diff --git a/.dockerignore b/.dockerignore index e7bf1da..cd39ab4 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,4 +1,5 @@ Dockerfile +modd.* tmp/**/* dist/* go.work @@ -6,3 +7,4 @@ go.work.sum modd.*conf test-initrd* test-initrd/**/* +target diff --git a/.gitignore b/.gitignore index 008db5b..ac39382 100644 --- a/.gitignore +++ b/.gitignore @@ -2,6 +2,8 @@ /dist /qemu.pid /test-initrd.cpio +/bootstrap.tar /tmp /go.work /go.work.sum +/target diff --git a/Cargo.lock b/Cargo.lock new file mode 100644 index 0000000..2251147 --- /dev/null +++ b/Cargo.lock @@ -0,0 +1,766 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 4 + +[[package]] +name = "addr2line" +version = "0.24.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1" +dependencies = [ + "gimli", +] + +[[package]] +name = "adler2" +version = "2.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" + +[[package]] +name = "aho-corasick" +version = "1.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916" +dependencies = [ + "memchr", +] + +[[package]] +name = "anstream" +version = "0.6.19" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933" +dependencies = [ + "anstyle", + "anstyle-parse", + "anstyle-query", + "anstyle-wincon", + "colorchoice", + "is_terminal_polyfill", + "utf8parse", +] + +[[package]] +name = "anstyle" +version = "1.0.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd" + +[[package]] +name = "anstyle-parse" +version = "0.2.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2" +dependencies = [ + "utf8parse", +] + +[[package]] +name = "anstyle-query" +version = "1.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9" +dependencies = [ + "windows-sys 0.59.0", +] + +[[package]] +name = "anstyle-wincon" +version = "3.0.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882" +dependencies = [ + "anstyle", + "once_cell_polyfill", + "windows-sys 0.59.0", +] + +[[package]] +name = "backtrace" +version = "0.3.75" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002" +dependencies = [ + "addr2line", + "cfg-if", + "libc", + "miniz_oxide", + "object", + "rustc-demangle", + "windows-targets", +] + +[[package]] +name = "bitflags" +version = "2.9.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967" + +[[package]] +name = "bytes" +version = "1.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a" + +[[package]] +name = "cc" +version = "1.2.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc" +dependencies = [ + "jobserver", + "libc", + "shlex", +] + +[[package]] +name = "cfg-if" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268" + +[[package]] +name = "cfg_aliases" +version = "0.2.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" + +[[package]] +name = "colorchoice" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75" + +[[package]] +name = "cpio" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "938e716cb1ade5d6c8f959c13a7248b889c07491fc7e41167c3afe20f8f0de1e" + +[[package]] +name = "either" +version = "1.15.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719" + +[[package]] +name = "env_filter" +version = "0.1.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0" +dependencies = [ + "log", + "regex", +] + +[[package]] +name = "env_logger" +version = "0.11.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f" +dependencies = [ + "anstream", + "anstyle", + "env_filter", + "jiff", + "log", +] + +[[package]] +name = "equivalent" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" + +[[package]] +name = "eyre" +version = "0.6.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7cd915d99f24784cdc19fd37ef22b97e3ff0ae756c7e492e9fbfe897d61e2aec" +dependencies = [ + "indenter", + "once_cell", +] + +[[package]] +name = "getrandom" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4" +dependencies = [ + "cfg-if", + "libc", + "r-efi", + "wasi 0.14.2+wasi-0.2.4", +] + +[[package]] +name = "gimli" +version = "0.31.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f" + +[[package]] +name = "hashbrown" +version = "0.15.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5" + +[[package]] +name = "indenter" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683" + +[[package]] +name = "indexmap" +version = "2.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e" +dependencies = [ + "equivalent", + "hashbrown", +] + +[[package]] +name = "init" +version = "2.4.0" +dependencies = [ + "cpio", + "env_logger", + "eyre", + "itertools", + "libc", + "log", + "lz4", + "nix", + "regex", + "serde", + "serde_json", + "serde_yaml", + "shell-escape", + "termios", + "tokio", + "unix_mode", + "zstd", +] + +[[package]] +name = "is_terminal_polyfill" +version = "1.70.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf" + +[[package]] +name = "itertools" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285" +dependencies = [ + "either", +] + +[[package]] +name = "itoa" +version = "1.0.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c" + +[[package]] +name = "jiff" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49" +dependencies = [ + "jiff-static", + "log", + "portable-atomic", + "portable-atomic-util", + "serde", +] + +[[package]] +name = "jiff-static" +version = "0.2.15" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "jobserver" +version = "0.1.33" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a" +dependencies = [ + "getrandom", + "libc", +] + +[[package]] +name = "libc" +version = "0.2.173" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d8cfeafaffdbc32176b64fb251369d52ea9f0a8fbc6f8759edffef7b525d64bb" + +[[package]] +name = "log" +version = "0.4.27" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94" + +[[package]] +name = "lz4" +version = "1.28.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a20b523e860d03443e98350ceaac5e71c6ba89aea7d960769ec3ce37f4de5af4" +dependencies = [ + "lz4-sys", +] + +[[package]] +name = "lz4-sys" +version = "1.11.1+lz4-1.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6bd8c0d6c6ed0cd30b3652886bb8711dc4bb01d637a68105a3d5158039b418e6" +dependencies = [ + "cc", + "libc", +] + +[[package]] +name = "memchr" +version = "2.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0" + +[[package]] +name = "miniz_oxide" +version = "0.8.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316" +dependencies = [ + "adler2", +] + +[[package]] +name = "mio" +version = "1.0.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c" +dependencies = [ + "libc", + "wasi 0.11.1+wasi-snapshot-preview1", + "windows-sys 0.59.0", +] + +[[package]] +name = "nix" +version = "0.30.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6" +dependencies = [ + "bitflags", + "cfg-if", + "cfg_aliases", + "libc", +] + +[[package]] +name = "object" +version = "0.36.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87" +dependencies = [ + "memchr", +] + +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + +[[package]] +name = "once_cell_polyfill" +version = "1.70.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad" + +[[package]] +name = "pin-project-lite" +version = "0.2.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b" + +[[package]] +name = "pkg-config" +version = "0.3.32" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c" + +[[package]] +name = "portable-atomic" +version = "1.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483" + +[[package]] +name = "portable-atomic-util" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507" +dependencies = [ + "portable-atomic", +] + +[[package]] +name = "proc-macro2" +version = "1.0.95" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "quote" +version = "1.0.40" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d" +dependencies = [ + "proc-macro2", +] + +[[package]] +name = "r-efi" +version = "5.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" + +[[package]] +name = "regex" +version = "1.11.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191" +dependencies = [ + "aho-corasick", + "memchr", + "regex-automata", + "regex-syntax", +] + +[[package]] +name = "regex-automata" +version = "0.4.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908" +dependencies = [ + "aho-corasick", + "memchr", + "regex-syntax", +] + +[[package]] +name = "regex-syntax" +version = "0.8.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c" + +[[package]] +name = "rustc-demangle" +version = "0.1.25" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f" + +[[package]] +name = "ryu" +version = "1.0.20" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f" + +[[package]] +name = "serde" +version = "1.0.219" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6" +dependencies = [ + "serde_derive", +] + +[[package]] +name = "serde_derive" +version = "1.0.219" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "serde_json" +version = "1.0.140" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373" +dependencies = [ + "itoa", + "memchr", + "ryu", + "serde", +] + +[[package]] +name = "serde_yaml" +version = "0.9.34+deprecated" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47" +dependencies = [ + "indexmap", + "itoa", + "ryu", + "serde", + "unsafe-libyaml", +] + +[[package]] +name = "shell-escape" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f" + +[[package]] +name = "shlex" +version = "1.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" + +[[package]] +name = "signal-hook-registry" +version = "1.4.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410" +dependencies = [ + "libc", +] + +[[package]] +name = "socket2" +version = "0.5.