From ffebc8c66e0e84c5f06033356bc00cc88f7735c4 Mon Sep 17 00:00:00 2001 From: m8in Date: Fri, 19 Jun 2026 22:38:54 +0200 Subject: [PATCH] Used REGEX for composition sync --- core/base.module.sh | 6 +++--- .../all/etc/sudoers.d/allow-composition-sync-send | 2 +- script/host/zfs/composition-sync/sync-send.sh | 10 +++++----- script/host/zfs/composition-sync/sync.sh | 7 ++++--- 4 files changed, 13 insertions(+), 12 deletions(-) diff --git a/core/base.module.sh b/core/base.module.sh index 3a46648..f9a592c 100755 --- a/core/base.module.sh +++ b/core/base.module.sh @@ -23,9 +23,9 @@ function base.checkAllInputParameters() { _SUCCESS="true" for _ARG in "${@}"; do if [ -n "${_ARG}" ]; then - # Has to start with an alphanumeric char '--' or '/' - if [[ ! "${_ARG}" =~ ^(--|/)?[[:alnum:]] ]]; then - echo "❌ Security base.checkAllInputParameters(): No special characters except '--' or '/' are allowed at the beginning of a parameter: '${_ARG}'" >&2 + # Has to start with an alphanumeric char '--', '/' or '@' + if [[ ! "${_ARG}" =~ ^(--|/|@)?[[:alnum:]] ]]; then + echo "❌ Security base.checkAllInputParameters(): No special characters except '--', '/' or '@' are allowed at the beginning of a parameter: '${_ARG}'" >&2 _SUCCESS="false" fi # No forbidden character is allowed to remain diff --git a/definitions/default/hosts/all/etc/sudoers.d/allow-composition-sync-send b/definitions/default/hosts/all/etc/sudoers.d/allow-composition-sync-send index 52c02ea..3fd6f22 100644 --- a/definitions/default/hosts/all/etc/sudoers.d/allow-composition-sync-send +++ b/definitions/default/hosts/all/etc/sudoers.d/allow-composition-sync-send @@ -6,6 +6,6 @@ Cmnd_Alias C_COMPOSITION_SYNC = \ ^[a-zA-Z0-9][a-zA-Z0-9.-]* \ [a-zA-Z][a-zA-Z0-9/_-]*[a-zA-Z0-9] \ [a-zA-Z0-9][a-zA-Z0-9_-]* \ - ([a-zA-Z0-9][a-zA-Z0-9._:-]*)? \ + (@[a-zA-Z0-9][a-zA-Z0-9._:-]*)? \ ([a-zA-Z0-9][a-zA-Z0-9._:-]*)?$ composition-sync ALL = (root) NOPASSWD: C_COMPOSITION_SYNC diff --git a/script/host/zfs/composition-sync/sync-send.sh b/script/host/zfs/composition-sync/sync-send.sh index 9ec690a..1e0e0ef 100755 --- a/script/host/zfs/composition-sync/sync-send.sh +++ b/script/host/zfs/composition-sync/sync-send.sh @@ -130,14 +130,14 @@ function send() { # Parameter 3: Only alphanumeric characters allowed and [.-] if not leading (due to: -oProxyCommand=...). # Parameter 4: Only alphanumeric characters allowed and [._:-] if not leading (due to: -oProxyCommand=...), but can be empty. # Parameter 5: Only alphanumeric characters allowed and [._:-] if not leading (due to: -oProxyCommand=...), but can be empty. -base.set RECEIVERHOST "${1}" '^[a-zA-Z0-9][a-zA-Z0-9._-]*$' -base.set ZFS_BRANCH "${2}" '^[a-zA-Z][a-zA-Z0-9/_-]*[a-zA-Z0-9]$' -base.set COMPOSITION "${3}" '^[a-zA-Z0-9][a-zA-Z0-9.-]*$' -base.set RECEIVERS_SNAPSHOT "${4}" '^[a-zA-Z0-9][a-zA-Z0-9._:-]*$' optional +base.set RECEIVERHOST "${1}" "${REGEX[HOST]}" +base.set ZFS_BRANCH "${2}" "${REGEX[ZFS]}" +base.set COMPOSITION "${3}" "${REGEX[COMPOSITION]}" +base.set RECEIVERS_SNAPSHOT "${4}" "${REGEX[SNAPSHOT]}" optional base.set RESUME_TOKEN "${5}" '^[a-zA-Z0-9][a-zA-Z0-9._:-]*$' optional # Resume mode -if [ "${RECEIVERS_SNAPSHOT}" == "RESUME" ]; then +if [ "${RECEIVERS_SNAPSHOT}" == "@RESUME" ] && [ -n "${RESUME_TOKEN}" ]; then sendResume "${RESUME_TOKEN}" # Exit preserving the code diff --git a/script/host/zfs/composition-sync/sync.sh b/script/host/zfs/composition-sync/sync.sh index 1ae808c..46ff7b9 100755 --- a/script/host/zfs/composition-sync/sync.sh +++ b/script/host/zfs/composition-sync/sync.sh @@ -108,7 +108,7 @@ function receive() { _RESUME_TOKEN=$(zfs get -H -o value receive_resume_token "${_ZFS}" 2> /dev/null) if [ -n "${_RESUME_TOKEN}" ] && [ "${_RESUME_TOKEN}" != "-" ]; then echo "Resume token present trying to resume at ${_RESUME_TOKEN}" - _COMMON_SNAPSHOT="RESUME" + _COMMON_SNAPSHOT="@RESUME" else _RESUME_TOKEN="" _COMMON_SNAPSHOT=$(zfs list -H -o name -S creation -t snapshot "${_ZFS}" 2> /dev/null | head -n 1) @@ -118,13 +118,14 @@ function receive() { fi # Add "-s" for resumable streams in the next line at zfs receive. Not done yet because of: cannot receive resume stream: kernel modules must be upgraded to receive this stream. - ${_SSH_COMMAND} "sudo ${_SEND_SCRIPT:?"Missing SEND_SCRIPT"} \"${_RECEIVERHOST}\" \"${_ZFS_BRANCH}\" \"${_COMPOSITION}\" \"${_COMMON_SNAPSHOT#${_ZFS}@}\" \"${_RESUME_TOKEN}\"" | zfs receive -v "${_ZFS}" + ${_SSH_COMMAND} "sudo ${_SEND_SCRIPT:?"Missing SEND_SCRIPT"} \"${_RECEIVERHOST}\" \"${_ZFS_BRANCH}\" \"${_COMPOSITION}\" \"@${_COMMON_SNAPSHOT#*@}\" \"${_RESUME_TOKEN}\"" | zfs receive -v "${_ZFS}" if [ $? -ne 0 ]; then echo "Unable to receive stream using these settings:" echo " - Sending host: ${_SOURCEHOST}:${_SSH_PORT}" echo " - Receiving host: ${_RECEIVERHOST}" + echo " - ZFS Branch: ${_ZFS_BRANCH}" echo " - Composition: ${_COMPOSITION}" - echo " - Offered snapshot: ${_ZFS}@${_COMMON_SNAPSHOT#${_ZFS}@}" + echo " - Offered snapshot: @${_COMMON_SNAPSHOT#*@}" echo " - Resume token: ${_RESUME_TOKEN}" echo "Current state of snapshots:" zfs list -t snapshot "${_ZFS}" 2> /dev/null | tail