Merge branch 'master' of https://github.com/ethersphere/bee into act-removal-5469

Author: akrem-chabchoub

.github/workflows/go.yml

@@ -18,32 +18,13 @@ on:
     branches:
       - '**'
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
-  test-linux:
-    name: Test (Linux)
-    runs-on: [self-hosted, linux, bee]
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v5
-    - name: Setup Go
-      uses: actions/setup-go@v6
-      with:
-        cache: true
-        go-version-file: go.mod
-    - name: Build
-      run: make build
-    - name: Test with race detector
-      run: make test-ci-race
-  test-other:
+  test:
     name: Test
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
     - name: Checkout
       uses: actions/checkout@v5
@@ -52,14 +33,19 @@ jobs:
       with:
         cache: true
         go-version-file: go.mod
+    - name: Increase UDP buffer sizes (Ubuntu)
+      if: matrix.os == 'ubuntu-latest'
+      run: |
+        sudo sysctl -w net.core.rmem_max=7500000
+        sudo sysctl -w net.core.wmem_max=7500000
     - name: Increase UDP buffer sizes (macOS)
       if: matrix.os == 'macos-latest'
       run: |
         sudo sysctl -w kern.ipc.maxsockbuf=6291456
     - name: Build
       run: make build
-    - name: Test with race detector (macOS)
-      if: matrix.os == 'macos-latest'
+    - name: Test with race detector (Ubuntu and MacOS)
+      if: matrix.os != 'windows-latest'
       run: make test-ci-race
     - name: Test without race detector (Windows)
       if: matrix.os == 'windows-latest'
@@ -124,7 +110,7 @@ jobs:
   trigger-beekeeper:
     name: Trigger Beekeeper
     runs-on: ubuntu-latest
-    needs: [test-linux, test-other, lint, coverage]
+    needs: [test, lint, coverage]
     if: github.ref == 'refs/heads/master'
     steps:
     - name: Checkout

Dockerfile

@@ -20,7 +20,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY --from=build /src/dist/bee /usr/local/bin/bee
 

Dockerfile.ci

@@ -4,7 +4,7 @@ USER root
 
 RUN addgroup --system bee --gid 998; \
     adduser -S -G bee -u 998 -D -h /home/bee bee; \
-    mkdir -p /home/bee/.bee && chown 998:998 /home/bee/.bee
+    mkdir -p /home/bee/.bee && chown 998:998 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY bee /bee
 

Dockerfile.dev

@@ -31,7 +31,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     groupadd -r bee --gid 999; \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY --from=build /src/dist/bee /usr/local/bin/bee
 

Dockerfile.goreleaser

@@ -10,7 +10,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY bee /usr/local/bin/bee
 

Dockerfile.scratch

@@ -8,7 +8,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 FROM scratch
 

cmd/bee/cmd/split.go

@@ -104,7 +104,7 @@ func splitRefs(cmd *cobra.Command) {
 				refs = append(refs, ch.Address().String())
 				return nil
 			})
-			writer, err := os.OpenFile(outputFileName, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)
+			writer, err := os.OpenFile(outputFileName, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)
 			if err != nil {
 				return fmt.Errorf("open output file: %w", err)
 			}
@@ -192,7 +192,7 @@ func splitChunks(cmd *cobra.Command) {
 			var chunksCount atomic.Int64
 			store := newPutter(func(chunk swarm.Chunk) error {
 				filePath := filepath.Join(outputDir, chunk.Address().String())
-				err := os.WriteFile(filePath, chunk.Data(), 0o644)
+				err := os.WriteFile(filePath, chunk.Data(), 0o600)
 				if err != nil {
 					return err
 				}

cmd/bee/cmd/split_test.go

@@ -14,6 +14,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"runtime"
 	"sync"
 	"testing"
 
