PR30962: debuginfod: full paths for X-DEBUGINFOD-FILE/ARCHIVE response headers

Previous code was inconsistent in offering basename versus full
pathname for these headers.  The documentation was not explicit on
this issue.  We now simplify by always passing full names back, and
document this in the debuginfod.8 man page, along with pointers to
how to use proxy front-end servers to strip them if needed.

Signed-Off-By: Frank Ch. Eigler <fche@redhat.com>

diff --git a/debuginfod/debuginfod.cxx b/debuginfod/debuginfod.cxx
index e53228803bb0ee60f38c0cf0e35bb5a2dd4a7162..c11aeda1a3afa7d9bfef87e53cd678bad7647c9e 100644 (file)
--- a/debuginfod/debuginfod.cxx
+++ b/debuginfod/debuginfod.cxx
@@ -1876,11 +1876,10 @@ handle_buildid_f_match (bool internal_req_t,
     }
   else
     {
-      std::string file = b_source0.substr(b_source0.find_last_of("/")+1, b_source0.length());
       add_mhd_response_header (r, "Content-Type", "application/octet-stream");
       add_mhd_response_header (r, "X-DEBUGINFOD-SIZE",
                               to_string(s.st_size).c_str());
-      add_mhd_response_header (r, "X-DEBUGINFOD-FILE", file.c_str());
+      add_mhd_response_header (r, "X-DEBUGINFOD-FILE", b_source0.c_str());
       add_mhd_last_modified (r, s.st_mtime);
       if (verbose > 1)
        obatched(clog) << "serving file " << b_source0 << " section=" << section << endl;
@@ -2164,14 +2163,12 @@ handle_buildid_r_match (bool internal_req_p,
         }
       else
         {
-          std::string file = b_source1.substr(b_source1.find_last_of("/")+1, b_source1.length());
           add_mhd_response_header (r, "Content-Type",
                                    "application/octet-stream");
           add_mhd_response_header (r, "X-DEBUGINFOD-SIZE",
                                    to_string(archive_entry_size(e)).c_str());
-          add_mhd_response_header (r, "X-DEBUGINFOD-ARCHIVE",
-                                   b_source0.c_str());
-          add_mhd_response_header (r, "X-DEBUGINFOD-FILE", file.c_str());
+          add_mhd_response_header (r, "X-DEBUGINFOD-ARCHIVE", b_source0.c_str());
+          add_mhd_response_header (r, "X-DEBUGINFOD-FILE", b_source1.c_str());
           add_mhd_last_modified (r, archive_entry_mtime(e));
           if (verbose > 1)
            obatched(clog) << "serving archive " << b_source0

diff --git a/doc/debuginfod.8 b/doc/debuginfod.8
index d4316bec8175ecc6f70843583b866ef953c4b9cd..4f1f04b386bdde4acf7e09a6f047c214849790c8 100644 (file)
--- a/doc/debuginfod.8
+++ b/doc/debuginfod.8
@@ -304,18 +304,35 @@ Unknown buildid / request combinations result in HTTP error codes.
 This file service resemblance is intentional, so that an installation
 can take advantage of standard HTTP management infrastructure.
 
-Upon finding a file in an archive or simply in the database, some
-custom http headers are added to the response. For files in the
-database X-DEBUGINFOD-FILE and X-DEBUGINFOD-SIZE are added.
-X-DEBUGINFOD-FILE is simply the unescaped filename and
-X-DEBUGINFOD-SIZE is the size of the file. For files found in archives,
-in addition to X-DEBUGINFOD-FILE and X-DEBUGINFOD-SIZE,
-X-DEBUGINFOD-ARCHIVE is added.  X-DEBUGINFOD-ARCHIVE is the name of the
-archive the file was found in.
-
-There are three requests.  In each case, the buildid is encoded as a
-lowercase hexadecimal string.  For example, for a program \fI/bin/ls\fP,
-look at the ELF note GNU_BUILD_ID:
+For most queries, some custom http headers are added to the response,
+providing additional metadata about the buildid-related response.  For example:
+
+.SAMPLE
+% debuginfod-find -v debuginfo /bin/ls |& grep -i x-debuginfo
+x-debuginfod-size: 502024
+x-debuginfod-archive: /mnt/fedora_koji_prod/koji/packages/coreutils/9.3/4.fc39/x86_64/coreutils-debuginfo-9.3-4.fc39.x86_64.rpm
+x-debuginfod-file: /usr/lib/debug/usr/bin/ls-9.3-4.fc39.x86_64.debug
+.ESAMPLE
+
+.TP
+X-DEBUGINFOD-SIZE
+The size of the file, in bytes.  This may differ from the http Content-Length:
+field (if present), due to compression in transit.
+
+.TP
+X-DEBUGINFOD-FILE
+The full path name of the file related to the given buildid.
+
+.TP
+X-DEBUGINFOD-ARCHIVE
+The full path name of the archive that contained the above file, if any.
+
+
+
+
+There are a handful of buildid-related requests.  In each case, the
+buildid is encoded as a lowercase hexadecimal string.  For example,
+for a program \fI/bin/ls\fP, look at the ELF note GNU_BUILD_ID:
 
