htwkmooc/poseidon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable unprivileged retrieve of file listing and content.

Browse Source
This commit is contained in:
Maximilian Paß
2022-09-28 18:50:27 +01:00
parent 0218b3589a
commit 0c70ad3b24
8 changed files with 49 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
api/swagger.yaml
View File

@ -330,6 +330,12 @@ paths:
format: pct-encoded # rfc 3986
default: "./"
required: false
- name: privilegedExecution
in: query
description: Specifies if the command should be executed as an privileged user.
schema:
type: boolean
default: false
responses:
"200":
description: Success. Returns the listing of the runner's filesystem.
@ -423,6 +429,12 @@ paths:
format: pct-encoded # rfc 3986
example: "./flag.txt"
required: true
- name: privilegedExecution
in: query
description: Specifies if the command should be executed as an privileged user.
schema:
type: boolean
default: false
responses:
"200":
description: Success. Returns the file.

13
internal/api/runners.go
View File

@ -28,6 +28,7 @@ const (
ExecutionIDKey = "executionID"
PathKey = "path"
RecursiveKey = "recursive"
PrivilegedExecutionKey = "privilegedExecution"
)
type RunnerController struct {
@ -93,9 +94,13 @@ func (r *RunnerController) listFileSystem(writer http.ResponseWriter, request *h
if path == "" {
path = "./"
}
privilegedExecution, err := strconv.ParseBool(request.URL.Query().Get(PrivilegedExecutionKey))
if err != nil {
privilegedExecution = false
}
writer.Header().Set("Content-Type", "application/json")
err = targetRunner.ListFileSystem(path, recursive, writer, request.Context())
err = targetRunner.ListFileSystem(path, recursive, writer, privilegedExecution, request.Context())
if errors.Is(err, runner.ErrFileNotFound) {
writeClientError(writer, err, http.StatusFailedDependency)
return
@ -129,9 +134,13 @@ func (r *RunnerController) updateFileSystem(writer http.ResponseWriter, request
func (r *RunnerController) fileContent(writer http.ResponseWriter, request *http.Request) {
targetRunner, _ := runner.FromContext(request.Context())
path := request.URL.Query().Get(PathKey)
privilegedExecution, err := strconv.ParseBool(request.URL.Query().Get(PrivilegedExecutionKey))
if err != nil {
privilegedExecution = false
}
writer.Header().Set("Content-Type", "application/octet-stream")
err := targetRunner.GetFileContent(path, writer, request.Context())
err = targetRunner.GetFileContent(path, writer, privilegedExecution, request.Context())
if errors.Is(err, runner.ErrFileNotFound) {
writeClientError(writer, err, http.StatusFailedDependency)
return

8
internal/api/runners_test.go
View File

@ -315,8 +315,8 @@ func (s *UpdateFileSystemRouteTestSuite) TestUpdateFileSystemReturnsInternalServ
func (s *UpdateFileSystemRouteTestSuite) TestListFileSystem() {
routeURL, err := s.router.Get(UpdateFileSystemPath).URL(RunnerIDKey, tests.DefaultMockID)
s.Require().NoError(err)
mockCall := s.runnerMock.On("ListFileSystem",
mock.AnythingOfType("string"), mock.AnythingOfType("bool"), mock.Anything, mock.Anything)
mockCall := s.runnerMock.On("ListFileSystem", mock.AnythingOfType("string"),
mock.AnythingOfType("bool"), mock.Anything, mock.AnythingOfType("bool"), mock.Anything)
s.Run("default parameters", func() {
mockCall.Run(func(args mock.Arguments) {
@ -375,8 +375,8 @@ func (s *UpdateFileSystemRouteTestSuite) TestListFileSystem() {
func (s *UpdateFileSystemRouteTestSuite) TestFileContent() {
routeURL, err := s.router.Get(FileContentRawPath).URL(RunnerIDKey, tests.DefaultMockID)
s.Require().NoError(err)
mockCall := s.runnerMock.
On("GetFileContent", mock.AnythingOfType("string"), mock.Anything, mock.Anything)
mockCall := s.runnerMock.On("GetFileContent",
mock.AnythingOfType("string"), mock.Anything, mock.AnythingOfType("bool"), mock.Anything)
s.Run("Not Found", func() {
mockCall.Return(runner.ErrFileNotFound)

