From 5cefb13ddd4d51a63a387e74c138035b7b8b8537 Mon Sep 17 00:00:00 2001
From: Roel Janssen <roel@gnu.org>
Date: Thu, 19 Apr 2018 17:11:30 +0200
Subject: [PATCH] guix-daemon: Disable garbage collection for remote
 connections.

* nix/nix-daemon/nix-daemon.cc (isRemoteConnection): New variable.
  (performOp): For wopCollectGarbage, throw an error when isRemoteConnection
  is set.
  (acceptConnection): Set isRemoteConnection when connection is not AF_UNIX.
* tests/guix-daemon.sh: Add a test for the new behavior.
---
 nix/nix-daemon/nix-daemon.cc | 10 +++++++++-
 tests/guix-daemon.sh         | 14 ++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/nix/nix-daemon/nix-daemon.cc b/nix/nix-daemon/nix-daemon.cc
index deb7003d7e..782e4acfc5 100644
--- a/nix/nix-daemon/nix-daemon.cc
+++ b/nix/nix-daemon/nix-daemon.cc
@@ -54,7 +54,9 @@ static FdSink to(STDOUT_FILENO);
 
 bool canSendStderr;
 
-
+/* This variable is used to keep track of whether a connection
+   comes from a host other than the host running guix-daemon. */
+static bool isRemoteConnection;
 
 /* This function is called anytime we want to write something to
    stderr.  If we're in a state where the protocol allows it (i.e.,
@@ -529,6 +531,11 @@ static void performOp(bool trusted, unsigned int clientVersion,
     }
 
     case wopCollectGarbage: {
+        if (isRemoteConnection) {
+            throw Error("Garbage collection is disabled for remote hosts.");
+            break;
+        }
+
         GCOptions options;
         options.action = (GCOptions::GCAction) readInt(from);
         options.pathsToDelete = readStorePaths<PathSet>(from);
@@ -934,6 +941,7 @@ static void acceptConnection(int fdSocket)
                    connection.  Setting these to -1 means: do not change.  */
                 settings.clientUid = clientUid;
 		settings.clientGid = clientGid;
+                isRemoteConnection = (remoteAddr.ss_family != AF_UNIX);
 
                 /* Handle the connection. */
                 from.fd = remote;
diff --git a/tests/guix-daemon.sh b/tests/guix-daemon.sh
index 6f91eb58bf..9ae6e0b77a 100644
--- a/tests/guix-daemon.sh
+++ b/tests/guix-daemon.sh
@@ -194,6 +194,20 @@ do
     kill "$daemon_pid"
 done
 
+# Make sure garbage collection from a TCP connection does not work.
+
+tcp_socket="127.0.0.1:9999"
+guix-daemon --listen="$tcp_socket" &
+daemon_pid=$!
+
+GUIX_DAEMON_SOCKET="guix://$tcp_socket"
+export GUIX_DAEMON_SOCKET
+
+if guix gc; then false; else true; fi
+
+unset GUIX_DAEMON_SOCKET
+kill "$daemon_pid"
+
 # Log compression.
 
 guix-daemon --listen="$socket" --disable-chroot --debug --log-compression=gzip &