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678" +dependencies = [ + "libc", + "windows-sys 0.52.0", +] + +[[package]] +name = "syn" +version = "2.0.103" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e4307e30089d6fd6aff212f2da3a1f9e32f3223b1f010fb09b7c95f90f3ca1e8" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "termios" +version = "0.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "411c5bf740737c7918b8b1fe232dca4dc9f8e754b8ad5e20966814001ed0ac6b" +dependencies = [ + "libc", +] + +[[package]] +name = "tokio" +version = "1.45.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779" +dependencies = [ + "backtrace", + "bytes", + "libc", + "mio", + "pin-project-lite", + "signal-hook-registry", + "socket2", + "tokio-macros", + "windows-sys 0.52.0", +] + +[[package]] +name = "tokio-macros" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "unicode-ident" +version = "1.0.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512" + +[[package]] +name = "unix_mode" +version = "0.1.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b55eedc365f81a3c32aea49baf23fa965e3cd85bcc28fb8045708c7388d124ef" + +[[package]] +name = "unsafe-libyaml" +version = "0.2.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861" + +[[package]] +name = "utf8parse" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" + +[[package]] +name = "wasi" +version = "0.11.1+wasi-snapshot-preview1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" + +[[package]] +name = "wasi" +version = "0.14.2+wasi-0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3" +dependencies = [ + "wit-bindgen-rt", +] + +[[package]] +name = "windows-sys" +version = "0.52.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d" +dependencies = [ + "windows-targets", +] + +[[package]] +name = "windows-sys" +version = "0.59.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" +dependencies = [ + "windows-targets", +] + +[[package]] +name = "windows-targets" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" +dependencies = [ + "windows_aarch64_gnullvm", + "windows_aarch64_msvc", + "windows_i686_gnu", + "windows_i686_gnullvm", + "windows_i686_msvc", + "windows_x86_64_gnu", + "windows_x86_64_gnullvm", + "windows_x86_64_msvc", +] + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" + +[[package]] +name = "windows_i686_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" + +[[package]] +name = "windows_i686_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" + +[[package]] +name = "windows_i686_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.52.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" + +[[package]] +name = "wit-bindgen-rt" +version = "0.39.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1" +dependencies = [ + "bitflags", +] + +[[package]] +name = "zstd" +version = "0.13.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a" +dependencies = [ + "zstd-safe", +] + +[[package]] +name = "zstd-safe" +version = "7.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d" +dependencies = [ + "zstd-sys", +] + +[[package]] +name = "zstd-sys" +version = "2.0.15+zstd.1.5.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eb81183ddd97d0c74cedf1d50d85c8d08c1b8b68ee863bdee9e706eedba1a237" +dependencies = [ + "cc", + "pkg-config", +] diff --git a/Cargo.toml b/Cargo.toml new file mode 100644 index 0000000..407196f --- /dev/null +++ b/Cargo.toml @@ -0,0 +1,30 @@ +[package] +name = "init" +version = "2.4.0" +edition = "2024" + +[profile.release] +strip = true +panic = "abort" +opt-level = "z" +lto = true +codegen-units = 1 + +[dependencies] +libc = { version = "0.2", default-features = false } +env_logger = "0.11.3" +eyre = "0.6.12" +itertools = "0.14.0" +log = "0.4.21" +nix = { version = "0.30.1", features = ["feature", "mount", "process", "reboot", "signal"] } +regex = "1.11.1" +serde = { version = "1.0.198", features = ["derive"] } +serde_json = "1.0.116" +serde_yaml = "0.9.34" +shell-escape = "0.1.5" +tokio = { version = "1.38.0", features = ["rt", "net", "fs", "process", "io-std", "io-util", "sync", "macros", "signal"] } +termios = "0.3.3" +zstd = "0.13.3" +unix_mode = "0.1.4" +cpio = "0.4.1" +lz4 = "1.28.1" diff --git a/Dockerfile b/Dockerfile index 0881909..5919e8e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,39 +1,44 @@ -from golang:1.23.2-alpine3.20 as build -run apk add --no-cache gcc musl-dev linux-headers eudev-dev upx +from rust:1.87.0-alpine as rust + +run apk add --no-cache git musl-dev libudev-zero-dev # pkgconfig cryptsetup-dev lvm2-dev clang-dev clang-static workdir /src - copy . . - -env CGO_ENABLED=1 -run \ - --mount=type=cache,id=gomod,target=/go/pkg/mod \ - --mount=type=cache,id=gobuild,target=/root/.cache/go-build \ - go test ./... \ -&& go build -ldflags "-s -w" -o /go/bin/init -trimpath . - -run upx /go/bin/init +run --mount=type=cache,id=novit-rs,target=/usr/local/cargo/registry \ + --mount=type=cache,id=novit-rs-target,sharing=private,target=/src/target \ + cargo build --release && cp target/release/init / # ------------------------------------------------------------------------ -from alpine:3.20.3 as initrd +from alpine:3.22.0 as initrd +run apk add zstd lz4 -run apk add --no-cache xz +workdir /system -workdir /layer run . /etc/os-release \ && wget -O- https://dl-cdn.alpinelinux.org/alpine/v${VERSION_ID%.*}/releases/x86_64/alpine-minirootfs-${VERSION_ID}-x86_64.tar.gz |tar zxv -run apk add --no-cache -p . musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs lsblk -run rm -rf usr/share/apk var/cache/apk +run apk add --no-cache --update -p . musl coreutils \ + lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup \ + e2fsprogs lsblk openssh-server wireguard-tools-wg-quick \ + && rm -rf usr/share/apk var/cache/apk etc/motd -copy --from=build /go/bin/init . +copy etc/sshd_config etc/ssh/sshd_config + +run mkdir /layer \ + && mv dev /layer \ +# && find |cpio -H newc -o |lz4 >/layer/system.alz4 + && find |cpio -H newc -o |zstd -19 >/layer/system.azstd + +workdir /layer +copy --from=rust /init init +run mkdir -p bin run var/log; cd bin && for cmd in init-version init-connect bootstrap; do ln -s ../init $cmd; done # check viability -run chroot /layer /init hello +run chroot . init-version run find |cpio -H newc -o >/initrd # ------------------------------------------------------------------------ -from alpine:3.20.3 +from alpine:3.22.0 copy --from=initrd /initrd / entrypoint ["base64","/initrd"] diff --git a/Dockerfile.build b/Dockerfile.build new file mode 100644 index 0000000..057ea2e --- /dev/null +++ b/Dockerfile.build @@ -0,0 +1,5 @@ +from rust:1.77.1-alpine as rust + +run apk add --no-cache musl-dev +run apk add --no-cache musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs lsblk + diff --git a/Dockerfile.test b/Dockerfile.test new file mode 100644 index 0000000..431e758 --- /dev/null +++ b/Dockerfile.test @@ -0,0 +1,2 @@ +from alpine:3.19.0 +run apk add --no-cache musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs lsblk diff --git a/apply-config.go b/apply-config.go deleted file mode 100644 index 3f71b87..0000000 --- a/apply-config.go +++ /dev/null @@ -1,140 +0,0 @@ -package main - -import ( - "os" - "path/filepath" - "strconv" - "strings" - "syscall" - "time" - - "github.com/rs/zerolog/log" - yaml "gopkg.in/yaml.v2" - - "novit.tech/direktil/pkg/config/apply" -) - -var loopOffset = 0 - -func applyConfig(cfgPath string, bootMounted bool) (cfg *configV1) { - cfgBytes, err := os.ReadFile(cfgPath) - if err != nil { - fatalf("failed to read %s: %v", cfgPath, err) - } - - cfg = &configV1{} - if err := yaml.Unmarshal(cfgBytes, cfg); err != nil { - fatal("failed to load config: ", err) - } - - // mount layers - if len(cfg.Layers) == 0 { - fatal("no layers configured!") - } - - layersInMemory := paramBool("layers-in-mem", false) - - log.Info().Strs("layers", cfg.Layers).Bool("in-memory", layersInMemory).Msg("mounting layers") - - const layersInMemDir = "/layers-in-mem" - if layersInMemory { - mkdir(layersInMemDir, 0700) - mount("layers-mem", layersInMemDir, "tmpfs", 0, "") - } - - lowers := make([]string, len(cfg.Layers)) - for i, layer := range cfg.Layers { - log := log.With().Str("layer", layer).Logger() - - path := layerPath(layer) - - info, err := os.Stat(path) - if err != nil { - fatal(err) - } - - log.Info().Int64("size", info.Size()).Msg("layer found") - - if layersInMemory { - log.Info().Msg("copying to memory") - targetPath := filepath.Join(layersInMemDir, layer) - cp(path, targetPath) - path = targetPath - } - - dir := "/layers/" + layer - - lowers[i] = dir - - mountSquahfs(path, dir) - } - - // prepare system root - mount("mem", "/changes", "tmpfs", 0, "") - - mkdir("/changes/workdir", 0755) - mkdir("/changes/upperdir", 0755) - - mount("overlay", "/system", "overlay", rootMountFlags, - "lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir") - - // make root rshared (default in systemd, required by Kubernetes 1.10+) - // equivalent to "mount --make-rshared /" - // see kernel's Documentation/sharedsubtree.txt (search rshared) - if err := syscall.Mount("", "/system", "", syscall.MS_SHARED|syscall.MS_REC, ""); err != nil { - fatalf("FATAL: mount --make-rshared / failed: %v", err) - } - - if bootMounted { - if layersInMemory { - if err := syscall.Unmount("/boot", 0); err != nil { - log.Warn().Err(err).Msg("failed to unmount /boot") - time.Sleep(2 * time.Second) - } - - } else { - mount("/boot", "/system/boot", "", syscall.MS_BIND, "") - } - } - - // - write