The extension's fallback transport (docs/05 §4). veloxd now also listens on 127.0.0.1, first free port in 52000-52016, and writes it to <runtime>/ws.port (0600). - rpc/ws_frame — RFC 6455 frame codec. Incremental; reassembles continuation frames; enforces "client frames MUST be masked" (§5.1); caps a reassembled message at 8 MiB. This is the attacker-adjacent parser, so it has its own test table. - rpc/ws_handshake — HTTP upgrade parse, Sec-WebSocket-Accept (SHA-1 + base64 via libcrypto), and the two non-negotiable checks: an Origin header must be present and must be moz-extension:// (a page cannot pair). Version must be 13. - rpc/ws_server — per-connection Handshake -> Open state machine on the shared EventLoop. Token gate: session.pair mints a token behind the approver + rate limiter; session.hello must present a valid one; every other method is -32002 until authed. Privileged methods are refused -32003 by the generated dispatch(). Ping -> Pong; Close echoed. session.hello major-version mismatch -> -32001. - rpc/pairing — PairingApprover interface + EnvAutoApprover dev stub (approves iff VELOX_PAIR_AUTO=1); PairingRateLimiter (5 failures / 60 s per origin, then 60 s lockout -> -32014, survives reconnect); a four-digit code generator. - store/pairings — the pairings table: create() returns the plaintext token once and stores only its SHA-256; find_active_by_token, touch, revoke, list_active. - util/crypto — sha1 / sha256_hex / base64 / random_token over libcrypto. - store/sqlite — pin the DB file (and -wal/-shm) to 0600. - runtime_dir — resolve_data_dir() for $XDG_DATA_HOME/velox (velox.db). - main.cpp — opens + migrates velox.db, starts both transports; a WS bind failure is logged, not fatal (capture must fail open, the Unix socket still serves the GUI/CLI). Real gap, flagged not hidden: the pairing prompt is EnvAutoApprover for now — a GUI dialog / desktop notification is build step 7. Pairing needs VELOX_PAIR_AUTO=1 until then. Tests (ASan+UBSan and TSan clean): veloxd.ws_frame (codec + handshake vectors incl. the RFC 6455 §1.3 accept sample), veloxd.pairings (token create/find/revoke, hash-not-token, rate-limit window + lockout + per-origin isolation + success reset), veloxd.ws_server (full flow: 101 handshake, -32002 gate, deny-then-approve pairing, hello-with-token, -32003 privileged refusal, real download.list). 27 daemon/cli tests green; full tree green. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig
156 lines
4.9 KiB
C++
156 lines
4.9 KiB
C++
#include "store/sqlite.hpp"
|
|
|
|
#include <sqlite3.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <utility>
|
|
|
|
namespace velox::daemon::store {
|
|
|
|
// --- Db ------------------------------------------------------------------------------
|
|
|
|
Db::~Db() {
|
|
if (db_ != nullptr) sqlite3_close(db_);
|
|
}
|
|
|
|
Db::Db(Db&& o) noexcept : db_(std::exchange(o.db_, nullptr)) {}
|
|
|
|
Db& Db::operator=(Db&& o) noexcept {
|
|
if (this != &o) {
|
|
if (db_ != nullptr) sqlite3_close(db_);
|
|
db_ = std::exchange(o.db_, nullptr);
|
|
}
|
|
return *this;
|
|
}
|
|
|
|
DbError Db::last_error() const {
|
|
return DbError{sqlite3_extended_errcode(db_), sqlite3_errmsg(db_)};
|
|
}
|
|
|
|
DbResult<Db> Db::open(const std::string& path) {
|
|
sqlite3* handle = nullptr;
|
|
const int rc = sqlite3_open_v2(
|
|
path.c_str(), &handle, SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_NOMUTEX,
|
|
nullptr);
|
|
if (rc != SQLITE_OK) {
|
|
DbError e{rc, handle != nullptr ? sqlite3_errmsg(handle) : "sqlite3_open_v2 failed"};
|
|
if (handle != nullptr) sqlite3_close(handle);
|
|
return std::unexpected(std::move(e));
|
|
}
|
|
|
|
Db db(handle);
|
|
// Not a secret store (credentials go to the Secret Service), but task URLs and pairing
|
|
// hashes still are not world-readable. SQLite honours the umask; pin 0600 explicitly.
|
|
if (path != ":memory:" && !path.empty() && path.front() != ':') {
|
|
::chmod(path.c_str(), 0600);
|
|
::chmod((path + "-wal").c_str(), 0600);
|
|
::chmod((path + "-shm").c_str(), 0600);
|
|
}
|
|
// WAL for crash-safe concurrent readers (docs/01 §1). busy_timeout so a writer waits
|
|
// rather than returning SQLITE_BUSY under the RPC loop. foreign_keys is per-connection.
