Harden Web authentication startup

Author: nicosuave

herdr/plugin.sh

@@ -240,26 +240,23 @@ web)
   log="$dir/web.log"
   url="http://$web_listen"
   # Reuse a server that is already up — the background index service may well be serving it.
-  if ! curl -fsS -m 1 "$url/api/stats" >/dev/null 2>&1; then
+  if ! curl -fsS -m 1 "$url/healthz" >/dev/null 2>&1; then
     nohup "$MEMEX" web --listen "$web_listen" ${MEMEX_ROOT:+--root "$MEMEX_ROOT"} >>"$log" 2>&1 </dev/null &
     # The assets are embedded in the binary, so it comes up fast; give it ~3s anyway.
     up=""
     for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
       sleep 0.2
-      if curl -fsS -m 1 "$url/api/stats" >/dev/null 2>&1; then
+      if curl -fsS -m 1 "$url/healthz" >/dev/null 2>&1; then
         up=1
         break
       fi
     done
     [ -n "$up" ] || refuse "memex web did not come up on $web_listen, see $log"
   fi
-  case "$(uname -s)" in
-  Darwin) opener="open" ;;
-  *) opener="xdg-open" ;;
-  esac
-  command -v "$opener" >/dev/null 2>&1 || refuse "$opener not found; memex web is running at $url"
-  "$opener" "$url" >/dev/null 2>&1 || refuse "failed to open $url with $opener"
-  printf 'opened %s\n' "$url"
+  open_args=(index-service open --listen "$web_listen")
+  [ -n "${MEMEX_ROOT:-}" ] && open_args+=(--root "$MEMEX_ROOT")
+  "$MEMEX" "${open_args[@]}" >/dev/null 2>&1 || refuse "failed to open authenticated memex web UI at $url"
+  printf 'opened authenticated %s\n' "$url"
   ;;
 
 startup)

src/web.rs

@@ -145,6 +145,7 @@ fn handle_request(
             "application/javascript; charset=utf-8",
             false,
         ),
+        "/healthz" => respond_text(request, StatusCode(200), "ok", "text/plain"),
         "/api/stats" => match stats_payload(paths) {
             Ok(payload) => respond_json(request, StatusCode(200), &payload),
             Err(err) => respond_json_error(request, StatusCode(503), &err.to_string()),
@@ -1081,6 +1082,15 @@ mod tests {
         );
         assert!(bootstrap_page.starts_with("HTTP/1.1 200"));
 
+        let health = http_round_trip(
+            &paths,
+            &auth,
+            "GET /healthz HTTP/1.1\r\nHost: localhost:6363\r\nConnection: close\r\n\r\n"
+                .to_string(),
+        );
+        assert!(health.starts_with("HTTP/1.1 200"));
+        assert!(health.ends_with("ok"));
+
         let unauthorized = http_round_trip(
             &paths,
             &auth,

