH', 'ECONNRESET', 'EAI_AGAIN',
|
||||
'EPIPE', 'ECONNREFUSED', 'EHOSTUNREACH',
|
||||
]);
|
||||
|
||||
class UpdateManager extends EventEmitter {
|
||||
constructor() {
|
||||
super();
|
||||
@@ -181,87 +205,208 @@ class UpdateManager extends EventEmitter {
|
||||
* Get image digest from GitHub Container Registry (ghcr.io)
|
||||
* Public images are tokenless via the registry-1.docker.io-style bearer flow,
|
||||
* but using ghcr.io's own auth endpoint.
|
||||
*
|
||||
* DC-078: hardened — `family: 4` to avoid the dual-stack DNS race when the
|
||||
* host's IPv6 path is unreachable (was producing AggregateError [ETIMEDOUT] in
|
||||
* error.log every check cycle). Hard request timeout caps each attempt.
|
||||
*/
|
||||
async getGhcrDigest(repository, tag) {
|
||||
// ghcr.io uses the same OCI distribution spec as Docker Hub
|
||||
const imageRepo = repository.replace(/^ghcr\.io\//, '');
|
||||
const res = await this.fetchWithReliability({
|
||||
hostname: 'ghcr.io',
|
||||
path: `/v2/${imageRepo}/manifests/${tag}`,
|
||||
headers: {
|
||||
'Accept': 'application/vnd.docker.distribution.manifest.v2+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.oci.image.index.v1+json'
|
||||
},
|
||||
});
|
||||
return res.headers['docker-content-digest'] || null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get image digest from Docker Hub
|
||||
*
|
||||
* DC-078: hardened — see getGhcrDigest comment. Resolves a 401 → token via
|
||||
* `fetchAuthToken`, which itself is wrapped in the same retry + IPv4-only +
|
||||
* timeout policy via `fetchWithReliability`.
|
||||
*/
|
||||
async getDockerHubDigest(repository, tag) {
|
||||
// Normalize repository name
|
||||
const repo = repository.includes('/') ? repository : `library/${repository}`;
|
||||
const firstAttempt = await this.fetchWithReliability({
|
||||
hostname: 'registry-1.docker.io',
|
||||
path: `/v2/${repo}/manifests/${tag}`,
|
||||
headers: {
|
||||
'Accept': 'application/vnd.docker.distribution.manifest.v2+json'
|
||||
},
|
||||
});
|
||||
if (firstAttempt.statusCode !== 401) {
|
||||
if (firstAttempt.statusCode < 200 || firstAttempt.statusCode >= 300) {
|
||||
throw new Error(`Docker Hub registry returned HTTP ${firstAttempt.statusCode}`);
|
||||
}
|
||||
return firstAttempt.headers['docker-content-digest'] || null;
|
||||
}
|
||||
// 401 → acquire a Bearer token via the WWW-Authenticate realm, then retry once.
|
||||
const authHeader = firstAttempt.headers['www-authenticate'];
|
||||
const authUrl = this.parseAuthHeader(authHeader);
|
||||
if (!authUrl) {
|
||||
throw new Error('Authentication required but no auth URL found');
|
||||
}
|
||||
const token = await this.fetchAuthToken(authUrl);
|
||||
const authed = await this.fetchWithReliability({
|
||||
hostname: 'registry-1.docker.io',
|
||||
path: `/v2/${repo}/manifests/${tag}`,
|
||||
headers: {
|
||||
'Accept': 'application/vnd.docker.distribution.manifest.v2+json',
|
||||
'Authorization': `Bearer ${token}`,
|
||||
},
|
||||
});
|
||||
if (authed.statusCode < 200 || authed.statusCode >= 300) {
|
||||
throw new Error(`Docker Hub registry returned HTTP ${authed.statusCode} after auth`);
|
||||
}
|
||||
return authed.headers['docker-content-digest'] || null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Single hardened HTTPS probe — DC-078.
|
||||
*
|
||||
* Reliability properties:
|
||||
* 1. `family: 4` — IPv4-only DNS lookup. Avoids dual-stack races where a
|
||||
* single unreachable IPv6 destination consumes the default 30-second
|
||||
* connect timeout before the IPv4 fallback succeeds (manifested in
|
||||
* error.log as AggregateError [ETIMEDOUT] with `at internalConnectMultiple`).
|
||||
* 2. Hard per-request timeout (REGISTRY_REQUEST_TIMEOUT_MS) — caps total
|
||||
* latency for any single probe attempt.
|
||||
* 3. Retry on transient network errors (REGISTRY_TRANSIENT_ERROR_CODES)
|
||||
* with REGISTRY_RETRY_BACKOFF_MS delay between attempts. Does NOT
|
||||
* retry on HTTP 4xx/5xx — those are real responses we should surface.