files - apply.Files(cfg.Files, "/system") - - // - groups - for _, group := range cfg.Groups { - logEvt := log.Info().Str("group", group.Name) - - opts := make([]string, 0) - opts = append(opts /* chroot */, "/system", "groupadd", "-r") - if group.Gid != 0 { - opts = append(opts, "-g", strconv.Itoa(group.Gid)) - logEvt.Int("gid", group.Gid) - } - opts = append(opts, group.Name) - - logEvt.Msg("creating group") - run("chroot", opts...) - } - - // - user - for _, user := range cfg.Users { - logEvt := log.Info().Str("user", user.Name) - - opts := make([]string, 0) - opts = append(opts /* chroot */, "/system", "useradd", "-r") - if user.Gid != 0 { - opts = append(opts, "-g", strconv.Itoa(user.Gid)) - logEvt.Int("gid", user.Gid) - } - if user.Uid != 0 { - opts = append(opts, "-u", strconv.Itoa(user.Uid)) - logEvt.Int("uid", user.Uid) - } - opts = append(opts, user.Name) - - logEvt.Msg("creating user") - run("chroot", opts...) - } - - return -} diff --git a/ask-secret.go b/ask-secret.go deleted file mode 100644 index 6ca1923..0000000 --- a/ask-secret.go +++ /dev/null @@ -1,56 +0,0 @@ -package main - -import ( - "bufio" - "bytes" - "fmt" - "io" - "os" - "sync" - "sync/atomic" -) - -var ( - inputTTYs = new(sync.Map) - askingSecret atomic.Bool -) - -func registerInput(in *tty) { inputTTYs.Store(in, in) } -func unregiterInput(in *tty) { inputTTYs.Delete(in) } - -func askSecret(prompt string) (s []byte) { - err := func() (err error) { - askingSecret.Store(true) - defer askingSecret.Store(false) - - inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).EchoOff(); return true }) - defer inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).Restore(); return true }) - - var ( - in io.Reader = stdin - out io.Writer = stdout - ) - - if stdin == nil { - in = os.Stdin - out = os.Stdout - } - - out.Write([]byte(prompt + ": ")) - - s, err = bufio.NewReader(in).ReadBytes('\n') - if err != nil { - return - } - - fmt.Println() - s = bytes.TrimRight(s, "\r\n") - return - }() - - if err != nil { - fatalf("failed to read from stdin: %v", err) - } - - return -} diff --git a/auth.go b/auth.go deleted file mode 100644 index da64f55..0000000 --- a/auth.go +++ /dev/null @@ -1,59 +0,0 @@ -package main - -import ( - "bytes" - "errors" - - "github.com/rs/zerolog/log" - "golang.org/x/crypto/ssh" - - config "novit.tech/direktil/pkg/bootstrapconfig" -) - -var ( - auths []config.Auth -) - -func localAuth() bool { - sec := askSecret("password") - - for _, auth := range auths { - if auth.Password == "" { - continue - } - - if config.CheckPassword(auth.Password, sec) { - log.Info().Msgf("login with auth %q", auth.Name) - return true - } - } - - return false -} - -func sshCheckPubkey(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) { - keyBytes := key.Marshal() - - for _, auth := range auths { - if auth.SSHKey == "" { - continue - } - - allowedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(auth.SSHKey)) - if err != nil { - log.Warn().Err(err).Str("user", auth.Name).Str("key", auth.SSHKey).Msg("SSH public key is invalid") - return nil, err - } - - if bytes.Equal(allowedKey.Marshal(), keyBytes) { - log.Info().Str("user", auth.Name).Msg("ssh: accepting public key") - return &ssh.Permissions{ - Extensions: map[string]string{ - "pubkey-fp": ssh.FingerprintSHA256(key), - }, - }, nil - } - } - - return nil, errors.New("no matching public key") -} diff --git a/boot-v2.go b/boot-v2.go deleted file mode 100644 index 8f52769..0000000 --- a/boot-v2.go +++ /dev/null @@ -1,104 +0,0 @@ -package main - -import ( - "os" - "os/exec" - "syscall" - - "github.com/rs/zerolog/log" - "gopkg.in/yaml.v3" - - config "novit.tech/direktil/pkg/bootstrapconfig" -) - -func bootV2() { - log.Info().Msg("-- boot v2 --") - - kernelVersion := unameRelease() - log.Info().Str("version", kernelVersion).Msg("Linux") - - cfg := &config.Config{} - - { - f, err := os.Open("/config.yaml") - if err != nil { - fatal("failed to open /config.yaml: ", err) - } - - err = yaml.NewDecoder(f).Decode(cfg) - f.Close() - - if err != nil { - fatal("failed to parse /config.yaml: ", err) - } - } - - log.Info().Msg("config loaded") - - if cfg.AntiPhishingCode != "" { - log.Info().Str("anti-phishing-code", cfg.AntiPhishingCode).Send() - } - - auths = cfg.Auths - - // mount kernel modules - if cfg.Modules == "" { - log.Warn().Msg("NOT mounting modules (\"modules:\" not specified)") - } else { - log.Info().Str("from", cfg.Modules).Msg("mounting modules") - mountSquahfs(cfg.Modules, "/modules") - - modulesSourcePath := "/modules/lib/modules/" + kernelVersion - if _, err := os.Stat(modulesSourcePath); err != nil { - fatal("invalid modules dir: ", err) - } - - os.MkdirAll("/lib/modules", 0755) - if err := os.Symlink(modulesSourcePath, "/lib/modules/"+kernelVersion); err != nil { - fatal("failed to symlink modules: ", err) - } - } - - // devices init - log.Info().Msg("starting udevd") - err := exec.Command("udevd").Start() - if err != nil { - fatal("failed to start udevd: ", err) - } - - log.Info().Msg("udevadm triggers") - run("udevadm", "trigger", "-c", "add", "-t", "devices") - run("udevadm", "trigger", "-c", "add", "-t", "subsystems") - - log.Info().Msg("udevadm settle") - run("udevadm", "settle") - - // networks - setupNetworks(cfg) - - // Wireguard VPN - // TODO startVPN() - - // SSH service - startSSH(cfg) - - // dmcrypt blockdevs - setupCrypt(cfg.PreLVMCrypt, map[string]string{}) - - // LVM - setupLVM(cfg) - - // bootstrap the system - bootstrap(cfg) - - // finalize - finalizeBoot() -} - -func finalizeBoot() { - // switch root - log.Info().Msg("switching root") - err := syscall.Exec("/sbin/switch_root", []string{"switch_root", - "-c", "/dev/console", "/system", "/sbin/init"}, os.Environ()) - fatal("switch_root failed: ", err) -} diff --git a/bootstrap.go b/bootstrap.go deleted file mode 100644 index c792324..0000000 --- a/bootstrap.go +++ /dev/null @@ -1,192 +0,0 @@ -package main - -import ( - "bytes" - "fmt" - "io" - "net/http" - "os" - "path/filepath" - "strings" - "time" - - "github.com/rs/zerolog/log" - - config "novit.tech/direktil/pkg/bootstrapconfig" -) - -func bootstrap(cfg *config.Config) { - if cfg.Bootstrap.Dev == "" { - fatalf("bootstrap device not defined!") - } - - const bsDir = "/bootstrap" - os.MkdirAll(bsDir, 0700) - - run("mount", cfg.Bootstrap.Dev, bsDir) - - baseDir := filepath.Join(bsDir, bootVersion) - sysCfgPath := filepath.Join(baseDir, "config.yaml") - - if _, err := os.Stat(sysCfgPath); os.IsNotExist(err) { - log.Warn().Msgf("bootstrap %q does not exist", bootVersion) - - seed := cfg.Bootstrap.Seed - if seed == "" { - fatalf("boostrap seed not defined, admin required") - } - - log.Info().Str("from", seed).Msgf("seeding bootstrap") - - err = os.MkdirAll(baseDir, 0700) - if err != nil { - fatalf("failed to create bootstrap dir: %v", err) - } - - bootstrapFile := filepath.Join(baseDir, "bootstrap.tar") - - err = func() (err error) { - var resp *http.Response - - start := time.Now() - for time.Since(start) <= time.Minute { - resp, err = http.Get(seed) - if err == nil { - break - } - time.Sleep(time.Second) - } - if err != nil { - return fmt.Errorf("failed to fetch bootstrap") - } - - if resp.StatusCode != http.StatusOK { - err = fmt.Errorf("bad HTTP status: %s", resp.Status) - return - } - - defer resp.Body.Close() - - out, err := os.Create(bootstrapFile) - if err != nil { - return - } - - defer out.Close() - - _, err = io.Copy(out, resp.Body) - - return - }() - - if err != nil { - fatalf("seeding failed: %v", err) - } - - log.Info().Msg("unpacking bootstrap file") - run("tar", "xvf", bootstrapFile, "-C", baseDir) - } - - layersDir = baseDir - layersOverride["modules"] = "/modules.sqfs" - sysCfg := applyConfig(sysCfgPath, false) - - // load requested modules - for _, mod := range sysCfg.Modules { - log.Info().Str("module", mod).Msg("loading module") - run("modprobe", mod) - } - - // localy-generated assets dir - localGenDir := filepath.Join(bsDir, "local-gen") - - // vpns are v2+ - for _, vpn := range sysCfg.VPNs { - setupVPN(vpn, localGenDir) - } - - // mounts are v2+ - for _, mount := range sysCfg.Mounts { - log.Info().Str("source", mount.Dev).Str("target", mount.Path).Msg("mount") - - path := filepath.Join("/system", mount.Path) - - os.MkdirAll(path, 0755) - - args := []string{mount.Dev, path} - if mount.Type != "" { - args = append(args, "-t", mount.Type) - } - if mount.Options != "" { - args = append(args, "-o", mount.Options) - } - - run("mount", args...) - } - - // setup root user - if ph := sysCfg.RootUser.PasswordHash; ph != "" { - log.Info().Msg("setting root's password") - setUserPass("root", ph) - } - if ak := sysCfg.RootUser.AuthorizedKeys; len(ak) != 0 { - log.Info().Msg("setting root's authorized keys") - setAuthorizedKeys(ak) - } - - // update-ca-certificates - log.Info().Msg("updating CA certificates") - run("chroot", "/system", "update-ca-certificates") -} - -func setUserPass(user, passwordHash string) { - const fpath = "/system/etc/shadow" - - ba, err := os.ReadFile(fpath) - if err != nil { - fatalf("failed to read shadow: %v", err) - } - - lines := bytes.Split(ba, []byte{'\n'}) - - buf := new(bytes.Buffer) - for _, line := range lines { - line := string(line) - p := strings.Split(line, ":") - if len(p) < 2 || p[0] != user { - buf.WriteString(line) - buf.WriteByte('\n') - continue - } - - p[1] = passwordHash - line = strings.Join(p, ":") - - buf.WriteString(line) - buf.WriteByte('\n') - } - - err = os.WriteFile(fpath, buf.Bytes(), 0600) - if err != nil { - fatalf("failed to write shadow: %v", err) - } -} - -func setAuthorizedKeys(ak []string) { - buf := new(bytes.Buffer) - for _, k := range ak { - buf.WriteString(k) - buf.WriteByte('\n') - } - - const sshDir = "/system/root/.ssh" - err := os.MkdirAll(sshDir, 0700) - if err != nil { - fatalf("failed to create %s: %v", sshDir, err) - } - - err = os.WriteFile(filepath.Join(sshDir, "authorized_keys"), buf.Bytes(), 0600) - if err != nil { - fatalf("failed to write authorized keys: %v", err) - } -} diff --git a/build-init b/build-init new file mode 100755 index 0000000..ac56ce6 --- /dev/null +++ b/build-init @@ -0,0 +1,27 @@ +set -ex + +which podman &>/dev/null && docker=podman || docker=docker + +mkdir -p empty +$docker build -t nv-rs-build --network=host -f Dockerfile.build empty + +case $1 in + release) + opts=--release + bindir=target/release + ;; + "") + bindir=target/debug + ;; + *) + echo >&2 "invalid arg: $1" + exit 1 + ;; +esac + +$docker run --rm -i --net=host --user=$UID \ + nv-rs-build \ + cargo build $opts + +mkdir -p dist +cp $bindir/init dist/ diff --git a/build.rs b/build.rs new file mode 100644 index 0000000..2928225 --- /dev/null +++ b/build.rs @@ -0,0 +1,9 @@ +use std::process::Command; +fn main() { + let output = Command::new("git") + .args(&["rev-parse", "HEAD"]) + .output() + .unwrap(); + let git_commit = String::from_utf8(output.stdout).unwrap(); + println!