git.giacomolli.uk - onechat/blob - backup_archive.go

   1 package main
   2
   3 import (
   4         "archive/tar"
   5         "compress/gzip"
   6         "context"
   7         "errors"
   8         "fmt"
   9         "io"
  10         "io/fs"
  11         "os"
  12         "path/filepath"
  13         "strings"
  14 )
  15
  16 // backupArchive writes the files in root to path through a private temporary
  17 // file and a rename. Only directories and regular files enter the archive.
  18 func backupArchive(ctx context.Context, root, path string) (size int64, err error) {
  19         file, err := os.CreateTemp(filepath.Dir(path), ".onechat-backup-*")
  20         if err != nil {
  21                 return 0, fmt.Errorf("create archive: %w", err)
  22         }
  23
  24         defer func() {
  25                 err = errors.Join(err, file.Close())
  26                 removeErr := os.Remove(file.Name())
  27                 if !errors.Is(removeErr, os.ErrNotExist) {
  28                         err = errors.Join(err, removeErr)
  29                 }
  30         }()
  31
  32         compressed := gzip.NewWriter(file)
  33         archive := tar.NewWriter(compressed)
  34         err = filepath.WalkDir(root, func(path string, entry fs.DirEntry, walkErr error) error {
  35                 if walkErr != nil {
  36                         return fmt.Errorf("walk backup: %w", walkErr)
  37                 }
  38
  39                 if ctx.Err() != nil {
  40                         return ctx.Err()
  41                 }
  42
  43                 if path == root {
  44                         return nil
  45                 }
  46
  47                 name, nameErr := filepath.Rel(root, path)
  48                 if nameErr != nil {
  49                         return fmt.Errorf("name archive entry: %w", nameErr)
  50                 }
  51
  52                 info, infoErr := entry.Info()
  53                 if infoErr != nil {
  54                         return fmt.Errorf("read backup entry: %w", infoErr)
  55                 }
  56
  57                 if !info.IsDir() && !info.Mode().IsRegular() {
  58                         return fmt.Errorf("unsupported backup entry %q", name)
  59                 }
  60
  61                 header, headerErr := tar.FileInfoHeader(info, "")
  62                 if headerErr != nil {
  63                         return fmt.Errorf("make archive header: %w", headerErr)
  64                 }
  65
  66                 header.Name = filepath.ToSlash(name)
  67                 header.Uid, header.Gid = 0, 0
  68                 header.Uname, header.Gname = "", ""
  69                 headerErr = archive.WriteHeader(header)
  70                 if headerErr != nil {
  71                         return fmt.Errorf("write archive header: %w", headerErr)
  72                 }
  73
  74                 if info.IsDir() {
  75                         return nil
  76                 }
  77
  78                 return backupCopyFile(ctx, archive, path, info.Size())
  79         })
  80         err = errors.Join(err, archive.Close(), compressed.Close())
  81         if err != nil {
  82                 return 0, fmt.Errorf("write archive: %w", err)
  83         }
  84
  85         err = file.Sync()
  86         if err != nil {
  87                 return 0, fmt.Errorf("sync archive: %w", err)
  88         }
  89
  90         info, err := file.Stat()
  91         if err != nil {
  92                 return 0, fmt.Errorf("read archive size: %w", err)
  93         }
  94
  95         err = os.Rename(file.Name(), path)
  96         if err != nil {
  97                 return 0, fmt.Errorf("install archive: %w", err)
  98         }
  99
 100         return info.Size(), nil
 101 }
 102
 103 // backupExtract restores regular files and directories in an empty staging
 104 // directory. Links, duplicate entries, unsafe names, and special modes fail.
 105 // Directory modes apply last so a read-only directory can hold files.
