Descriptor-anchored Secured Filesystem Operations

src/tls_front/cache/disk.rs

@@ -1,27 +1,26 @@
 use std::path::Path;
 
-use tokio::io::AsyncReadExt;
-
 use super::*;
 pub(super) async fn read_disk_entry_bounded(path: &Path) -> std::io::Result<Vec<u8>> {
-    let file = tokio::fs::File::open(path).await?;
-    if file.metadata().await?.len() > TLS_FRONT_DISK_ENTRY_MAX_BYTES {
-        return Err(std::io::Error::new(
-            std::io::ErrorKind::InvalidData,
-            "TLS cache entry exceeds the 1 MiB limit",
-        ));
+    #[cfg(unix)]
+    {
+        crate::util::secure_fs::read_regular_limited_async(
+            path.to_path_buf(),
+            TLS_FRONT_DISK_ENTRY_MAX_BYTES as usize,
+        )
+        .await
     }
-    let mut bytes = Vec::new();
-    file.take(TLS_FRONT_DISK_ENTRY_MAX_BYTES.saturating_add(1))
-        .read_to_end(&mut bytes)
-        .await?;
-    if bytes.len() as u64 > TLS_FRONT_DISK_ENTRY_MAX_BYTES {
-        return Err(std::io::Error::new(
-            std::io::ErrorKind::InvalidData,
-            "TLS cache entry grew beyond the 1 MiB limit while reading",
-        ));
+    #[cfg(not(unix))]
+    {
+        let bytes = tokio::fs::read(path).await?;
+        if bytes.len() as u64 > TLS_FRONT_DISK_ENTRY_MAX_BYTES {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                "TLS cache entry exceeds the 1 MiB limit",
+            ));
+        }
+        Ok(bytes)
     }
-    Ok(bytes)
 }
 
 pub(super) fn cert_info_matches_domain(cached: &CachedTlsData) -> bool {

src/tls_front/cache/runtime.rs

@@ -231,9 +231,6 @@ impl TlsFrontCache {
 
     pub async fn load_from_disk(&self) {
         let path = self.disk_path.clone();
-        if tokio::fs::create_dir_all(&path).await.is_err() {
-            return;
-        }
         let mut loaded = 0usize;
         for name in &self.disk_entry_names {
             let entry_path = path.join(name);
@@ -297,9 +294,6 @@ impl TlsFrontCache {
     }
 
     async fn persist(&self, domain: &str, data: &CachedTlsData) {
-        if tokio::fs::create_dir_all(&self.disk_path).await.is_err() {
-            return;
-        }
         let fname = format!("{}.json", domain.replace(['/', '\\'], "_"));
         let path = self.disk_path.join(fname);
         if let Ok(json) = serde_json::to_vec_pretty(data) {
@@ -311,7 +305,9 @@ impl TlsFrontCache {
                 );
                 return;
             }
-            // best-effort write
+            #[cfg(unix)]
+            let _ = crate::util::secure_fs::atomic_replace_async(path, json, 0o600).await;
+            #[cfg(not(unix))]
             let _ = tokio::fs::write(path, json).await;
         }
     }