src/web_auth.rs

@@ -136,19 +136,80 @@ fn load_or_create_secret(paths: &Paths) -> Result<[u8; ACCESS_TOKEN_BYTES]> {
     std::fs::create_dir_all(&paths.root)
         .with_context(|| format!("failed to create {}", paths.root.display()))?;
     let path = token_path(paths);
-    match open_secret_for_create(&path) {
-        Ok(mut file) => {
-            let mut secret = [0_u8; ACCESS_TOKEN_BYTES];
-            fill_random(&mut secret)?;
-            let encoded = URL_SAFE_NO_PAD.encode(secret);
+    match publish_new_secret(&path)? {
+        Some(secret) => Ok(secret),
+        None => read_secret(&path),
+    }
+}
+
+fn publish_new_secret(path: &Path) -> Result<Option<[u8; ACCESS_TOKEN_BYTES]>> {
+    let parent = path
+        .parent()
+        .ok_or_else(|| anyhow!("web auth token path has no parent: {}", path.display()))?;
+    let mut secret = [0_u8; ACCESS_TOKEN_BYTES];
+    fill_random(&mut secret)?;
+    let encoded = URL_SAFE_NO_PAD.encode(secret);
+
+    for _ in 0..16 {
+        let mut suffix = [0_u8; 16];
+        fill_random(&mut suffix)?;
+        let temp_path = parent.join(format!(
+            ".{TOKEN_FILE}.{}.tmp",
+            URL_SAFE_NO_PAD.encode(suffix)
+        ));
+        let mut file = match open_secret_for_create(&temp_path) {
+            Ok(file) => file,
+            Err(err) if err.kind() == ErrorKind::AlreadyExists => continue,
+            Err(err) => {
+                return Err(err)
+                    .with_context(|| format!("failed to create {}", temp_path.display()));
+            }
+        };
+
+        let write_result = (|| -> std::io::Result<()> {
             file.write_all(encoded.as_bytes())?;
             file.write_all(b"\n")?;
-            file.sync_all()?;
-            Ok(secret)
+            file.sync_all()
+        })();
+        if let Err(err) = write_result {
+            drop(file);
+            let _ = std::fs::remove_file(&temp_path);
+            return Err(err).with_context(|| format!("failed to write {}", temp_path.display()));
+        }
+        drop(file);
+
+        match std::fs::hard_link(&temp_path, path) {
+            Ok(()) => {
+                std::fs::remove_file(&temp_path).with_context(|| {
+                    format!("failed to remove temporary token {}", temp_path.display())
+                })?;
+                sync_directory(parent)?;
+                return Ok(Some(secret));
+            }
+            Err(err) if err.kind() == ErrorKind::AlreadyExists => {
+                let _ = std::fs::remove_file(&temp_path);
+                return Ok(None);
+            }
+            Err(err) => {
+                let _ = std::fs::remove_file(&temp_path);
+                return Err(err).with_context(|| format!("failed to publish {}", path.display()));
+            }
         }
-        Err(err) if err.kind() == ErrorKind::AlreadyExists => read_secret(&path),
-        Err(err) => Err(err).with_context(|| format!("failed to create {}", path.display())),
     }
+
+    bail!("failed to allocate a temporary web auth token file")
+}
+
+#[cfg(unix)]
+fn sync_directory(path: &Path) -> Result<()> {
+    File::open(path)
+        .and_then(|directory| directory.sync_all())
+        .with_context(|| format!("failed to sync {}", path.display()))
+}
+
+#[cfg(not(unix))]
+fn sync_directory(_path: &Path) -> Result<()> {
+    Ok(())
 }
 
 fn read_secret(path: &Path) -> Result<[u8; ACCESS_TOKEN_BYTES]> {
@@ -254,6 +315,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn concurrent_first_use_publishes_one_complete_access_token() {
+        let temp = TempDir::new().unwrap();
+        let root = temp.path().to_path_buf();
+        let barrier = std::sync::Arc::new(std::sync::Barrier::new(16));
+        let threads: Vec<_> = (0..16)
+            .map(|_| {
+                let root = root.clone();
+                let barrier = std::sync::Arc::clone(&barrier);
+                std::thread::spawn(move || {
+                    let paths = Paths::new(Some(root)).unwrap();
+                    barrier.wait();
+                    WebAuth::load_or_create(&paths).unwrap()
+                })
+            })
+            .collect();
+        let auths: Vec<_> = threads
+            .into_iter()
+            .map(|thread| thread.join().unwrap())
+            .collect();
+        let paths = Paths::new(Some(root)).unwrap();
+        let token = std::fs::read_to_string(token_path(&paths)).unwrap();
+
+        assert!(auths.iter().all(|auth| auth.authorize_bearer(token.trim())));
+        assert_eq!(
+            std::fs::read_dir(&paths.root)
+                .unwrap()
+                .filter_map(Result::ok)
+                .count(),
+            1
+        );
+    }
+
     #[test]
     fn bootstrap_tokens_are_short_lived_and_single_use() {
         let temp = TempDir::new().unwrap();