 .SAMPLE
 % readelf -n /bin/ls | grep -A4 build.id
@@ -391,8 +408,7 @@ contents of the section, not an ELF file.
 This endpoint returns a Prometheus formatted text/plain dump of a
 variety of statistics about the operation of the debuginfod server.
 The exact set of metrics and their meanings may change in future
-versions.  Caution: configuration information (path names, versions)
-may be disclosed.
+versions.
 
 .SH DATA MANAGEMENT
 
@@ -485,8 +501,16 @@ a denial-of-service in terms of RAM, CPU, disk I/O, or network I/O.
 If this is a problem, users are advised to install debuginfod with a
 HTTPS reverse-proxy front-end that enforces site policies for
 firewalling, authentication, integrity, authorization, and load
-control.  The \fI/metrics\fP webapi endpoint is probably not
-appropriate for disclosure to the public.
+control.
+
+Front-end proxies may elide sensitive path name components in
+X-DEBUGINFOD-FILE/ARCHIVE response headers.  For example, using Apache
+httpd's \fBmod_headers\fP, you can remove the entire directory name
+prefix:
+
+.SAMPLE
+Header edit x-debuginfod-archive ".*/" ""
+.ESAMPLE
 
 When relaying queries to upstream debuginfods, debuginfod \fBdoes not\fP
 include any particular security features.  It trusts that the binaries

diff --git a/tests/run-debuginfod-response-headers.sh b/tests/run-debuginfod-response-headers.sh
index 8cb7b843d19db412d64ac49c811a0107164046f8..fbb6a4842fa459bbfc0750d93ac881ef76ae8e22 100755 (executable)
--- a/tests/run-debuginfod-response-headers.sh
+++ b/tests/run-debuginfod-response-headers.sh
@@ -78,8 +78,8 @@ tempfiles vlog-find$PORT1.1
 errfiles vlog-find$PORT1.1
 cat vlog-find$PORT1.1
 grep 'Headers:' vlog-find$PORT1.1
-grep -i 'X-DEBUGINFOD-FILE: prog' vlog-find$PORT1.1
-grep -i 'X-DEBUGINFOD-SIZE: '     vlog-find$PORT1.1
+grep -i 'X-DEBUGINFOD-FILE: .*/prog' vlog-find$PORT1.1
+grep -i 'X-DEBUGINFOD-SIZE: '        vlog-find$PORT1.1
 
 # Check to see if an executable file located in an archive prints the file's description and archive
 env DEBUGINFOD_URLS="http://127.0.0.1:"$PORT1 LD_LIBRARY_PATH=$ldpath ${abs_top_builddir}/debuginfod/debuginfod-find\
@@ -88,9 +88,9 @@ tempfiles vlog-find$PORT1.2
 errfiles vlog-find$PORT1.2
 cat vlog-find$PORT1.2
 grep 'Headers:'               vlog-find$PORT1.2
-grep -i 'X-DEBUGINFOD-FILE: '    vlog-find$PORT1.2
+grep -i 'X-DEBUGINFOD-FILE: .*/.*'    vlog-find$PORT1.2
 grep -i 'X-DEBUGINFOD-SIZE: '    vlog-find$PORT1.2
-grep -i 'X-DEBUGINFOD-ARCHIVE: ' vlog-find$PORT1.2
+grep -i 'X-DEBUGINFOD-ARCHIVE: .*/.*' vlog-find$PORT1.2
 
 # Check that X-DEBUGINFOD-SIZE matches the size of each file
 for file in vlog-find$PORT1.1 vlog-find$PORT1.2