|
|
for (const char* pragma : {"PRAGMA journal_mode=WAL", "PRAGMA synchronous=NORMAL",
|
|
"PRAGMA foreign_keys=ON", "PRAGMA busy_timeout=5000"}) {
|
|
if (auto r = db.exec(pragma); !r) return std::unexpected(r.error());
|
|
}
|
|
return db;
|
|
}
|
|
|
|
DbResult<void> Db::exec(std::string_view sql) {
|
|
char* err = nullptr;
|
|
const int rc = sqlite3_exec(db_, std::string(sql).c_str(), nullptr, nullptr, &err);
|
|
if (rc != SQLITE_OK) {
|
|
DbError e{rc, err != nullptr ? err : sqlite3_errmsg(db_)};
|
|
sqlite3_free(err);
|
|
return std::unexpected(std::move(e));
|
|
}
|
|
return {};
|
|
}
|
|
|
|
DbResult<Stmt> Db::prepare(std::string_view sql) {
|
|
sqlite3_stmt* s = nullptr;
|
|
const int rc =
|
|
sqlite3_prepare_v2(db_, sql.data(), static_cast<int>(sql.size()), &s, nullptr);
|
|
if (rc != SQLITE_OK) return std::unexpected(last_error());
|
|
return Stmt(db_, s);
|
|
}
|
|
|
|
std::int64_t Db::user_version() {
|
|
auto st = prepare("PRAGMA user_version");
|
|
if (!st) return -1;
|
|
auto row = st->step();
|
|
if (!row || !*row) return -1;
|
|
return st->column_int(0);
|
|
}
|
|
|
|
DbResult<void> Db::set_user_version(std::int64_t v) {
|
|
// PRAGMA does not accept a bound parameter; the value is our own integer.
|
|
return exec("PRAGMA user_version=" + std::to_string(v));
|
|
}
|
|
|
|
// --- Stmt ----------------------------------------------------------------------------
|
|
|
|
Stmt::~Stmt() {
|
|
if (stmt_ != nullptr) sqlite3_finalize(stmt_);
|
|
}
|
|
|
|
Stmt::Stmt(Stmt&& o) noexcept
|
|
: db_(std::exchange(o.db_, nullptr)), stmt_(std::exchange(o.stmt_, nullptr)) {}
|
|
|
|
Stmt& Stmt::operator=(Stmt&& o) noexcept {
|
|
if (this != &o) {
|
|
if (stmt_ != nullptr) sqlite3_finalize(stmt_);
|
|
db_ = std::exchange(o.db_, nullptr);
|
|
stmt_ = std::exchange(o.stmt_, nullptr);
|
|
}
|
|
return *this;
|
|
}
|
|
|
|
DbError Stmt::last_error() const {
|
|
return DbError{sqlite3_extended_errcode(db_), sqlite3_errmsg(db_)};
|
|
}
|
|
|
|
DbResult<void> Stmt::bind(int i, std::int64_t v) {
|
|
if (sqlite3_bind_int64(stmt_, i, v) != SQLITE_OK) return std::unexpected(last_error());
|
|
return {};
|
|
}
|
|
|
|
DbResult<void> Stmt::bind(int i, std::string_view v) {
|
|
if (sqlite3_bind_text(stmt_, i, v.data(), static_cast<int>(v.size()), SQLITE_TRANSIENT) !=
|
|
SQLITE_OK)
|
|
return std::unexpected(last_error());
|
|
return {};
|
|
}
|
|
|
|
DbResult<void> Stmt::bind_null(int i) {
|
|
if (sqlite3_bind_null(stmt_, i) != SQLITE_OK) return std::unexpected(last_error());
|
|
return {};
|
|
}
|
|
|
|
DbResult<bool> Stmt::step() {
|
|
const int rc = sqlite3_step(stmt_);
|
|
if (rc == SQLITE_ROW) return true;
|
|
if (rc == SQLITE_DONE) return false;
|
|
return std::unexpected(last_error());
|
|
}
|
|
|
|
DbResult<void> Stmt::reset() {
|
|
if (sqlite3_reset(stmt_) != SQLITE_OK) return std::unexpected(last_error());
|
|
return {};
|
|
}
|
|
|
|
std::int64_t Stmt::column_int(int i) const { return sqlite3_column_int64(stmt_, i); }
|
|
|
|
std::string Stmt::column_text(int i) const {
|
|
const auto* p = sqlite3_column_text(stmt_, i);
|
|
if (p == nullptr) return {};
|
|
return std::string(reinterpret_cast<const char*>(p),
|
|
static_cast<std::size_t>(sqlite3_column_bytes(stmt_, i)));
|
|
}
|
|
|
|
bool Stmt::column_is_null(int i) const {
|
|
return sqlite3_column_type(stmt_, i) == SQLITE_NULL;
|
|
}
|
|
|
|
} // namespace velox::daemon::store
|