("cargo:rustc-env=GIT_COMMIT={}", git_commit); +} diff --git a/colorio/colorio.go b/colorio/colorio.go deleted file mode 100644 index 01c243b..0000000 --- a/colorio/colorio.go +++ /dev/null @@ -1,45 +0,0 @@ -package colorio - -import "io" - -var ( - Reset = []byte("\033[0m") - Bold = []byte("\033[1m") - Dim = []byte("\033[2m") - Underlined = []byte("\033[4m") - Blink = []byte("\033[5m") - Reverse = []byte("\033[7m") - Hidden = []byte("\033[8m") -) - -type writer struct { - before []byte - after []byte - w io.Writer -} - -func NewWriter(color []byte, w io.Writer) io.Writer { - return writer{ - before: color, - after: Reset, - w: w, - } -} - -func (w writer) Write(ba []byte) (n int, err error) { - b := make([]byte, len(w.before)+len(ba)+len(w.after)) - copy(b, w.before) - copy(b[len(w.before):], ba) - copy(b[len(w.before)+len(ba):], w.after) - - n, err = w.w.Write(b) - - n -= len(w.before) - if n < 0 { - n = 0 - } else if n > len(ba) { - n = len(ba) - } - - return -} diff --git a/colorio/colorio_test.go b/colorio/colorio_test.go deleted file mode 100644 index a887039..0000000 --- a/colorio/colorio_test.go +++ /dev/null @@ -1,21 +0,0 @@ -package colorio - -import ( - "bytes" - "fmt" - "testing" -) - -func TestWriter(t *testing.T) { - buf := new(bytes.Buffer) - - w := NewWriter(Bold, buf) - - buf.WriteByte('{') - fmt.Fprintln(w, "hello") - buf.WriteByte('}') - - if s, exp := buf.String(), "{"+string(Bold)+"hello\n"+string(Reset)+"}"; s != exp { - t.Errorf("%q != %q", s, exp) - } -} diff --git a/config.go b/config.go deleted file mode 100644 index 2582afb..0000000 --- a/config.go +++ /dev/null @@ -1,7 +0,0 @@ -package main - -import ( - nconfig "novit.tech/direktil/pkg/config" -) - -type configV1 = nconfig.Config diff --git a/debug/bootstrap b/debug/bootstrap new file mode 120000 index 0000000..2f5573a --- /dev/null +++ b/debug/bootstrap @@ -0,0 +1 @@ +../target/debug/init \ No newline at end of file diff --git a/debug/connect-boot b/debug/connect-boot new file mode 120000 index 0000000..2f5573a --- /dev/null +++ b/debug/connect-boot @@ -0,0 +1 @@ +../target/debug/init \ No newline at end of file diff --git a/debug/init b/debug/init new file mode 120000 index 0000000..2f5573a --- /dev/null +++ b/debug/init @@ -0,0 +1 @@ +../target/debug/init \ No newline at end of file diff --git a/debug/init-version b/debug/init-version new file mode 120000 index 0000000..2f5573a --- /dev/null +++ b/debug/init-version @@ -0,0 +1 @@ +../target/debug/init \ No newline at end of file diff --git a/etc/sshd_config b/etc/sshd_config new file mode 100644 index 0000000..bda3446 --- /dev/null +++ b/etc/sshd_config @@ -0,0 +1,7 @@ +KbdInteractiveAuthentication no +PasswordAuthentication no + +PubkeyAuthentication yes + +PermitRootLogin yes +AllowUsers root diff --git a/filter.go b/filter.go deleted file mode 100644 index 39b033c..0000000 --- a/filter.go +++ /dev/null @@ -1,22 +0,0 @@ -package main - -func filter[T any](values []T, accept func(T) bool) []T { - r := make([]T, 0, len(values)) - - for _, v := range values { - if accept(v) { - r = append(r, v) - } - } - - return r -} - -func contains[T any](values []T, accept func(T) bool) bool { - for _, v := range values { - if accept(v) { - return true - } - } - return false -} diff --git a/filter_test.go b/filter_test.go deleted file mode 100644 index bcb6580..0000000 --- a/filter_test.go +++ /dev/null @@ -1,13 +0,0 @@ -package main - -import ( - "fmt" - "testing" -) - -func TestFilter(t*testing.T) { - a := filter([]string{"a","b","c"}, func(v string) bool { return v != "b" }) - if fmt.Sprint(a) != "[a c]" { - t.Errorf("bad result: %v", a) - } -} diff --git a/go.mod b/go.mod deleted file mode 100644 index 04e9c68..0000000 --- a/go.mod +++ /dev/null @@ -1,35 +0,0 @@ -module novit.tech/direktil/initrd - -require ( - github.com/creack/pty v1.1.24 - github.com/freddierice/go-losetup/v2 v2.0.1 - github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b - github.com/pkg/term v1.1.0 - github.com/rs/zerolog v1.34.0 - golang.org/x/crypto v0.38.0 - golang.org/x/sys v0.33.0 - golang.org/x/term v0.32.0 - golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 - gopkg.in/yaml.v2 v2.4.0 - gopkg.in/yaml.v3 v3.0.1 - novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6 -) - -require ( - github.com/cavaliergopher/cpio v1.0.1 // indirect - github.com/google/go-cmp v0.7.0 // indirect - github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 // indirect - github.com/josharian/native v1.1.0 // indirect - github.com/mattn/go-colorable v0.1.14 // indirect - github.com/mattn/go-isatty v0.0.20 // indirect - github.com/mdlayher/genetlink v1.3.2 // indirect - github.com/mdlayher/netlink v1.7.2 // indirect - github.com/mdlayher/socket v0.5.1 // indirect - golang.org/x/net v0.40.0 // indirect - golang.org/x/sync v0.14.0 // indirect - golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect -) - -go 1.23.1 - -toolchain go1.24.3 diff --git a/go.sum b/go.sum deleted file mode 100644 index 6eb5872..0000000 --- a/go.sum +++ /dev/null @@ -1,104 +0,0 @@ -github.com/cavaliergopher/cpio v1.0.1 h1:KQFSeKmZhv0cr+kawA3a0xTQCU4QxXF1vhU7P7av2KM= -github.com/cavaliergopher/cpio v1.0.1/go.mod h1:pBdaqQjnvXxdS/6CvNDwIANIFSP0xRKI16PX4xejRQc= -github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= -github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s= -github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE= -github.com/freddierice/go-losetup/v2 v2.0.1 h1:wPDx/Elu9nDV8y/CvIbEDz5Xi5Zo80y4h7MKbi3XaAI= -github.com/freddierice/go-losetup/v2 v2.0.1/go.mod h1:TEyBrvlOelsPEhfWD5rutNXDmUszBXuFnwT1kIQF4J8= -github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= -github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= -github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 h1:smvLGU3obGU5kny71BtE/ibR0wIXRUiRFDmSn0Nxz1E= -github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1/go.mod h1:fP/NdyhRVOv09PLRbVXrSqHhrfQypdZwgE2L4h2U5C8= -github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b h1:Pzf7tldbCVqwl3NnOnTamEWdh/rL41fsoYCn2HdHgRA= -github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b/go.mod h1:IBDUGq30U56w969YNPomhMbRje1GrhUsCh7tHdwgLXA= -github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA= -github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w= -github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= -github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= -github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= -github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= -github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= -github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= -github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw= -github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o= -github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g= -github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw= -github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos= -github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ= -github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws= -github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc= -github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk= -github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw= -github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg= -github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0= -github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss= -github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY= -github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ= -github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= -github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= -golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg= -golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8= -golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw= -golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= -golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY= -golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds= -golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ= -golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= -golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw= -golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= -golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= -golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY= -golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg= -golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ= -golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= -golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A= -golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw= -golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU= -golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= -gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= -gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6 