mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: harden qdrant restore safety

Browse Source
This commit is contained in:
marcopan
2026-08-08 19:37:09 +02:00
parent a6dbe1d023
commit afaab5931f
3 changed files with 461 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/test-vector-backup-restore-safety.sh
+254 -33
View File
@@ -9,9 +9,10 @@ mkdir "$fakebin"
project="thoth-task8"
volume_name="${project}_qdrant-data"
mountpoint="$tmp/docker-volumes/$volume_name/_data"
mkdir -p "$mountpoint/collections/demo"
printf '%s' before-backup >"$mountpoint/collections/demo/state.json"
volume_root="$tmp/volumes"
volume_dir="$volume_root/$volume_name"
mkdir -p "$volume_dir/collections/demo"
printf '%s' before-backup >"$volume_dir/collections/demo/state.json"
cat >"$fakebin/docker" <<'SH'
#!/bin/sh
@@ -19,8 +20,49 @@ set -eu
log_file=${DOCKER_LOG:?}
printf '%s\n' "$*" >>"$log_file"
volume_dir_for() {
printf '%s/%s\n' "${VOLUME_ROOT:?}" "$1"
}
run_backup() {
volume_name=$1
backup_dir=$2
output_name=$3
staging=$(mktemp -d "${TMPDIR:-/tmp}/fake-qdrant-backup.XXXXXX")
mkdir -p "$staging/payload"
cat >"$staging/manifest.env" <<EOF
format=thothii-qdrant-backup-v1
project_name=${PROJECT_NAME:?}
volume_name=$volume_name
volume_role=qdrant-data
helper_image=${HELPER_IMAGE:?}
EOF
cp -R "$(volume_dir_for "$volume_name")"/. "$staging/payload"/
tar -C "$staging" -cf "$backup_dir/$output_name" manifest.env payload
rm -rf "$staging"
}
run_restore() {
volume_name=$1
backup_dir=$2
input_name=$3
volume_dir=$(volume_dir_for "$volume_name")
snapshot=$(mktemp -d "${TMPDIR:-/tmp}/fake-qdrant-rollback.XXXXXX")
extract=$(mktemp -d "${TMPDIR:-/tmp}/fake-qdrant-extract.XXXXXX")
cp -R "$volume_dir"/. "$snapshot"/
find "$volume_dir" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
if [ "${RUN_FAIL_AFTER_CLEANUP:-0}" = 1 ]; then
cp -R "$snapshot"/. "$volume_dir"/
rm -rf "$snapshot" "$extract"
exit 17
fi
tar -C "$extract" -xf "$backup_dir/$input_name"
cp -R "$extract/payload"/. "$volume_dir"/
rm -rf "$snapshot" "$extract"
}
if [ "$1" = volume ] && [ "$2" = ls ]; then
if [ "${VOLUME_LS_OUTPUT:-}" = multiple ]; then
if [ "${VOLUME_LS_OUTPUT:-single}" = multiple ]; then
printf '%s\n%s\n' "${PROJECT_NAME}_qdrant-data" "${PROJECT_NAME}_qdrant-data-copy"
exit 0
fi
@@ -29,7 +71,10 @@ if [ "$1" = volume ] && [ "$2" = ls ]; then
fi
if [ "$1" = volume ] && [ "$2" = inspect ]; then
printf '%s\n' "${MOUNTPOINT:?}"
printf '%s %s %s\n' \
"${PROJECT_NAME}_qdrant-data" \
"${PROJECT_NAME}" \
"qdrant-data"
exit 0
fi
@@ -41,68 +86,244 @@ if [ "$1" = compose ] && [ "$2" = --project-name ]; then
fi
exit 0
;;
stop)
exit 0
;;
start)
stop|start)
exit 0
;;
esac
fi
if [ "$1" = run ]; then
shift
volume_mount=
backup_mount=
backup_readonly=0
while [ "$#" -gt 0 ]; do
case "$1" in
--mount)
case "$2" in
type=volume,src=*,dst=/qdrant-data*)
volume_mount=$2
;;
type=bind,src=*,dst=/backup*)
backup_mount=$2
;;
type=bind,src=*,dst=/restore-backup,readonly)
backup_mount=$2
backup_readonly=1
;;
esac
shift 2
;;
--rm)
shift
;;
*)
break
;;
esac
done
image=$1
shift
last_arg=
for arg in "$@"; do last_arg=$arg; done
volume_name=$(printf '%s' "$volume_mount" | sed -n 's/.*src=\([^,]*\),dst=.*/\1/p')
backup_src=$(printf '%s' "$backup_mount" | sed -n 's/.*src=\([^,]*\),dst=.*/\1/p')
[ "$image" = "${HELPER_IMAGE:?}" ] || exit 19
[ -n "$volume_name" ] || exit 20
[ -n "$backup_src" ] || exit 21
case "$backup_mount" in
*dst=/backup)
run_backup "$volume_name" "$backup_src" "$last_arg"
;;
