git.giacomolli.uk - onechat/blob - backup_archive.go

   1 package main
   2
   3 import (
   4         "archive/tar"
   5         "compress/gzip"
   6         "context"
   7         "errors"
   8         "fmt"
   9         "io"
  10         "io/fs"
  11         "os"
  12         "path/filepath"
  13         "strings"
  14 )
  15
  16 // BackupReader checks cancellation between reads of an archive or file.
  17 type BackupReader struct {
  18         ctx    context.Context
  19         reader io.Reader
  20 }
  21
  22 func (r BackupReader) Read(data []byte) (int, error) {
  23         if r.ctx.Err() != nil {
  24                 return 0, r.ctx.Err()
  25         }
  26
  27         count, err := r.reader.Read(data)
  28         if err != nil {
  29                 return count, fmt.Errorf("read backup data: %w", err)
  30         }
  31
  32         return count, nil
  33 }
  34
  35 // backupArchive writes the files in root to path through a private temporary
  36 // file and a rename. Only directories and regular files enter the archive.
  37 func backupArchive(ctx context.Context, root, path string) (size int64, err error) {
  38         file, err := os.CreateTemp(filepath.Dir(path), ".onechat-backup-*")
  39         if err != nil {
  40                 return 0, fmt.Errorf("create archive: %w", err)
  41         }
  42
  43         defer func() {
  44                 err = errors.Join(err, file.Close())
  45                 removeErr := os.Remove(file.Name())
  46                 if !errors.Is(removeErr, os.ErrNotExist) {
  47                         err = errors.Join(err, removeErr)
  48                 }
  49         }()
  50
  51         compressed := gzip.NewWriter(file)
  52         archive := tar.NewWriter(compressed)
  53         err = filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
  54                 if err != nil {
  55                         return fmt.Errorf("walk backup: %w", err)
  56                 }
  57
  58                 if ctx.Err() != nil {
  59                         return ctx.Err()
  60                 }
  61
  62                 if path == root {
  63                         return nil
  64                 }
  65
  66                 name, err := filepath.Rel(root, path)
  67                 if err != nil {
  68                         return fmt.Errorf("name archive entry: %w", err)
  69                 }
  70
  71                 info, err := entry.Info()
  72                 if err != nil {
  73                         return fmt.Errorf("read backup entry: %w", err)
  74                 }
  75
  76                 if !info.IsDir() && !info.Mode().IsRegular() {
  77                         return fmt.Errorf("unsupported backup entry %q", name)
  78                 }
  79
  80                 header, err := tar.FileInfoHeader(info, "")
  81                 if err != nil {
  82                         return fmt.Errorf("make archive header: %w", err)
  83                 }
  84
  85                 header.Name = filepath.ToSlash(name)
  86                 header.Uid, header.Gid = 0, 0
  87                 header.Uname, header.Gname = "", ""
  88                 err = archive.WriteHeader(header)
  89                 if err != nil {
  90                         return fmt.Errorf("write archive header: %w", err)
  91                 }
  92
  93                 if info.IsDir() {
  94                         return nil
  95                 }
  96
  97                 err = backupCopyFile(ctx, archive, path, info.Size())
  98                 if err != nil {
  99                         return fmt.Errorf("archive file: %w", err)
 100                 }
 101
 102                 return nil
 103         })
 104
 105         err = errors.Join(err, archive.Close(), compressed.Close())
 106         if err != nil {
 107                 return 0, fmt.Errorf("write archive: %w", err)
 108         }
 109
 110         err = file.Sync()
 111         if err != nil {
 112                 return 0, fmt.Errorf("sync archive: %w", err)
 113         }
 114
 115         info, err := file.Stat()
 116         if err != nil {
 117                 return 0, fmt.Errorf("read archive size: %w", err)
 118         }
 119
 120         err = os.Rename(file.Name(), path)
 121         if err != nil {
 122                 return 0, fmt.Errorf("install archive: %w", err)
 123         }
 124
 125         return info.Size(), nil
 126 }
 127
 128 // backupExtract restores regular files and directories in an empty staging
 129 // directory. Links, duplicate entries, unsafe names, and special modes fail.
 130 // Directory modes apply last so a read-only directory can hold files.