h1:D0TN5GyZ4d88ILpgVZgcZ62027lW8/LLnQSpQyN2yOw= -novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6/go.mod h1:zjezU6tELE880oYHs/WAauGBupKIEQQ7KqWTB69RW10= diff --git a/init-rs b/init-rs new file mode 120000 index 0000000..a0ecdcc --- /dev/null +++ b/init-rs @@ -0,0 +1 @@ +target/debug/init \ No newline at end of file diff --git a/losetup.go b/losetup.go deleted file mode 100644 index e89cc73..0000000 --- a/losetup.go +++ /dev/null @@ -1,26 +0,0 @@ -package main - -import ( - "syscall" - - "github.com/freddierice/go-losetup/v2" -) - -var loDevices = map[string]losetup.Device{} - -func losetupAttach(file string) losetup.Device { - if _, ok := loDevices[file]; !ok { - dev, err := losetup.Attach(file, 0, true) - if err != nil { - fatalf("failed to attach %q to a loop device: %v", file, err) - } - - loDevices[file] = dev - } - return loDevices[file] -} - -func mountSquahfs(source, target string) { - dev := losetupAttach(source) - mount(dev.Path(), target, "squashfs", syscall.MS_RDONLY, "") -} diff --git a/lvm.go b/lvm.go deleted file mode 100644 index 8e4a2c7..0000000 --- a/lvm.go +++ /dev/null @@ -1,410 +0,0 @@ -package main - -import ( - "bytes" - "io/fs" - "os" - "os/exec" - "path/filepath" - "sort" - "strconv" - "syscall" - - udev "github.com/jochenvg/go-udev" - "github.com/rs/zerolog/log" - - config "novit.tech/direktil/pkg/bootstrapconfig" - - "novit.tech/direktil/initrd/lvm" -) - -func sortedKeys[T any](m map[string]T) (keys []string) { - keys = make([]string, 0, len(m)) - for k := range m { - keys = append(keys, k) - } - sort.Strings(keys) - return -} - -func setupLVM(cfg *config.Config) { - if len(cfg.LVM) == 0 { - log.Info().Msg("no LVM VG configured.") - return - } - - // [dev] = filesystem - // eg: [/dev/sda1] = ext4 - createdDevs := map[string]string{} - - run("pvscan") - run("vgscan", "--mknodes") - - for _, vg := range cfg.LVM { - setupVG(vg) - } - - for _, vg := range cfg.LVM { - setupLVs(vg, createdDevs) - } - - run("vgchange", "--sysinit", "-a", "ly") - - setupCrypt(cfg.Crypt, createdDevs) - - devs := make([]string, 0, len(createdDevs)) - for k := range createdDevs { - devs = append(devs, k) - } - sort.Strings(devs) - - for _, dev := range devs { - setupFS(dev, createdDevs[dev]) - } -} - -func setupVG(vg config.LvmVG) { - pvs := lvm.PVSReport{} - err := runJSON(&pvs, "pvs", "--reportformat", "json") - if err != nil { - fatalf("failed to list LVM PVs: %v", err) - } - - vgExists := false - devNeeded := vg.PVs.N - for _, pv := range pvs.PVs() { - if pv.VGName == vg.VG { - vgExists = true - devNeeded-- - } - } - - log := log.With().Str("vg", vg.VG).Logger() - - if devNeeded <= 0 { - log.Info().Msg("LVM VG has all its devices") - return - } - - if vgExists { - log.Info().Msgf("LVM VG misses %d devices", devNeeded) - } else { - log.Info().Msg("LVM VG does not exists, creating") - } - - devNames := make([]NameAliases, 0) - { - devRefs := map[uint64]*NameAliases{} - - enum := new(udev.Udev).NewEnumerate() - enum.AddMatchSubsystem("block") - - devs, err := enum.Devices() - if err != nil { - fatal("udev enumeration failed") - } - - for _, dev := range devs { - num := dev.Devnum() - - n := dev.PropertyValue("DEVNAME") - idx := len(devNames) - devNames = append(devNames, nameAlias(n)) - - ref := uint64(num.Major())<<8 | uint64(num.Minor()) - devRefs[ref] = &devNames[idx] - } - - err = filepath.Walk("/dev", func(n string, fi fs.FileInfo, err error) error { - if fi.Mode().Type() == os.ModeDevice { - stat := fi.Sys().(*syscall.Stat_t) - ref := stat.Rdev - if na := devRefs[ref]; na != nil { - na.AddAlias(n) - } - } - return err - }) - if err != nil { - fatalf("failed to walk /dev: %v", err) - } - } - - for _, dev := range devNames { - log.Info().Str("name", dev.Name).Any("aliases", dev.Aliases).Msg("found block device") - } - - m := regexpSelectN(vg.PVs.N, vg.PVs.Regexps, devNames) - if len(m) == 0 { - log.Error().Strs("regexps", vg.PVs.Regexps).Msg("no device match the regexps") - fatalf("failed to setup VG %s", vg.VG) - } - - if vgExists { - log.Info().Strs("devices", m).Msg("LVM VG: extending") - run("vgextend", append([]string{vg.VG}, m...)...) - devNeeded -= len(m) - } else { - log.Info().Strs("devices", m).Msg("LVM VG: creating") - run("vgcreate", append([]string{vg.VG}, m...)...) - devNeeded -= len(m) - } - - if devNeeded > 0 { - fatalf("VG %s does not have enough devices (%d missing)", vg.VG, devNeeded) - } -} - -func setupLVs(vg config.LvmVG, createdDevs map[string]string) { - lvsRep := lvm.LVSReport{} - err := runJSON(&lvsRep, "lvs", "--reportformat", "json") - if err != nil { - fatalf("lvs failed: %v", err) - } - - lvs := lvsRep.LVs() - - defaults := vg.Defaults - - for idx, lv := range vg.LVs { - log := log.With().Str("vg", vg.VG).Str("lv", lv.Name).Logger() - - if contains(lvs, func(v lvm.LV) bool { - return v.VGName == vg.VG && v.Name == lv.Name - }) { - log.Info().Msg("LV exists") - continue - } - - log.Info().Msg("LV does not exist") - - if lv.Raid == nil { - lv.Raid = defaults.Raid - } - - args := make([]string, 0) - - if lv.Name == "" { - fatalf("LV[%d] has no name", idx) - } - args = append(args, vg.VG, "--name", lv.Name) - - if lv.Size != "" && lv.Extents != "" { - fatalf("LV has both size and extents defined!") - } else if lv.Size == "" && lv.Extents == "" { - fatalf("LV does not have size or extents defined!") - } else if lv.Size != "" { - args = append(args, "-L", lv.Size) - } else /* if lv.Extents != "" */ { - args = append(args, "-l", lv.Extents) - } - - if raid := lv.Raid; raid != nil { - if raid.Mirrors != 0 { - args = append(args, "--mirrors", strconv.Itoa(raid.Mirrors)) - } - if raid.Stripes != 0 { - args = append(args, "--stripes", strconv.Itoa(raid.Stripes)) - } - } - - log.Info().Strs("args", args).Msg("LV: creating") - run("lvcreate", args...) - - dev := "/dev/" + vg.VG + "/" + lv.Name - zeroDevStart(dev) - - fs := lv.FS - if fs == "" { - fs = vg.Defaults.FS - } - createdDevs[dev] = fs - } -} - -func zeroDevStart(dev string) { - f, err := os.OpenFile(dev, os.O_WRONLY, 0600) - if err != nil { - fatalf("failed to open %s: %v", dev, err) - } - - defer f.Close() - - _, err = f.Write(make([]byte, 8192)) - if err != nil { - fatalf("failed to zero the beginning of %s: %v", dev, err) - } -} - -var cryptDevs = map[string]bool{} - -func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) { - var password []byte - passwordVerified := false - - // flat, expanded devices to open - devNames := make([]config.CryptDev, 0, len(devSpecs)) - - for _, devSpec := range devSpecs { - if devSpec.Dev == "" && devSpec.Prefix == "" { - fatalf("crypt: name %q: no dev or match set", devSpec.Name) - } - if devSpec.Dev != "" && devSpec.Prefix != "" { - fatalf("crypt: name %q: both dev (%q) and match (%q) are set", devSpec.Name, devSpec.Dev, devSpec.Prefix) - } - - if devSpec.Dev != "" { - // already flat - devNames = append(devNames, devSpec) - continue - } - - matches, err := filepath.Glob(devSpec.Prefix + "*") - if err != nil { - fatalf("failed to search for device matches: %v", err) - } - - for _, m := range matches { - suffix := m[len(devSpec.Prefix):] - - devNames = append(devNames, config.CryptDev{Dev: m, Name: devSpec.Name + suffix}) - } - } - - for _, devName := range devNames { - name, dev := devName.Name, devName.Dev - - if name == "" { - name = filepath.Base(dev) - } - - if cryptDevs[name] { - fatalf("duplicate crypt device name: %s", name) - } - cryptDevs[name] = true - - retryOpen: - if len(password) == 0 { - password = askSecret("crypt password") - - if len(password) == 0 { - fatalf("empty password given") - } - } - - fs := createdDevs[dev] - delete(createdDevs, dev) - - tgtDev := "/dev/mapper/" + name - - needFormat := !devInitialized(dev) - if needFormat { - if !passwordVerified { - retry: - p2 := askSecret("verify crypt password") - - eq := bytes.Equal(password, p2) - - for i := range p2 { - p2[i] = 0 - } - - if !eq { - log.Error().Msg("passwords don't match") - goto retry - } - } - - log.Info().Str("dev", dev).Msg("formatting encrypted device") - cmd := exec.Command("cryptsetup", "luksFormat", dev, "--key-file=-") - cmd.Stdin = bytes.NewBuffer(password) - cmd.Stdout = stdout - cmd.Stderr = stderr - err := cmd.Run() - if err != nil { - fatalf("failed luksFormat: %v", err) - } - - createdDevs[tgtDev] = fs - } - - if len(password) == 0 { - password = askSecret("crypt password") - - if len(password) == 0 { - fatalf("empty password given") - } - } - - log.Info().Str("name", name).Str("dev", dev).Msg("openning encrypted device") - cmd := exec.Command("cryptsetup", "open", dev, name, "--key-file=-") - cmd.Stdin = bytes.NewBuffer(password) - cmd.Stdout = stdout - cmd.Stderr = stderr - err := cmd.Run() - if err != nil { - // maybe the password is wrong - for i := range password { - password[i] = 0 - } - password = password[:0] - passwordVerified = false - goto retryOpen - } - - if needFormat { - zeroDevStart(tgtDev) - } - - passwordVerified = true - } - - for i := range password { - password[i] = 0 - } -} - -func devInitialized(dev string) bool { - f, err := os.Open(dev) - if err != nil { - fatalf("failed to open %s: %v", dev, err) - } - - defer f.Close() - - ba := make([]byte, 8192) - _, err = f.Read(ba) - if err != nil { - fatalf("failed to read %s: %v", dev, err) - } - - for _, b := range ba { - if b != 0 { - return true - } - } - return false -} - -func setupFS(dev, fs string) { - if devInitialized(dev) { - log.Info().Str("dev", dev).Msg("device already formatted") - return - } - - if fs == "" { - fs = "ext4" - } - - log.Info().Str("dev", dev).Str("fs", fs).Msg("formatting device") - args := make([]string, 0) - - switch fs { - case "btrfs": - args = append(args, "-f") - case "ext4": - args = append(args, "-F") - } - - run("mkfs."