|
||||
*
|
||||
* Returns {statusCode, headers, body} so callers can read whichever response
|
||||
* header or body bytes they need. For digest probes the body is drained and
|
||||
* discarded; for auth-token fetches the JSON body is parsed.
|
||||
*
|
||||
* @param {object} opts
|
||||
* @param {string} opts.hostname
|
||||
* @param {string} opts.path
|
||||
* @param {object} [opts.headers]
|
||||
* @param {number} [opts.maxBodyBytes=65536] — protect against runaway bodies
|
||||
*/
|
||||
async fetchWithReliability(opts) {
|
||||
const maxBodyBytes = opts.maxBodyBytes || 65536;
|
||||
let attempt = 0;
|
||||
while (attempt <= REGISTRY_MAX_RETRIES) {
|
||||
try {
|
||||
const result = await this._httpsRequestOnce({
|
||||
hostname: opts.hostname,
|
||||
path: opts.path,
|
||||
headers: opts.headers || {},
|
||||
maxBodyBytes,
|
||||
});
|
||||
return result;
|
||||
} catch (error) {
|
||||
// Drain retryable transient errors; non-transient (HTTP status) errors
|
||||
// and code-less errors are surfaced directly to the caller.
|
||||
if (!REGISTRY_TRANSIENT_ERROR_CODES.has(error && error.code)) {
|
||||
throw error;
|
||||
}
|
||||
if (attempt >= REGISTRY_MAX_RETRIES) {
|
||||
throw error;
|
||||
}
|
||||
attempt += 1;
|
||||
// Brief backoff before retry to let transient blips settle.
|
||||
await new Promise((resolve) => setTimeout(resolve, REGISTRY_RETRY_BACKOFF_MS));
|
||||
}
|
||||
}
|
||||
// Defensive — should not reach here because the loop either throws or returns.
|
||||
throw new Error('fetchWithReliability exhausted retries');
|
||||
}
|
||||
|
||||
/**
|
||||
* One-shot HTTPS request helper for fetchWithReliability — DC-078.
|
||||
* Returns {statusCode, headers, body} on 2xx and most non-2xx responses
|
||||
* (the caller decides what to do with non-2xx). Throws on transient
|
||||
* network errors so the retry policy catches them.
|
||||
*/
|
||||
_httpsRequestOnce({ hostname, path: urlPath, headers, maxBodyBytes }) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const options = {
|
||||
hostname: 'ghcr.io',
|
||||
path: `/v2/${imageRepo}/manifests/${tag}`,
|
||||
hostname,
|
||||
path: urlPath,
|
||||
method: 'GET',
|
||||
headers: {
|
||||
'Accept': 'application/vnd.docker.distribution.manifest.v2+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.oci.image.index.v1+json'
|
||||
}
|
||||
family: 4, // DC-078: IPv4-only — see top-of-file comment
|
||||
headers,
|
||||
timeout: REGISTRY_REQUEST_TIMEOUT_MS, // DC-078: hard per-request cap
|
||||
};
|
||||
|
||||
const req = https.request(options, (res) => {
|
||||
if (res.statusCode === 401) {
|
||||
const authHeader = res.headers['www-authenticate'];
|
||||
const authUrl = this.parseAuthHeader(authHeader);
|
||||
if (authUrl) {
|
||||
// ghcr.io auth endpoint accepts scope=repository:owner/name:pull
|
||||
this.authenticateAndGetDigest(authUrl, options).then(resolve).catch(reject);
|
||||
} else {
|
||||
reject(new Error('Authentication required but no auth URL found'));
|
||||
let body = '';
|
||||
let size = 0;
|
||||
let aborted = false;
|
||||
res.on('data', (chunk) => {
|
||||
if (aborted) return;
|
||||
size += chunk.length;
|
||||
if (size > maxBodyBytes) {
|
||||
aborted = true;
|
||||
res.destroy();
|
||||
const err = new Error(`response from ${hostname}${urlPath} exceeded ${maxBodyBytes} bytes`);
|
||||
err.code = 'ERR_RESPONSE_TOO_LARGE';
|
||||
reject(err);
|
||||
return;
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (res.statusCode !== 200) {
|
||||
// Drain body to avoid socket leak
|
||||
res.resume();
|
||||
reject(new Error(`ghcr.io returned HTTP ${res.statusCode}`));
|
||||
return;
|
||||
}
|
||||
|
||||
const digest = res.headers['docker-content-digest'];
|
||||
resolve(digest || null);
|
||||
body += chunk;
|
||||
});
|
||||
res.on('end', () => {
|
||||
if (aborted) return;
|
||||
resolve({
|
||||
statusCode: res.statusCode,
|
||||
headers: res.headers,
|
||||
body,
|
||||
});
|
||||
});
|
||||
});
|
||||
// Node 22 emits 'timeout' on the request, not the socket, when socket.setTimeout
|
||||
// is hit — make it an explicit error so fetchWithReliability's retry policy catches it.