4
internal/runner/aws_runner.go
View File

@ -104,7 +104,7 @@ func (w *AWSFunctionWorkload) ExecuteInteractively(id string, _ io.ReadWriter, s
// ListFileSystem is currently not supported with this aws serverless function.
// This is because the function execution ends with the termination of the workload code.
// So an on-demand file system listing after the termination is not possible. Also, we do not want to copy all files.
func (w *AWSFunctionWorkload) ListFileSystem(_ string, _ bool, _ io.Writer, _ context.Context) error {
func (w *AWSFunctionWorkload) ListFileSystem(_ string, _ bool, _ io.Writer, _ bool, _ context.Context) error {
return dto.ErrNotSupported
}
@ -125,7 +125,7 @@ func (w *AWSFunctionWorkload) UpdateFileSystem(request *dto.UpdateFileSystemRequ
// GetFileContent is currently not supported with this aws serverless function.
// This is because the function execution ends with the termination of the workload code.
// So an on-demand file streaming after the termination is not possible. Also, we do not want to copy all files.
func (w *AWSFunctionWorkload) GetFileContent(_ string, _ io.Writer, _ context.Context) error {
func (w *AWSFunctionWorkload) GetFileContent(_ string, _ io.Writer, _ bool, _ context.Context) error {
return dto.ErrNotSupported
}

11
internal/runner/nomad_runner.go
View File

@ -118,7 +118,8 @@ func (r *NomadJob) ExecuteInteractively(
return exit, cancel, nil
}
func (r *NomadJob) ListFileSystem(path string, recursive bool, content io.Writer, ctx context.Context) error {
func (r *NomadJob) ListFileSystem(
path string, recursive bool, content io.Writer, privilegedExecution bool, ctx context.Context) error {
r.ResetTimeout()
command := "ls -l --time-style=+%s -1 --literal"
if recursive {
@ -128,7 +129,8 @@ func (r *NomadJob) ListFileSystem(path string, recursive bool, content io.Writer
ls2json := &nullio.Ls2JsonWriter{Target: content}
defer ls2json.Close()
retrieveCommand := (&dto.ExecutionRequest{Command: fmt.Sprintf("%s %q", command, path)}).FullCommand()
exitCode, err := r.api.ExecuteCommand(r.id, ctx, retrieveCommand, false, &nullio.Reader{}, ls2json, io.Discard)
exitCode, err := r.api.ExecuteCommand(r.id, ctx, retrieveCommand, false, privilegedExecution,
&nullio.Reader{}, ls2json, io.Discard)
if err != nil {
return fmt.Errorf("%w: nomad error during retrieve file headers: %v",
nomad.ErrorExecutorCommunicationFailed, err)
@ -172,12 +174,13 @@ func (r *NomadJob) UpdateFileSystem(copyRequest *dto.UpdateFileSystemRequest) er
return nil
}
func (r *NomadJob) GetFileContent(path string, content io.Writer, ctx context.Context) error {
func (r *NomadJob) GetFileContent(path string, content io.Writer, privilegedExecution bool, ctx context.Context) error {
r.ResetTimeout()
retrieveCommand := (&dto.ExecutionRequest{Command: fmt.Sprintf("cat %q", path)}).FullCommand()
// Improve: Instead of using io.Discard use a **fixed-sized** buffer. With that we could improve the error message.
exitCode, err := r.api.ExecuteCommand(r.id, ctx, retrieveCommand, false, &nullio.Reader{}, content, io.Discard)
exitCode, err := r.api.ExecuteCommand(r.id, ctx, retrieveCommand, false, privilegedExecution,
&nullio.Reader{}, content, io.Discard)
if err != nil {
return fmt.Errorf("%w: nomad error during retrieve file content copy: %v",