*dst=/restore-backup,readonly)
[ "$backup_readonly" -eq 1 ] || exit 22
run_restore "$volume_name" "$backup_src" "$last_arg"
;;
*)
exit 23
;;
esac
exit 0
fi
exit 0
SH
chmod 0755 "$fakebin/docker"
make_foreign_archive() {
archive_path=$1
python - "$archive_path" <<'PY'
import io, tarfile, sys
archive = sys.argv[1]
with tarfile.open(archive, "w") as tf:
manifest = b"format=wrong-format\nproject_name=foreign\nvolume_name=foreign_qdrant-data\nvolume_role=qdrant-data\nhelper_image=foreign\n"
info = tarfile.TarInfo("manifest.env")
info.size = len(manifest)
tf.addfile(info, io.BytesIO(manifest))
data = b"x"
info = tarfile.TarInfo("../escape")
info.size = len(data)
tf.addfile(info, io.BytesIO(data))
PY
}
make_symlink_archive() {
archive_path=$1
python - "$archive_path" <<'PY'
import io, tarfile, sys
archive = sys.argv[1]
with tarfile.open(archive, "w") as tf:
manifest = b"format=thothii-qdrant-backup-v1\nproject_name=thoth-task8\nvolume_name=thoth-task8_qdrant-data\nvolume_role=qdrant-data\nhelper_image=qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c\n"
info = tarfile.TarInfo("manifest.env")
info.size = len(manifest)
tf.addfile(info, io.BytesIO(manifest))
directory = tarfile.TarInfo("payload")
directory.type = tarfile.DIRTYPE
tf.addfile(directory)
link = tarfile.TarInfo("payload/collections-link")
link.type = tarfile.SYMTYPE
link.linkname = "/etc/passwd"
tf.addfile(link)
PY
}
backup_output="$tmp/qdrant-backup.tar"
docker_log="$tmp/docker.log"
PATH="$fakebin:$PATH" DOCKER_LOG="$docker_log" PROJECT_NAME="$project" MOUNTPOINT="$mountpoint" \
docker_log="$tmp/docker-backup.log"
PATH="$fakebin:$PATH" DOCKER_LOG="$docker_log" PROJECT_NAME="$project" VOLUME_ROOT="$volume_root" \
HELPER_IMAGE="qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c" \
./scripts/vector-backup.sh --project-name "$project" --output "$backup_output" >/dev/null
test -s "$backup_output"
tar -tf "$backup_output" | grep -q '^./collections/demo/state.json$'
grep -q "volume ls --filter label=com.docker.compose.project=$project --filter label=com.docker.compose.volume=qdrant-data" "$docker_log"
grep -q "compose --project-name $project ps --status running -q qdrant" "$docker_log"
tar -tf "$backup_output" | grep -qx 'manifest.env'
tar -tf "$backup_output" | grep -qx 'payload/collections/demo/state.json'
tar -xOf "$backup_output" manifest.env | grep -qx 'format=thothii-qdrant-backup-v1'
tar -xOf "$backup_output" manifest.env | grep -qx "project_name=$project"
tar -xOf "$backup_output" manifest.env | grep -qx "volume_name=$volume_name"
grep -q "run --rm --mount type=volume,src=$volume_name,dst=/qdrant-data,readonly --mount type=bind,src=$tmp,dst=/backup" "$docker_log"
grep -q "compose --project-name $project stop qdrant" "$docker_log"
grep -q "compose --project-name $project start qdrant" "$docker_log"
if grep -q "volume inspect --format {{ .Mountpoint }}" "$docker_log"; then
echo "backup consulted Docker mountpoints" >&2
exit 1
fi
if grep -q "prune" "$docker_log"; then
echo "backup attempted global docker cleanup" >&2
exit 1
fi
existing="$tmp/existing.tar"
printf '%s' sentinel >"$existing"
if PATH="$fakebin:$PATH" DOCKER_LOG="$tmp/existing.log" PROJECT_NAME="$project" MOUNTPOINT="$mountpoint" \
./scripts/vector-backup.sh --project-name "$project" --output "$existing" >"$tmp/existing.out" 2>"$tmp/existing.err"; then
if PATH="$fakebin:$PATH" DOCKER_LOG="$tmp/existing.log" PROJECT_NAME="$project" VOLUME_ROOT="$volume_root" \