|
||||
req.on('timeout', () => {
|
||||
req.destroy(new Error('request timeout'));
|
||||
const err = new Error(`registry request to ${hostname}${urlPath} timed out after ${REGISTRY_REQUEST_TIMEOUT_MS}ms`);
|
||||
err.code = 'ETIMEDOUT';
|
||||
reject(err);
|
||||
});
|
||||
req.on('error', (err) => {
|
||||
// Tag errors missing .code so the retry policy recognizes transient ones.
|
||||
if (!err.code && /timeout/i.test(err.message)) err.code = 'ETIMEDOUT';
|
||||
reject(err);
|
||||
});
|
||||
|
||||
req.on('error', reject);
|
||||
req.end();
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Get image digest from Docker Hub
|
||||
* Fetch an auth token from a registry's WWW-Authenticate realm URL — DC-078.
|
||||
* Uses fetchWithReliability for IPv4-only + timeout + retry. Parses the
|
||||
* JSON body and returns the `token` or `access_token` field.
|
||||
*/
|
||||
async getDockerHubDigest(repository, tag) {
|
||||
return new Promise((resolve, reject) => {
|
||||
// Normalize repository name
|
||||
const repo = repository.includes('/') ? repository : `library/${repository}`;
|
||||
|
||||
const options = {
|
||||
hostname: 'registry-1.docker.io',
|
||||
path: `/v2/${repo}/manifests/${tag}`,
|
||||
method: 'GET',
|
||||
headers: {
|
||||
'Accept': 'application/vnd.docker.distribution.manifest.v2+json'
|
||||
}
|
||||
};
|
||||
|
||||
const req = https.request(options, (res) => {
|
||||
if (res.statusCode === 401) {
|
||||
// Need to authenticate
|
||||
const authHeader = res.headers['www-authenticate'];
|
||||
const authUrl = this.parseAuthHeader(authHeader);
|
||||
|
||||
if (authUrl) {
|
||||
this.authenticateAndGetDigest(authUrl, options).then(resolve).catch(reject);
|
||||
} else {
|
||||
reject(new Error('Authentication required but no auth URL found'));
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
const digest = res.headers['docker-content-digest'];
|
||||
resolve(digest || null);
|
||||
});
|
||||
|
||||
req.on('error', reject);
|
||||
req.end();
|
||||
async fetchAuthToken(authUrl) {
|
||||
const url = new URL(authUrl);
|
||||
const result = await this.fetchWithReliability({
|
||||
hostname: url.hostname,
|
||||
path: url.pathname + url.search,
|
||||
maxBodyBytes: 16384, // auth tokens are <2 KB; cap to a small bound
|
||||
});
|
||||
if (result.statusCode !== 200) {
|
||||
throw new Error(`auth token endpoint ${authUrl} returned HTTP ${result.statusCode}`);
|
||||
}
|
||||
let auth;
|
||||
try {
|
||||
auth = JSON.parse(result.body);
|
||||
} catch (parseErr) {
|
||||
// Surface a clean error — otherwise a malformed token response throws
|
||||
// SyntaxError with the raw body snippet, which is hard to diagnose
|
||||
// against the offending realm URL in a log line.
|
||||
throw new Error(`auth token response from ${authUrl} was not valid JSON: ${parseErr.message}`);
|
||||
}
|
||||
const token = auth.token || auth.access_token;
|
||||
if (!token) throw new Error(`No token in auth response from ${authUrl}`);
|
||||
return token;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -283,48 +428,6 @@ class UpdateManager extends EventEmitter {
|
||||
return url.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* Authenticate and get digest
|
||||
*/
|
||||
async authenticateAndGetDigest(authUrl, originalOptions) {
|
||||
return new Promise((resolve, reject) => {
|
||||
https.get(authUrl, (res) => {
|
||||
let data = '';
|
||||
res.on('data', chunk => data += chunk);
|
||||
res.on('end', () => {
|
||||
try {
|
||||
const auth = JSON.parse(data);
|
||||
const token = auth.token || auth.access_token;
|
||||
|
||||
if (!token) {
|
||||
reject(new Error('No token in auth response'));
|
||||
return;
|
||||
}
|
||||
|
||||
// Retry original request with token
|
||||
const options = {
|
||||
...originalOptions,
|
||||
headers: {
|
||||
...originalOptions.headers,
|
||||
'Authorization': `Bearer ${token}`
|
||||
}
|
||||
};
|
||||
|
||||
const req = https.request(options, (res) => {
|
||||
const digest = res.headers['docker-content-digest'];
|
||||
resolve(digest || null);
|
||||
});
|
||||
|
||||
req.on('error', reject);
|
||||
req.end();
|
||||
} catch (error) {
|
||||
reject(error);
|
||||
}
|
||||
});
|
||||
}).on('error', reject);
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract tag from image name
|
||||
*/
|
||||
|
||||
Reference in New Issue
Block a user