 106 func backupExtract(ctx context.Context, path, root string) (err error) {
 107         file, err := os.Open(path)
 108         if err != nil {
 109                 return fmt.Errorf("open archive: %w", err)
 110         }
 111
 112         defer func() {
 113                 err = errors.Join(err, file.Close())
 114         }()
 115
 116         compressed, err := gzip.NewReader(file)
 117         if err != nil {
 118                 return fmt.Errorf("open compressed archive: %w", err)
 119         }
 120
 121         defer func() {
 122                 err = errors.Join(err, compressed.Close())
 123         }()
 124
 125         archive := tar.NewReader(BackupReader{ctx: ctx, reader: compressed})
 126         seen := make(map[string]bool)
 127
 128         var directories []*tar.Header
 129
 130         for {
 131                 header, readErr := archive.Next()
 132                 if errors.Is(readErr, io.EOF) {
 133                         break
 134                 }
 135
 136                 if readErr != nil {
 137                         return fmt.Errorf("read archive entry: %w", readErr)
 138                 }
 139
 140                 name := strings.TrimSuffix(header.Name, "/")
 141                 if !filepath.IsLocal(name) || strings.Contains(name, "\\") || filepath.Clean(name) != name || backupExcluded(name) {
 142                         return fmt.Errorf("unsafe archive path %q", header.Name)
 143                 }
 144
 145                 if seen[name] {
 146                         return fmt.Errorf("duplicate archive path %q", name)
 147                 }
 148
 149                 seen[name] = true
 150                 if header.Mode & ^int64(0o777) != 0 {
 151                         return fmt.Errorf("unsafe archive mode for %q", name)
 152                 }
 153
 154                 target := filepath.Join(root, name)
 155                 switch header.Typeflag {
 156                 case tar.TypeDir:
 157                         err = os.MkdirAll(target, 0o700)
 158                         directories = append(directories, header)
 159                 case tar.TypeReg:
 160                         err = os.MkdirAll(filepath.Dir(target), 0o700)
 161                         if err == nil {
 162                                 err = backupExtractFile(archive, target, os.FileMode(header.Mode))
 163                         }
 164                 default:
 165                         return fmt.Errorf("unsupported archive entry %q", name)
 166                 }
 167
 168                 if err != nil {
 169                         return fmt.Errorf("restore archive entry %q: %w", name, err)
 170                 }
 171         }
 172
 173         // Read through the gzip trailer to check its checksum.
 174         _, err = io.Copy(io.Discard, compressed)
 175         if err != nil {
 176                 return fmt.Errorf("check archive checksum: %w", err)
 177         }
 178
 179         for i := len(directories) - 1; i >= 0; i-- {
 180                 header := directories[i]
 181                 err = os.Chmod(filepath.Join(root, header.Name), os.FileMode(header.Mode))
 182                 if err != nil {
 183                         return fmt.Errorf("restore directory mode: %w", err)
 184                 }
 185         }
 186
 187         return nil
 188 }
 189
 190 // BackupReader checks cancellation between reads of an archive or file.
 191 type BackupReader struct {
 192         ctx    context.Context
 193         reader io.Reader
 194 }
 195
 196 func (r BackupReader) Read(data []byte) (int, error) {
 197         if r.ctx.Err() != nil {
 198                 return 0, r.ctx.Err()
 199         }
 200
 201         count, err := r.reader.Read(data)
 202         if err != nil {
 203                 return count, fmt.Errorf("read backup data: %w", err)
 204         }
 205
 206         return count, nil
 207 }
 208
 209 // backupCopyFile copies the size fixed at the snapshot of path. Growth after
 210 // that point is not part of the copy, and a shorter file is an error.
 211 func backupCopyFile(ctx context.Context, out io.Writer, path string, size int64) (err error) {
 212         file, err := os.Open(path)
 213         if err != nil {
 214                 return fmt.Errorf("open backup file: %w", err)
 215         }
 216
 217         defer func() {
 218                 err = errors.Join(err, file.Close())
 219         }()
 220
 221         _, err = io.CopyN(out, BackupReader{ctx: ctx, reader: file}, size)
 222         if err != nil {
 223                 return fmt.Errorf("copy backup file: %w", err)
 224         }
 225
 226         return nil
 227 }
 228
 229 func backupExtractFile(in io.Reader, path string, mode os.FileMode) (err error) {
 230         file, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
 231         if err != nil {
 232                 return fmt.Errorf("create restored file: %w", err)
 233         }
 234
 235         defer func() {
 236                 err = errors.Join(err, file.Close())
 237         }()
 238
 239         _, err = io.Copy(file, in)
 240         if err != nil {
 241                 return fmt.Errorf("write restored file: %w", err)
 242         }
 243
 244         err = file.Chmod(mode)
 245         if err != nil {
 246                 return fmt.Errorf("restore file mode: %w", err)
 247         }
 248
 249         return nil
 250 }
 251
 252 // backupExcluded keeps runtime locks, sockets, probe files, and import copies
 253 // out of the snapshot.
 254 func backupExcluded(name string) bool {
 255         first, _, _ := strings.Cut(filepath.ToSlash(name), "/")
 256         if first == socketFileName || first == tokenLockFileName || first == "probe" || strings.HasPrefix(first, "agent-backup-") {
 257                 return true
 258         }
 259
 260         if filepath.Base(name) == "lock" {
 261                 return true
 262         }
 263
 264         return false
 265 }