HELPER_IMAGE="qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c" \
./scripts/vector-backup.sh --project-name "$project" --output "$existing" >"$tmp/existing.out" 2>"$tmp/existing.err"; then
echo "backup overwrote an existing archive" >&2
exit 1
fi
test "$(cat "$existing")" = sentinel
if PATH="$fakebin:$PATH" DOCKER_LOG="$tmp/ambiguous.log" PROJECT_NAME="$project" MOUNTPOINT="$mountpoint" VOLUME_LS_OUTPUT=multiple \
./scripts/vector-backup.sh --project-name "$project" --output "$tmp/ambiguous.tar" >"$tmp/ambiguous.out" 2>"$tmp/ambiguous.err"; then
if PATH="$fakebin:$PATH" DOCKER_LOG="$tmp/ambiguous.log" PROJECT_NAME="$project" VOLUME_ROOT="$volume_root" \
VOLUME_LS_OUTPUT=multiple HELPER_IMAGE="qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c" \
./scripts/vector-backup.sh --project-name "$project" --output "$tmp/ambiguous.tar" >"$tmp/ambiguous.out" 2>"$tmp/ambiguous.err"; then
echo "backup accepted an ambiguous qdrant-data target" >&2
exit 1
fi
grep -q 'exactly one qdrant-data volume' "$tmp/ambiguous.err"
restore_input="$tmp/restore.tar"
restore_source="$tmp/restore-source"
mkdir -p "$restore_source/collections/demo"
printf '%s' restored >"$restore_source/collections/demo/state.json"
tar -C "$restore_source" -cf "$restore_input" .
foreign_archive="$tmp/foreign.tar"
make_foreign_archive "$foreign_archive"
printf '%s' before-malicious >"$volume_dir/collections/demo/state.json"
foreign_log="$tmp/foreign.log"
: >"$foreign_log"
if PATH="$fakebin:$PATH" DOCKER_LOG="$foreign_log" PROJECT_NAME="$project" VOLUME_ROOT="$volume_root" \
MOUNTPOINT="/" HELPER_IMAGE="qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c" \
./scripts/vector-restore.sh --project-name "$project" --input "$foreign_archive" --confirm-project "$project" \
>"$tmp/foreign.out" 2>"$tmp/foreign.err"; then
echo "restore accepted a malformed or foreign archive" >&2
exit 1
fi
grep -Eq 'manifest|archive|foreign|unexpected|traversal' "$tmp/foreign.err"
test "$(cat "$volume_dir/collections/demo/state.json")" = before-malicious
if grep -q "compose --project-name $project stop qdrant" "$foreign_log"; then
echo "restore stopped qdrant before archive validation" >&2
exit 1
fi
if grep -q '^run ' "$foreign_log"; then
echo "restore ran helper container before archive validation" >&2
exit 1
fi
if grep -q "volume inspect --format {{ .Mountpoint }}" "$foreign_log"; then
echo "restore consulted Docker mountpoints during malformed archive rejection" >&2
exit 1
fi
if PATH="$fakebin:$PATH" DOCKER_LOG="$tmp/restore-refuse.log" PROJECT_NAME="$project" MOUNTPOINT="$mountpoint" \
./scripts/vector-restore.sh --project-name "$project" --input "$restore_input" --confirm-project wrong-project \
>"$tmp/restore-refuse.out" 2>"$tmp/restore-refuse.err"; then
symlink_archive="$tmp/symlink.tar"
make_symlink_archive "$symlink_archive"
symlink_log="$tmp/symlink.log"
: >"$symlink_log"
if PATH="$fakebin:$PATH" DOCKER_LOG="$symlink_log" PROJECT_NAME="$project" VOLUME_ROOT="$volume_root" \
HELPER_IMAGE="qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c" \
./scripts/vector-restore.sh --project-name "$project" --input "$symlink_archive" --confirm-project "$project" \
>"$tmp/symlink.out" 2>"$tmp/symlink.err"; then
echo "restore accepted a symlink-bearing archive" >&2
exit 1
fi
grep -Eq 'symlink|hardlink|device|fifo|socket|archive' "$tmp/symlink.err"
if grep -q "compose --project-name $project stop qdrant" "$symlink_log"; then
echo "restore stopped qdrant before symlink archive rejection" >&2