2
internal/runner/nomad_runner_test.go
View File

@ -403,6 +403,6 @@ func NewRunner(id string, manager Accessor) Runner {
func (s *UpdateFileSystemTestSuite) TestGetFileContentReturnsErrorIfExitCodeIsNotZero() {
s.mockedExecuteCommandCall.RunFn = nil
s.mockedExecuteCommandCall.Return(1, nil)
err := s.runner.GetFileContent("", &bytes.Buffer{}, context.Background())
err := s.runner.GetFileContent("", &bytes.Buffer{}, false, context.Background())
s.ErrorIs(err, ErrFileNotFound)
}

4
internal/runner/runner.go
View File

@ -46,7 +46,7 @@ type Runner interface {
// ListFileSystem streams the listing of the file system of the requested directory into the Writer provided.
// The result is streamed via the io.Writer in order to not overload the memory with user input.
ListFileSystem(path string, recursive bool, result io.Writer, ctx context.Context) error
ListFileSystem(path string, recursive bool, result io.Writer, privilegedExecution bool, ctx context.Context) error
// UpdateFileSystem processes a dto.UpdateFileSystemRequest by first deleting each given dto.FilePath recursively
// and then copying each given dto.File to the runner.
@ -54,7 +54,7 @@ type Runner interface {
// GetFileContent streams the file content at the requested path into the Writer provided at content.
// The result is streamed via the io.Writer in order to not overload the memory with user input.
GetFileContent(path string, content io.Writer, ctx context.Context) error
GetFileContent(path string, content io.Writer, privilegedExecution bool, ctx context.Context) error
// Destroy destroys the Runner in Nomad.
Destroy() error

20
internal/runner/runner_mock.go
View File

@ -92,13 +92,13 @@ func (_m *RunnerMock) ExecutionExists(id string) bool {
return r0
}
// GetFileContent provides a mock function with given fields: path, content, ctx
func (_m *RunnerMock) GetFileContent(path string, content io.Writer, ctx context.Context) error {
ret := _m.Called(path, content, ctx)
// GetFileContent provides a mock function with given fields: path, content, privilegedExecution, ctx
func (_m *RunnerMock) GetFileContent(path string, content io.Writer, privilegedExecution bool, ctx context.Context) error {
ret := _m.Called(path, content, privilegedExecution, ctx)
var r0 error
if rf, ok := ret.Get(0).(func(string, io.Writer, context.Context) error); ok {
r0 = rf(path, content, ctx)
if rf, ok := ret.Get(0).(func(string, io.Writer, bool, context.Context) error); ok {
r0 = rf(path, content, privilegedExecution, ctx)
} else {
r0 = ret.Error(0)
}
@ -120,13 +120,13 @@ func (_m *RunnerMock) ID() string {
return r0
}
// ListFileSystem provides a mock function with given fields: path, recursive, result, ctx
func (_m *RunnerMock) ListFileSystem(path string, recursive bool, result io.Writer, ctx context.Context) error {
ret := _m.Called(path, recursive, result, ctx)
// ListFileSystem provides a mock function with given fields: path, recursive, result, privilegedExecution, ctx
func (_m *RunnerMock) ListFileSystem(path string, recursive bool, result io.Writer, privilegedExecution bool, ctx context.Context) error {
ret := _m.Called(path, recursive, result, privilegedExecution, ctx)
var r0 error
if rf, ok := ret.Get(0).(func(string, bool, io.Writer, context.Context) error); ok {
r0 = rf(path, recursive, result, ctx)
if rf, ok := ret.Get(0).(func(string, bool, io.Writer, bool, context.Context) error); ok {
r0 = rf(path, recursive, result, privilegedExecution, ctx)
} else {
r0 = ret.Error(0)
}