 131 func backupExtract(ctx context.Context, path, root string) (err error) {
 132         file, err := os.Open(path)
 133         if err != nil {
 134                 return fmt.Errorf("open archive: %w", err)
 135         }
 136
 137         defer func() {
 138                 err = errors.Join(err, file.Close())
 139         }()
 140
 141         compressed, err := gzip.NewReader(file)
 142         if err != nil {
 143                 return fmt.Errorf("open compressed archive: %w", err)
 144         }
 145
 146         defer func() {
 147                 err = errors.Join(err, compressed.Close())
 148         }()
 149
 150         archive := tar.NewReader(BackupReader{
 151                 ctx:    ctx,
 152                 reader: compressed,
 153         })
 154
 155         seen := make(map[string]bool)
 156
 157         var directories []*tar.Header
 158
 159         for {
 160                 var header *tar.Header
 161
 162                 header, err = archive.Next()
 163                 if errors.Is(err, io.EOF) {
 164                         break
 165                 }
 166
 167                 if err != nil {
 168                         return fmt.Errorf("read archive entry: %w", err)
 169                 }
 170
 171                 name := strings.TrimSuffix(header.Name, "/")
 172                 if !filepath.IsLocal(name) || strings.Contains(name, "\\") || filepath.Clean(name) != name || backupExcluded(name) {
 173                         return fmt.Errorf("unsafe archive path %q", header.Name)
 174                 }
 175
 176                 if seen[name] {
 177                         return fmt.Errorf("duplicate archive path %q", name)
 178                 }
 179
 180                 seen[name] = true
 181                 if header.Mode & ^int64(0o777) != 0 {
 182                         return fmt.Errorf("unsafe archive mode for %q", name)
 183                 }
 184
 185                 target := filepath.Join(root, name)
 186                 switch header.Typeflag {
 187                 case tar.TypeDir:
 188                         err = os.MkdirAll(target, 0o700)
 189                         directories = append(directories, header)
 190                 case tar.TypeReg:
 191                         err = os.MkdirAll(filepath.Dir(target), 0o700)
 192                         if err == nil {
 193                                 err = backupExtractFile(archive, target, os.FileMode(header.Mode))
 194                         }
 195                 default:
 196                         return fmt.Errorf("unsupported archive entry %q", name)
 197                 }
 198
 199                 if err != nil {
 200                         return fmt.Errorf("restore archive entry %q: %w", name, err)
 201                 }
 202         }
 203
 204         // Read through the gzip trailer to check its checksum.
 205         _, err = io.Copy(io.Discard, compressed)
 206         if err != nil {
 207                 return fmt.Errorf("check archive checksum: %w", err)
 208         }
 209
 210         for i := len(directories) - 1; i >= 0; i-- {
 211                 header := directories[i]
 212                 err = os.Chmod(filepath.Join(root, header.Name), os.FileMode(header.Mode))
 213                 if err != nil {
 214                         return fmt.Errorf("restore directory mode: %w", err)
 215                 }
 216         }
 217
 218         return nil
 219 }
 220
 221 // backupCopyFile copies the size fixed at the snapshot of path. Growth after
 222 // that point is not part of the copy, and a shorter file is an error.
 223 func backupCopyFile(ctx context.Context, out io.Writer, path string, size int64) (err error) {
 224         file, err := os.Open(path)
 225         if err != nil {
 226                 return fmt.Errorf("open backup file: %w", err)
 227         }
 228
 229         defer func() {
 230                 err = errors.Join(err, file.Close())
 231         }()
 232
 233         _, err = io.CopyN(out, BackupReader{
 234                 ctx:    ctx,
 235                 reader: file,
 236         }, size)
 237         if err != nil {
 238                 return fmt.Errorf("copy backup file: %w", err)
 239         }
 240
 241         return nil
 242 }
 243
 244 func backupExtractFile(in io.Reader, path string, mode os.FileMode) (err error) {
 245         file, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
 246         if err != nil {
 247                 return fmt.Errorf("create restored file: %w", err)
 248         }
 249
 250         defer func() {
 251                 err = errors.Join(err, file.Close())
 252         }()
 253
 254         _, err = io.Copy(file, in)
 255         if err != nil {
 256                 return fmt.Errorf("write restored file: %w", err)
 257         }
 258
 259         err = file.Chmod(mode)
 260         if err != nil {
 261                 return fmt.Errorf("restore file mode: %w", err)
 262         }
 263
 264         return nil
 265 }
 266
 267 // backupExcluded keeps runtime locks, sockets, probe files, and import copies
 268 // out of the snapshot.
 269 func backupExcluded(name string) bool {
 270         first, _, _ := strings.Cut(filepath.ToSlash(name), "/")
 271         if first == socketFileName || first == tokenLockFileName || first == "probe" || strings.HasPrefix(first, "agent-backup-") {
 272                 return true
 273         }
 274
 275         if filepath.Base(name) == "lock" || (first == imageDirName && strings.HasPrefix(filepath.Base(name), ".image-")) || (first == voiceDirName && (strings.HasPrefix(filepath.Base(name), ".voice-") || strings.HasPrefix(filepath.Base(name), ".transcript-"))) {
 276                 return true
 277         }
 278
 279         return false
 280 }