exit 1
fi
restore_source="$tmp/restore-source"
mkdir -p "$restore_source/payload/collections/demo"
cat >"$restore_source/manifest.env" <<EOF
format=thothii-qdrant-backup-v1
project_name=$project
volume_name=$volume_name
volume_role=qdrant-data
helper_image=qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c
created_utc=2026-08-08T17:35:36Z
EOF
printf '%s' restored >"$restore_source/payload/collections/demo/state.json"
restore_input="$tmp/restore.tar"
tar -C "$restore_source" -cf "$restore_input" manifest.env payload
if PATH="$fakebin:$PATH" DOCKER_LOG="$tmp/confirm.log" PROJECT_NAME="$project" VOLUME_ROOT="$volume_root" \
HELPER_IMAGE="qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c" \
./scripts/vector-restore.sh --project-name "$project" --input "$restore_input" --confirm-project wrong-project \
>"$tmp/confirm.out" 2>"$tmp/confirm.err"; then
echo "restore skipped explicit project confirmation" >&2
exit 1
fi
grep -q 'confirmation must match --project-name exactly' "$tmp/restore-refuse.err"
test "$(cat "$mountpoint/collections/demo/state.json")" = before-backup
grep -q 'confirmation must match --project-name exactly' "$tmp/confirm.err"
printf '%s' modified-live >"$mountpoint/collections/demo/state.json"
printf '%s' modified-live >"$volume_dir/collections/demo/state.json"
restore_log="$tmp/restore-ok.log"
PATH="$fakebin:$PATH" DOCKER_LOG="$restore_log" PROJECT_NAME="$project" MOUNTPOINT="$mountpoint" \
PATH="$fakebin:$PATH" DOCKER_LOG="$restore_log" PROJECT_NAME="$project" VOLUME_ROOT="$volume_root" \
HELPER_IMAGE="qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c" \
./scripts/vector-restore.sh --project-name "$project" --input "$restore_input" --confirm-project "$project" >/dev/null
test "$(cat "$mountpoint/collections/demo/state.json")" = restored
test "$(cat "$volume_dir/collections/demo/state.json")" = restored
grep -q "compose --project-name $project stop qdrant" "$restore_log"
grep -q "compose --project-name $project start qdrant" "$restore_log"
grep -q "volume inspect --format {{ .Mountpoint }} $volume_name" "$restore_log"
grep -q "run --rm --mount type=volume,src=$volume_name,dst=/qdrant-data --mount type=bind,src=$tmp,dst=/restore-backup,readonly" "$restore_log"
if grep -q "volume inspect --format {{ .Mountpoint }}" "$restore_log"; then
echo "restore consulted Docker mountpoints during normal restore" >&2
exit 1
fi
if grep -q "prune" "$restore_log"; then
echo "restore attempted global docker cleanup" >&2
exit 1
fi
echo "qdrant backup/restore target resolution, refusal, and service-state contracts passed."
printf '%s' rollback-source >"$volume_dir/collections/demo/state.json"
rollback_log="$tmp/restore-rollback.log"
if PATH="$fakebin:$PATH" DOCKER_LOG="$rollback_log" PROJECT_NAME="$project" VOLUME_ROOT="$volume_root" \
RUN_FAIL_AFTER_CLEANUP=1 HELPER_IMAGE="qdrant/qdrant:v1.18.2@sha256:75eab8c4ba42096724fdcfde8b4de0b5713d529dde32f285a1f86fdcb2c9e50c" \
./scripts/vector-restore.sh --project-name "$project" --input "$restore_input" --confirm-project "$project" \
>"$tmp/rollback.out" 2>"$tmp/rollback.err"; then
echo "restore ignored helper failure after cleanup" >&2
exit 1
fi
test "$(cat "$volume_dir/collections/demo/state.json")" = rollback-source
grep -q "compose --project-name $project stop qdrant" "$rollback_log"
grep -q "compose --project-name $project start qdrant" "$rollback_log"
echo "qdrant backup/restore archive validation, scoped helper execution, and rollback safety passed."