Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

107 changes: 38 additions & 69 deletions src/cdp.rs
Original file line number Diff line number Diff line change
Expand Up @@ -1422,7 +1422,7 @@ impl<C: CdpChannel + Send> Executor for CdpExecutor<C> {
}
}

fn fetch_json_targets(config: &CdpConfig) -> Result<Value, CdpError> {
fn discover_websocket_url(config: &CdpConfig) -> Result<String, CdpError> {
let mut stream = TcpStream::connect_timeout(&config.endpoint(), MAX_IO_TIMEOUT)
.map_err(|_| CdpError::Protocol)?;
stream
Expand Down Expand Up @@ -1486,11 +1486,7 @@ fn fetch_json_targets(config: &CdpConfig) -> Result<Value, CdpError> {
if body.len() != content_length {
return Err(CdpError::Protocol);
}
serde_json::from_slice(&body).map_err(|_| CdpError::Protocol)
}

fn discover_websocket_url(config: &CdpConfig) -> Result<String, CdpError> {
let targets = fetch_json_targets(config)?;
let targets: Value = serde_json::from_slice(&body).map_err(|_| CdpError::Protocol)?;
let mut matches = targets
.as_array()
.ok_or(CdpError::Protocol)?
Expand Down Expand Up @@ -1745,7 +1741,7 @@ fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u3
if written >= descriptors.len() || written % 8 != 0 {
return Err(CdpError::StaleTarget);
}
for descriptor in descriptors[..written].as_chunks::<8>().0 {
for descriptor in descriptors[..written].chunks(8) {
let file_descriptor =
i32::from_ne_bytes(descriptor[..4].try_into().map_err(|_| CdpError::Protocol)?);
let descriptor_type = u32::from_ne_bytes(
Expand Down Expand Up @@ -1784,12 +1780,14 @@ fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u3
}

#[cfg(windows)]
fn get_extended_tcp_table() -> Result<Vec<u8>, CdpError> {
fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u32>, CdpError> {
const AF_INET: u32 = 2;
const ERROR_INSUFFICIENT_BUFFER: u32 = 122;
const MAX_TABLE_BYTES: usize = 16 * 1024 * 1024;
const NO_ERROR: u32 = 0;
const TCP_LISTEN: u32 = 2;
const TCP_TABLE_OWNER_PID_LISTENER: i32 = 3;
const TCP_ROW_BYTES: usize = 24;

#[link(name = "iphlpapi")]
unsafe extern "system" {
Expand Down Expand Up @@ -1840,16 +1838,6 @@ fn get_extended_tcp_table() -> Result<Vec<u8>, CdpError> {
if written > table.len() || written < 4 {
return Err(CdpError::Protocol);
}
table.truncate(written);
Ok(table)
}

#[cfg(windows)]
fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u32>, CdpError> {
const TCP_LISTEN: u32 = 2;
const TCP_ROW_BYTES: usize = 24;

let table = get_extended_tcp_table()?;
let row_count =
u32::from_ne_bytes(table[..4].try_into().map_err(|_| CdpError::Protocol)?) as usize;
if 4usize
Expand All @@ -1858,17 +1846,12 @@ fn endpoint_owner_process_ids(port: u16, _process_id: u32) -> Result<BTreeSet<u3
.checked_mul(TCP_ROW_BYTES)
.ok_or(CdpError::Protocol)?,
)
.is_none_or(|required| required > table.len())
.is_none_or(|required| required > written)
{
return Err(CdpError::Protocol);
}
let mut owners = BTreeSet::new();
for row in table[4..]
.as_chunks::<TCP_ROW_BYTES>()
.0
.iter()
.take(row_count)
{
for row in table[4..].chunks(TCP_ROW_BYTES).take(row_count) {
if u32::from_ne_bytes(row[..4].try_into().map_err(|_| CdpError::Protocol)?) == TCP_LISTEN
&& row[4..8] == Ipv4Addr::LOCALHOST.octets()
&& u16::from_be_bytes(row[8..10].try_into().map_err(|_| CdpError::Protocol)?) == port
Expand Down Expand Up @@ -2762,44 +2745,6 @@ mod tests {
}
}

fn interactive_request(
operation_id: &str,
action: Action,
target: TargetRef,
verification: VerificationPolicy,
) -> ActionRequest {
ActionRequest {
protocol_version: PROTOCOL_VERSION,
action_version: PROTOCOL_VERSION,
target_version: PROTOCOL_VERSION,
verification_version: PROTOCOL_VERSION,
operation_id: operation_id.to_string(),
subject: "subject".to_string(),
session_id: "session".to_string(),
authority: SignedAuthority {
grant: AuthorityGrant {
protocol_version: PROTOCOL_VERSION,
issuer: "host".to_string(),
key_id: "key".to_string(),
operation_id: operation_id.to_string(),
subject: "subject".to_string(),
session_id: "session".to_string(),
risk: SafetyClass::Reversible,
expires_at_ms: i64::MAX,
policy_generation: "generation".to_string(),
action_hash: "0".repeat(64),
},
signature: "0".repeat(128),
},
action,
target,
interaction_mode: crate::InteractionMode::Interactive,
deadline_at_ms: i64::MAX,
verification,
safety: SafetyClass::Reversible,
}
}

#[test]
fn only_exact_local_channel_is_accepted() {
let process_id = std::process::id();
Expand Down Expand Up @@ -3837,14 +3782,38 @@ mod tests {
)),
]);
drop(channel);
let request = interactive_request(
"cdp-set-value",
Action::SetValue {
let request = ActionRequest {
protocol_version: PROTOCOL_VERSION,
action_version: PROTOCOL_VERSION,
target_version: PROTOCOL_VERSION,
verification_version: PROTOCOL_VERSION,
operation_id: "cdp-set-value".to_string(),
subject: "subject".to_string(),
session_id: "session".to_string(),
authority: SignedAuthority {
grant: AuthorityGrant {
protocol_version: PROTOCOL_VERSION,
issuer: "host".to_string(),
key_id: "key".to_string(),
operation_id: "cdp-set-value".to_string(),
subject: "subject".to_string(),
session_id: "session".to_string(),
risk: SafetyClass::Reversible,
expires_at_ms: i64::MAX,
policy_generation: "generation".to_string(),
action_hash: "0".repeat(64),
},
signature: "0".repeat(128),
},
action: Action::SetValue {
value: value.to_string(),
},
TargetRef::Element { target },
VerificationPolicy::TargetValueHash { sha256: value_hash },
);
target: TargetRef::Element { target },
interaction_mode: crate::InteractionMode::Interactive,
deadline_at_ms: i64::MAX,
verification: VerificationPolicy::TargetValueHash { sha256: value_hash },
safety: SafetyClass::Reversible,
};
let directory = tempfile::tempdir().expect("temporary directory");
crate::restrict_directory(directory.path()).expect("restrict temporary directory");
let report = Engine::new(
Expand Down
Loading
Loading