@@ -172,3 +173,47 @@ func requestPipelineFn(s storage.Putter, encrypt bool, rLevel redundancy.Level)
 		return builder.FeedPipeline(ctx, pipe, r)
 	}
 }
+
+// TestDBSplitChunksFilePermissions is a regression test for PERM-01: the
+// "split chunks" command wrote each chunk payload file world-readable (0o644),
+// disclosing chunk contents to other local users on a shared host. Files must
+// not be group- or world-accessible.
+func TestDBSplitChunksFilePermissions(t *testing.T) {
+	t.Parallel()
+	if runtime.GOOS == "windows" {
+		t.Skip("permission bits are not meaningful on windows")
+	}
+
+	buf := make([]byte, 16*1024)
+	if _, err := crand.Read(buf); err != nil {
+		t.Fatal(err)
+	}
+
+	inputFileName := path.Join(t.TempDir(), "input")
+	if err := os.WriteFile(inputFileName, buf, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	outputDir := t.TempDir()
+
+	err := newCommand(t, cmd.WithArgs("split", "chunks", "--input-file", inputFileName, "--output-dir", outputDir)).Execute()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	entries, err := os.ReadDir(outputDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) == 0 {
+		t.Fatal("no chunk files were written")
+	}
+	for _, e := range entries {
+		info, err := e.Info()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if perm := info.Mode().Perm(); perm&0o077 != 0 {
+			t.Fatalf("chunk file %s is group/other-accessible: %#o", e.Name(), perm)
+		}
+	}
+}

pkg/addressbook/addressbook.go

@@ -96,8 +96,9 @@ type store struct {
 	store storage.StateStorer
 	now   func() time.Time
 
-	// mu serializes the read-modify-write in Seen against Put, so that a
-	// concurrent Put is not rolled back by a stale copy of the entry.
+	// mu serializes the read-modify-write in Seen against Put and Remove, so
+	// that a concurrent Put is not rolled back and a concurrent Remove is not
+	// undone by a stale copy of the entry.
 	mu sync.Mutex
 }
 
@@ -184,6 +185,9 @@ func (s *store) Seen(overlays ...swarm.Address) error {
 }
 
 func (s *store) Remove(overlay swarm.Address) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
 	return s.store.Delete(keyPrefix + overlay.String())
 }
 

pkg/addressbook/addressbook_test.go

@@ -253,6 +253,55 @@ func TestSeenKeepsConcurrentPut(t *testing.T) {
 	}
 }
 
+// TestSeenRaceWithRemove pins Seen's read-modify-write against a concurrent
+// Remove of the same overlay. Remove takes the same lock as Put and Seen, so
+// it cannot run while Seen holds the entry it has just read: the removal
+// always wins over Seen's stale write-back.
+func TestSeenRaceWithRemove(t *testing.T) {
+	t.Parallel()
+
+	now := time.Unix(1_000_000, 0)
+	hooked := &hookStore{StateStorer: mock.NewStateStore()}
+	book := addressbook.NewWithClock(hooked, func() time.Time { return now })
+
+	overlay := swarm.NewAddress([]byte{0, 1, 2, 3})
+	addr := newTestAddr(t, overlay)
+
+	if err := book.Put(overlay, addr, true); err != nil {
+		t.Fatal(err)
+	}
+
+	// move past the throttle window, so that Seen takes its write path.
+	now = now.Add(25 * time.Hour)
+
+	// While Seen holds the entry it has just read, kademlia decides the peer is
+	// bad (too many failed connection attempts, overlay mismatch, light node)
+	// and removes it.
+	started, finished := make(chan struct{}), make(chan struct{})
+	hooked.onGet = func() {
+		go func() {
+			defer close(finished)
+			close(started)
+			if err := book.Remove(overlay); err != nil {
+				t.Error(err)
+			}
+		}()
+		<-started
+		// Give Remove a chance to run before Seen writes back. Serialized on
+		// the addressbook lock, it blocks here until Seen returns.
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	if err := book.Seen(overlay); err != nil {
+		t.Fatal(err)
+	}
+	<-finished
+
+	if _, _, err := book.Get(overlay); !errors.Is(err, addressbook.ErrNotFound) {
+		t.Fatalf("concurrent Remove was undone by Seen's stale write-back: err=%v", err)
+	}
+}
+
 // hookStore fires onGet once, immediately after a Get returns, to interleave a
 // concurrent writer inside Seen's read-modify-write.
 type hookStore struct {