+fs, append(args, dev)...) -} diff --git a/lvm/lv.go b/lvm/lv.go deleted file mode 100644 index a86ff85..0000000 --- a/lvm/lv.go +++ /dev/null @@ -1,19 +0,0 @@ -package lvm - -type LVSReport struct { - Report []struct { - LV []LV `json:"lv"` - } `json:"report"` -} - -type LV struct { - Name string `json:"lv_name"` - VGName string `json:"vg_name"` -} - -func (r LVSReport) LVs() (ret []LV) { - for _, rep := range r.Report { - ret = append(ret, rep.LV...) - } - return -} diff --git a/lvm/pv.go b/lvm/pv.go deleted file mode 100644 index 2f59991..0000000 --- a/lvm/pv.go +++ /dev/null @@ -1,19 +0,0 @@ -package lvm - -type PVSReport struct { - Report []struct { - PV []PV `json:"pv"` - } `json:"report"` -} - -type PV struct { - Name string `json:"pv_name"` - VGName string `json:"vg_name"` -} - -func (r PVSReport) PVs() (ret []PV) { - for _, rep := range r.Report { - ret = append(ret, rep.PV...) - } - return -} diff --git a/main.go b/main.go deleted file mode 100644 index 79e4be1..0000000 --- a/main.go +++ /dev/null @@ -1,245 +0,0 @@ -package main - -import ( - "fmt" - "io" - "os" - "os/exec" - "path/filepath" - "runtime" - "syscall" - "time" - - "github.com/pkg/term/termios" - "github.com/rs/zerolog" - "github.com/rs/zerolog/log" - "golang.org/x/term" - - "novit.tech/direktil/initrd/colorio" - "novit.tech/direktil/initrd/shio" -) - -const ( - // VERSION is the current version of init - VERSION = "Direktil init v2.0" - - rootMountFlags = 0 - bootMountFlags = syscall.MS_NOEXEC | syscall.MS_NODEV | syscall.MS_NOSUID | syscall.MS_RDONLY - layerMountFlags = syscall.MS_RDONLY -) - -var ( - bootVersion string - - stdin, - stdinPipe = newPipe() - stdout = shio.New() - stderr = colorio.NewWriter(colorio.Bold, stdout) -) - -func newPipe() (io.ReadCloser, io.WriteCloser) { - return io.Pipe() -} - -func main() { - log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr}) - - registerInput(newTTY(os.Stdin.Fd())) - - switch baseName := filepath.Base(os.Args[0]); baseName { - case "init": - runInit() - default: - log.Fatal().Msgf("unknown sub-command: %q", baseName) - } -} - -func runInit() { - if len(os.Args) > 1 && os.Args[1] == "hello" { - fmt.Println("hello world!") - os.Exit(0) - } - - runtime.LockOSThread() - - // move log to shio - go io.Copy(os.Stdout, stdout.NewReader()) - log.Logger = log.Output(zerolog.ConsoleWriter{Out: stderr}) - - // check the PID is 1 - if pid := os.Getpid(); pid != 1 { - log.Fatal().Int("pid", pid).Msg("init must be PID 1") - } - - // copy os.Stdin to my stdin pipe - go io.Copy(stdinPipe, os.Stdin) - - log.Info().Msg("Welcome to " + VERSION) - - // essential mounts - mount("none", "/proc", "proc", 0, "") - mount("none", "/sys", "sysfs", 0, "") - mount("none", "/dev", "devtmpfs", 0, "") - mount("none", "/dev/pts", "devpts", 0, "gid=5,mode=620") - - // get the "boot version" - bootVersion = param("version", "current") - log.Info().Msgf("booting system %q", bootVersion) - - os.Setenv("PATH", "/usr/bin:/bin:/usr/sbin:/sbin") - - _, err := os.Stat("/config.yaml") - if err != nil { - log.Error().Err(err).Msg("config not found") - fatal() - } - - bootV2() -} - -var ( - layersDir = "/boot/current/layers/" - layersOverride = map[string]string{} -) - -func layerPath(name string) string { - if override, ok := layersOverride[name]; ok { - return override - } - return filepath.Join(layersDir, name+".fs") -} - -func fatal(v ...interface{}) { - log.Error().Msg("*** FATAL ***") - log.Error().Msg(fmt.Sprint(v...)) - die() -} - -func fatalf(pattern string, v ...interface{}) { - log.Error().Msg("*** FATAL ***") - log.Error().Msgf(pattern, v...) - die() -} - -func die() { - log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr}) - - stdout.Close() - stdin.Close() - stdinPipe.Close() - - stdin = nil - -mainLoop: - for { - termios.Tcdrain(os.Stdin.Fd()) - termios.Tcdrain(os.Stdout.Fd()) - termios.Tcdrain(os.Stderr.Fd()) - - fmt.Print("\nr to reboot, o to power off, s to get a shell: ") - - // TODO flush stdin (first char lost here?) - deadline := time.Now().Add(time.Minute) - os.Stdin.SetReadDeadline(deadline) - - term.MakeRaw(int(os.Stdin.Fd())) - termios.Tcflush(os.Stdin.Fd(), termios.TCIFLUSH) - - b := make([]byte, 1) - _, err := os.Stdin.Read(b) - if err != nil { - log.Error().Err(err).Msg("failed to read from stdin") - time.Sleep(5 * time.Second) - syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART) - } - fmt.Println() - - switch b[0] { - case 'o': - run("sync") - syscall.Reboot(syscall.LINUX_REBOOT_CMD_POWER_OFF) - case 'r': - run("sync") - syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART) - case 's': - for _, sh := range []string{"bash", "ash", "sh", "busybox"} { - fullPath, err := exec.LookPath(sh) - if err != nil { - continue - } - - args := make([]string, 0) - if sh == "busybox" { - args = append(args, "sh") - } - - if !localAuth() { - continue mainLoop - } - - cmd := exec.Command(fullPath, args...) - cmd.Env = os.Environ() - cmd.Stdin = os.Stdin - cmd.Stdout = os.Stdout - cmd.Stderr = os.Stderr - err = cmd.Run() - if err != nil { - fmt.Println("shell failed:", err) - } - continue mainLoop - } - log.Error().Msg("failed to find a shell!") - - default: - log.Error().Msgf("unknown choice: %q", string(b)) - } - } -} - -func run(cmd string, args ...string) { - if output, err := exec.Command(cmd, args...).CombinedOutput(); err != nil { - fatalf("command %s %q failed: %v\n%s", cmd, args, err, string(output)) - } -} - -func mkdir(dir string, mode os.FileMode) { - if err := os.MkdirAll(dir, mode); err != nil { - fatalf("mkdir %q failed: %v", dir, err) - } -} - -func mount(source, target, fstype string, flags uintptr, data string) { - if _, err := os.Stat(target); os.IsNotExist(err) { - mkdir(target, 0755) - } - - if err := syscall.Mount(source, target, fstype, flags, data); err != nil { - fatalf("mount %q %q -t %q -o %q failed: %v", source, target, fstype, data, err) - } - log.Info().Str("target", target).Msg("mounted") -} - -func cp(srcPath, dstPath string) { - var err error - defer func() { - if err != nil { - fatalf("cp %s %s failed: %v", srcPath, dstPath, err) - } - }() - - src, err := os.Open(srcPath) - if err != nil { - return - } - - defer src.Close() - - dst, err := os.Create(dstPath) - if err != nil { - return - } - - defer dst.Close() - - _, err = io.Copy(dst, src) -} diff --git a/modd.conf b/modd.conf index b0e96bb..0dbc428 100644 --- a/modd.conf +++ b/modd.conf @@ -1,14 +1,14 @@ modd.conf {} -go.??? **/*.go { - prep: go test ./... - prep: mkdir -p dist - prep: go build -o dist/init . - prep: go build -o dist/ ./tools/... +**/*.rs Cargo.* { + prep: cargo test + prep: cargo build + prep: debug/init-version } -dist/init Dockerfile { - prep: docker build -t novit-initrd-gen . - prep: docker run novit-initrd-gen |base64 -d >dist/initrd.new +target/debug/init Dockerfile { + prep: docker build --network host -t novit-initrd-gen . + prep: docker run --net=host --rm novit-initrd-gen |base64 -d >dist/initrd.new prep: mv dist/initrd.new dist/initrd + prep: ls -sh dist/initrd } diff --git a/modd.test.conf b/modd.test.conf index 9e7154c..6cdb410 100644 --- a/modd.test.conf +++ b/modd.test.conf @@ -1,7 +1,6 @@ modd.test.conf {} -dist/initrd dist/cpiocat dist/testconf test-initrd/**/* { - prep: dist/testconf test-initrd/config.yaml +dist/initrd dist/cpiocat test-initrd/**/* { prep: cp -f dist/initrd test-initrd.cpio prep: cd test-initrd && cat ../dist/initrd | ../dist/cpiocat * |lz4 -l9v >../test-initrd.cpio.new prep: mv test-initrd.cpio.new test-initrd.cpio diff --git a/network.go b/network.go deleted file mode 100644 index cf2a13b..0000000 --- a/network.go +++ /dev/null @@ -1,87 +0,0 @@ -package main - -import ( - "os/exec" - "strings" - - udev "github.com/jochenvg/go-udev" - "github.com/rs/zerolog/log" - - config "novit.tech/direktil/pkg/bootstrapconfig" -) - -func setupNetworks(cfg *config.Config) { - if len(cfg.Networks) == 0 { - log.Info().Msg("no networks configured.") - return - } - - type Iface struct { - Name string - AliasOf string - } - - ifaces := make([]NameAliases, 0) - { - enum := new(udev.Udev).NewEnumerate() - enum.AddMatchSubsystem("net") - - devs, err := enum.Devices() - if err != nil { - fatal("udev enumeration failed") - } - - for _, dev := range devs { - iface := nameAliases(dev.Sysname(), - dev.PropertyValue("INTERFACE"), - dev.PropertyValue("ID_NET_NAME"), - dev.PropertyValue("ID_NET_NAME_PATH"), - dev.PropertyValue("ID_NET_NAME_MAC"), - dev.PropertyValue("ID_NET_NAME_SLOT"), - ) - log.Info().Str("name", iface.Name).Any("aliases", iface.Aliases).Msg("found network device") - ifaces = append(ifaces, iface) - } - } - - assigned := map[string]bool{} - - for _, network := range cfg.Networks { - log := log.With().Str("network", network.Name).Logger() - log.Info().Msg("setting up network") - - unassigned := filter(ifaces, func(iface NameAliases) bool { - return !assigned[iface.Name] - }) - - // assign envvars - envvars := make([]string, 0, 1+len(network.Interfaces)) - envvars = append(envvars, "PATH=/bin:/sbin:/usr/bin:/usr/sbin") - - for _, match := range network.Interfaces { - envvar := new(strings.Builder) - envvar.WriteString(match.Var) - envvar.WriteByte('=') - for i, m := range regexpSelectN(match.N, match.Regexps, unassigned) { - assigned[m] = true - - if i != 0 { - envvar.WriteByte(' ') - } - envvar.WriteString(m) - } - - envvars = append(envvars, envvar.String()) - } - - log.Info().Strs("env", envvars).Msg("running script") - - cmd := exec.Command("/bin/sh", "-c", network.Script) - cmd.Env = envvars - cmd.Stdout = stdout - cmd.Stderr = stderr - if err := cmd.Run(); err != nil { - fatal("failed to setup network: ", err) - } - } -} diff --git a/params.go b/params.go deleted file mode 100644 index 1b68bc5..0000000 --- a/params.go +++ /dev/null @@ -1,39 +0,0 @@ -package main - -import ( - "os" - "strings" -) - -func param(name, defaultValue string) (value string) { - ba, err := os.ReadFile("/proc/cmdline") - if err != nil { - fatal("could not read /proc/cmdline: ", err) - } - - prefixes := []string{ - "direktil." + name + "=", - "dkl." + name + "=", - } - - value = defaultValue - - for _, part := range strings.Split(string(ba), " ") { - for _, prefix := range prefixes { - if strings.HasPrefix(part, prefix) { - value = strings.TrimSpace(part[len(prefix):]) - } - } - } - - return -} - -func paramBool(name string, defaultValue bool) (value bool) { - defaultValueS := "false" - if defaultValue { - defaultValueS = "true" - } - - return "true" == param(name, defaultValueS) -} diff --git a/regexp.go b/regexp.go deleted file mode 100644 index 14bb4b3..0000000 --- a/regexp.go +++ /dev/null @@ -1,65 +0,0 @@ -package main - -import ( - "regexp" - - "github.com/rs/zerolog/log" -) - -type NameAliases struct { - Name string - Aliases []string -} - -func nameAlias(name string) NameAliases { - return NameAliases{Name: name, Aliases: []string{name}} -} -func nameAliases(name string, aliases ...string) NameAliases { - na := NameAliases{Name: name, Aliases: make([]string, 0, len(aliases)+1)} - na.Aliases = append(na.Aliases, name) - for _, alias := range aliases { - na.AddAlias(alias) - } - - return na -} -func (na *NameAliases) AddAlias(alias string) { - if alias == "" { - return - } - if contains(na.Aliases, func(s string) bool { return s == alias }) { - return - } - na.Aliases = append(na.Aliases, alias) -} - -func regexpSelectN(n int, regexps []string, nameAliases []NameAliases) (matches []string) { - matches = make([]string, 0) - - res := make([]*regexp.Regexp, 0, len(regexps)) - for _, reStr := range regexps { - re, err := regexp.Compile(reStr) - if err != nil { - log.Warn().Err(err).Str("regexp", reStr).Msg("invalid regexp, ignored") - continue - } - res = append(res, re) - } - -nameAliasesLoop: - for _, item := range nameAliases { - if len(matches) == n { - break - } - for _, re := range res { - for _, alias := range item.Aliases { - if re.MatchString(alias) { - matches = append(matches, item.Name) - continue nameAliasesLoop - } - } - } - } - - return -} diff --git a/run-docker b/run-docker new file mode 100755 index 0000000..fd93882 --- /dev/null +++ b/run-docker @@ -0,0 +1,2 @@ +docker build -t nv-initrd-test -f Dockerfile.test empty +docker run -d --name nv-initrd-test -it --privileged -v $PWD:/src --workdir /src/test-initrd nv-initrd-test diff --git a/run-test.sh b/run-test.sh index 4bc3626..6153735 100755 --- a/run-test.sh +++ b/run-test.sh @@ -10,7 +10,8 @@ if ! [ -e $disk2 ]; then qemu-img create -f qcow2 $disk2 10G fi -exec qemu-system-x86_64 -pidfile qemu.pid -kernel test-kernel -initrd test-initrd.cpio \ +exec qemu-system-x86_64 -pidfile qemu.pid \ + -kernel test-kernel -initrd test-initrd.cpio \ -smp 2 -m 2048 \ -netdev bridge,br=novit,id=eth0 -device virtio-net-pci,netdev=eth0 \ -drive file=$disk1,if=virtio \ diff --git a/run.go b/run.go deleted file mode 100644 index b7f71c2..0000000 --- a/run.go +++ /dev/null @@ -1,18 +0,0 @@ -package main - -import ( - "encoding/json" - "os/exec" -) - -func runJSON(v interface{}, cmd string, args ...string) (err error) { - c := exec.Command(cmd, args...) - c.Stderr = stderr - ba, err := c.Output() - if err != nil { - return - } - - err = json.Unmarshal(ba, v) - return -} diff --git a/shio/shio.go b/shio/shio.go deleted file mode 100644 index b9259f6..0000000 --- a/shio/shio.go +++ /dev/null @@ -1,118 +0,0 @@ -// Shared IO -package shio - -import ( - "io" - "sync" - - "novit.tech/direktil/initrd/colorio" -) - -type ShIO struct { - buf []byte - closed bool - cond *sync.Cond - hideInput bool -} - -func New() *ShIO { - return NewWithCap(1024) -} -func NewWithCap(capacity int) *ShIO { - return NewWithBytes(make([]byte, 0, capacity)) -} -func NewWithBytes(content []byte) *ShIO { - return &ShIO{ - buf: content, - cond: sync.NewCond(&sync.Mutex{}), - } -} - -var ( - _ io.WriteCloser = New() -) - -func (s *ShIO) Write(data []byte) (n int, err error) { - s.cond.L.Lock() - defer s.cond.L.Unlock() - - if s.closed { - err = io.EOF - return - } - - if s.hideInput { - s.buf = append(s.buf, colorio.Reset...) - } - - s.buf = append(s.buf, data...) - n = len(data) - - if s.hideInput { - s.buf = append(s.buf, colorio.Hidden...) - } - - s.cond.Broadcast() - return -} - -func (s *ShIO) HideInput() { - s.cond.L.Lock() - defer s.cond.L.Unlock() - - if s.closed { - return - } - - s.buf = append(s.buf, colorio.Hidden...) - s.hideInput = true -} -func (s *ShIO) ShowInput() { - s.cond.L.Lock() - defer s.cond.L.Unlock() - - if s.closed { - return - } - - s.buf = append(s.buf, colorio.Reset...) - s.hideInput = false -} - -func (s *ShIO) Close() (err error) { - s.cond.L.Lock() - defer s.cond.L.Unlock() - - s.closed = true - - s.cond.Broadcast() - return -} - -func (s *ShIO) NewReader() io.Reader { - return &shioReader{s, 0} -} - -type shioReader struct { - in *ShIO - pos int -} - -func (r *shioReader) Read(ba []byte) (n int, err error) { - r.in.cond.L.Lock() - defer r.in.cond.L.Unlock() - - for r.pos == len(r.in.buf) && !r.in.closed { - r.in.cond.Wait() - } - - if r.pos == len(r.in.buf) && r.in.closed { - err = io.EOF - return - } - - n = copy(ba, r.in.buf[r.pos:]) - r.pos += n - - return -} diff --git a/shio/shio_test.go b/shio/shio_test.go deleted file mode 100644 index a4462f5..0000000 --- a/shio/shio_test.go +++ /dev/null @@ -1,52 +0,0 @@ -package shio - -import ( - "fmt" - "io" - "os" - "sync" - "time" -) - -func Example_output() { - done := false - defer func() { done = true }() - go func() { - time.Sleep(time.Second) - if !done { - panic("timeout") - } - }() - - shio := NewWithCap(3) - - r1 := shio.NewReader() - - // read as you write - wg := new(sync.WaitGroup) - wg.Add(1) - go func() { - defer wg.Done() - io.Copy(os.Stdout, r1) - fmt.Println("-- r1 done --") - }() - - fmt.Fprintln(shio, "hello1") - fmt.Fprintln(shio, "hello2") - shio.Close() - - wg.Wait() - - // read after close - r2 := shio.NewReader() - io.Copy(os.Stdout, r2) - fmt.Println("-- r2 done --") - - // Output: - // hello1 - // hello2 - // -- r1 done -- - // hello1 - // hello2 - // -- r2 done -- -} diff --git a/src/blockdev.rs b/src/blockdev.rs new file mode 100644 index 0000000..c2b647f --- /dev/null +++ b/src/blockdev.rs @@ -0,0 +1,21 @@ +use tokio::fs; +use tokio::io::{AsyncReadExt, AsyncWriteExt, Result}; + +/// Checks if a block device is uninitialized. +/// It assumed that a initialized device always has a non-zero byte in the first 8kiB. +pub async fn is_uninitialized(dev_path: &str) -> Result { + let mut dev = fs::File::open(dev_path).await?; + + let mut buf = [0u8; 8 << 10]; + dev.read_exact(&mut buf).await?; + + Ok(buf.into_iter().all(|b| b == 0)) +} + +/// zeroes the first 8kiB of the device so it looks uninitialized again. +pub async fn uninitialize(dev_path: &str) -> Result<()> { + let mut dev = fs::File::options().write(true).open(dev_path).await?; + + let buf = [0u8; 8 << 10]; + dev.write_all(&buf).await +} diff --git a/src/bootstrap.rs b/src/bootstrap.rs new file mode 100644 index 0000000..ef68c36 --- /dev/null +++ b/src/bootstrap.rs @@ -0,0 +1 @@ +pub mod config; diff --git a/src/bootstrap/config.rs b/src/bootstrap/config.rs new file mode 100644 index 0000000..e47f410 --- /dev/null +++ b/src/bootstrap/config.rs @@ -0,0 +1,224 @@ +use std::collections::BTreeMap as Map; + +pub const TAKE_ALL: i16 = -1; + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct Config { + pub anti_phishing_code: String, + + #[serde(skip_serializing_if = "Option::is_none")] + pub keymap: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub modules: Option, + + #[serde(skip_serializing_if = "Option::is_none")] + pub resolv_conf: Option, + + #[serde(default)] + pub vpns: Map, + + pub networks: Vec, + + pub auths: Vec, + #[serde(default)] + pub ssh: SSHServer, + + #[serde(default)] + pub pre_lvm_crypt: Vec, + #[serde(default)] + pub lvm: Vec, + #[serde(default)] + pub crypt: Vec, + + pub bootstrap: Bootstrap, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct Auth { + pub name: String, + #[serde(alias = "sshKey")] + #[serde(skip_serializing_if = "Option::is_none")] + pub ssh_key: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub password: Option, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct Network { + pub name: String, + pub interfaces: Vec, + pub script: String, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct NetworkInterface { + pub var: String, + pub n: i16, + pub regexps: Vec, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct SSHServer { + pub listen: String, + pub keys: SSHKeys, +} +impl Default for SSHServer { + fn default() -> Self { + Self { + listen: "[::]:22".to_string(), + keys: SSHKeys::default(), + } + } +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct SSHKeys { + #[serde(skip_serializing_if = "Option::is_none")] + dsa: Option, + #[serde(skip_serializing_if = "Option::is_none")] + rsa: Option, + #[serde(skip_serializing_if = "Option::is_none")] + ecdsa: Option, + #[serde(skip_serializing_if = "Option::is_none")] + ed25519: Option, +} +impl SSHKeys { + pub fn iter(&self) -> impl Iterator { + [ + self.dsa.iter(), + self.rsa.iter(), + self.ecdsa.iter(), + self.ed25519.iter(), + ] + .into_iter() + .flatten() + .map(String::as_str) + } +} +impl Default for SSHKeys { + fn default() -> Self { + Self { + dsa: Some("id_dsa".to_string()), + rsa: Some("id_rsa".to_string()), + ecdsa: Some("id_ecdsa".to_string()), + ed25519: Some("id_ed25519".to_string()), + } + } +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct LvmVG { + #[serde(alias = "vg")] + pub name: String, + pub pvs: LvmPV, + + #[serde(default)] + pub defaults: LvmLVDefaults, + + pub lvs: Vec, +} + +#[derive(Debug, Default, serde::Deserialize, serde::Serialize)] +pub struct LvmLVDefaults { + #[serde(default)] + pub fs: Filesystem, + #[serde(default)] + pub raid: Raid, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +#[serde(rename_all = "snake_case")] +pub enum Filesystem { + Ext4, + Xfs, + Btrfs, + Other(String), +} + +impl Filesystem { + pub fn fstype(&self) -> &str { + use Filesystem as F; + match self { + F::Ext4 => "ext4", + F::Xfs => "xfs", + F::Btrfs => "btrfs", + F::Other(t) => t, + } + } +} + +impl Default for Filesystem { + fn default() -> Self { + Filesystem::Ext4 + } +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct LvmLV { + pub name: String, + #[serde(skip_serializing_if = "Option::is_none")] + pub fs: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub raid: Option, + #[serde(flatten)] + pub size: LvSize, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +#[serde(rename_all = "snake_case")] +pub enum LvSize { + Size(String), + Extents(String), +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct LvmPV { + pub n: i16, + pub regexps: Vec, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct CryptDev { + pub name: String, + #[serde(flatten)] + pub filter: DevFilter, + pub optional: Option, +} +impl CryptDev { + pub fn optional(&self) -> bool { + self.optional.unwrap_or_else(|| self.filter.is_prefix()) + } +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +#[serde(rename_all = "snake_case")] +pub enum DevFilter { + Dev(String), + Prefix(String), +} +impl DevFilter { + pub fn is_dev(&self) -> bool { + match self { + Self::Dev(_) => true, + _ => false, + } + } + pub fn is_prefix(&self) -> bool { + match self { + Self::Prefix(_) => true, + _ => false, + } + } +} + +#[derive(Debug, Default, Clone, serde::Deserialize, serde::Serialize)] +pub struct Raid { + pub mirrors: Option, + pub stripes: Option, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct Bootstrap { + pub dev: String, + pub seed: Option, +} diff --git a/src/cmd.rs b/src/cmd.rs new file mode 100644 index 0000000..fbfd7c9 --- /dev/null +++ b/src/cmd.rs @@ -0,0 +1,5 @@ +pub mod bootstrap; +pub mod connect_boot; +pub mod init; +pub mod init_input; +pub mod version; diff --git a/src/cmd/bootstrap.rs b/src/cmd/bootstrap.rs new file mode 100644 index 0000000..a561858 --- /dev/null +++ b/src/cmd/bootstrap.rs @@ -0,0 +1,19 @@ +use eyre::Result; +use tokio::{fs, io, io::AsyncWriteExt}; + +pub async fn run() -> Result<()> { + let mut input = io::stdin(); + let mut out = fs::File::create("/bootstrap.tar.part").await?; + + let n = io::copy(&mut input, &mut out).await?; + + out.flush().await?; + drop(out); + + eprintln!("copied {n} bytes"); + + fs::rename("/bootstrap.tar.part", "/bootstrap.tar").await?; + eprintln!("/bootstrap.tar ready to use"); + + Ok(()) +} diff --git a/src/cmd/connect_boot.rs b/src/cmd/connect_boot.rs new file mode 100644 index 0000000..e69de29 diff --git a/src/cmd/init.rs b/src/cmd/init.rs new file mode 100644 index 0000000..6eb57e8 --- /dev/null +++ b/src/cmd/init.rs @@ -0,0 +1,400 @@ +use eyre::{format_err, Result}; +use log::{error, info, warn}; +use std::collections::BTreeSet as Set; +use std::os::unix::fs::symlink; +use tokio::sync::Mutex; +use tokio::{fs, process::Command}; + +use crate::{bootstrap::config::Config, cmd::version::version_string, dklog, input}; + +mod bootstrap; +mod dmcrypt; +mod lvm; +mod networks; +mod sshd; + +// devices used by any block target (DM, LVM...) +static USED_DEVS: Mutex> = Mutex::const_new(Set::new()); + +pub async fn run() { + if std::process::id() != 1 { + error!("init must run as PID 1, not {}", std::process::id()); + std::process::exit(1); + } + + unsafe { + use std::env; + env::set_var("PATH", "/bin:/sbin:/usr/bin:/usr/sbin"); + env::set_var("HOME", "/root"); + } + + // open input channels + tokio::spawn(crate::input::answer_requests_from_stdin()); + tokio::spawn(crate::input::answer_requests_from_socket()); + + // welcome + info!("Welcome to {}", version_string()); + + let uname = nix::sys::utsname::uname().expect("uname should work"); + let kernel_version = uname.release().to_string_lossy(); + info!("Linux version {kernel_version}"); + + // extract system archive + retry_or_ignore(async || { + if fs::try_exists("system.azstd").await? { + info!("unpacking system.azstd"); + let zarch = fs::read("system.azstd").await?; + let arch = zstd::Decoder::new(zarch.as_slice())?; + extract_cpio(arch).await + } else if fs::try_exists("system.alz4").await? { + info!("unpacking system.alz4"); + let zarch = fs::read("system.alz4").await?; + let arch = lz4::Decoder::new(zarch.as_slice())?; + extract_cpio(arch).await + } else { + return Ok(()); + } + }) + .await; + + // load config + let cfg: Config = retry(async || { + let cfg = (fs::read("config.yaml").await) + .map_err(|e| format_err!("failed to read config: {e}"))?; + serde_yaml::from_slice(cfg.as_slice()) + .map_err(|e| format_err!("failed to parse config: {e}")) + }) + .await; + + info!("config loaded"); + info!("anti-phishing-code: {}", cfg.anti_phishing_code); + + // seem to occasionaly race with Child::wait + // tokio::spawn(child_reaper()); + + // mount basic filesystems + mount("none", "/proc", "proc", None).await; + mount("none", "/sys", "sysfs", None).await; + mount("none", "/dev", "devtmpfs", None).await; + mount("none", "/dev/pts", "devpts", Some("gid=5,mode=620")).await; + + // mount modules + if let Some(ref modules) = cfg.modules { + retry_or_ignore(async || { + info!("mounting modules"); + mount(modules, "/modules", "squashfs", None).await; + + fs::create_dir_all("/lib/modules").await?; + let modules_path = &format!("/modules/lib/modules/{kernel_version}"); + + if !std::fs::exists(modules_path)? { + return Err(format_err!( + "invalid modules package: {modules_path} should exist" + )); + } + + symlink(modules_path, format!("/lib/modules/{kernel_version}"))?; + Ok(()) + }) + .await; + } else { + warn!("modules NOT mounted (not configured)"); + } + + // init devices + info!("initializing devices"); + start_daemon("udevd", &[]).await; + + exec("udevadm", &["trigger", "-c", "add", "-t", "devices"]).await; + exec("udevadm", &["trigger", "-c", "add", "-t", "subsystems"]).await; + exec("udevadm", &["settle"]).await; + + // resolv.conf + if let Some(ref resolv_conf) = cfg.resolv_conf { + retry_or_ignore(async || { + let path = "/etc/resolv.conf"; + info!("writing /etc/resolv.conf"); + fs::write(path, resolv_conf.as_bytes()).await?; + Ok(()) + }) + .await; + } + + // Wireguard VPNs + for (name, conf) in &cfg.vpns { + retry_or_ignore(async || { + let dir = "/etc/wireguard"; + fs::create_dir_all(dir).await?; + + let path = &format!("{dir}/{name}.conf"); + fs::write(path, conf.as_bytes()).await?; + chmod(path, 0o600).await?; + + try_exec("wg-quick", &["up", name]).await?; + Ok(()) + }) + .await + } + + // SSH service + sshd::start(&cfg).await; + + // networks + networks::setup(&cfg).await; + + // pre-lvm dmcrypt devs + dmcrypt::setup(&cfg.pre_lvm_crypt).await; + + // LVM + lvm::setup(&cfg).await; + + // post-lvm dmcrypt devs + dmcrypt::setup(&cfg.crypt).await; + + // bootstrap the system + bootstrap::bootstrap(cfg).await; + + // finalize + {} + + retry(async || switch_root("/system").await).await; +} + +use std::path::Path; + +async fn extract_cpio(mut arch: impl std::io::Read) -> Result<()> { + loop { + let rd = cpio::NewcReader::new(&mut arch)?; + let entry = rd.entry(); + if entry.is_trailer() { + return Ok(()); + } + + let path = entry.name().to_string(); + + if let Err(e) = extract_cpio_entry(rd, &path).await { + return Err(format_err!("failed to extract {path}: {e}")); + } + } +} + +async fn chmod(path: impl AsRef, mode: u32) -> std::io::Result<()> { + use std::fs::Permissions; + use std::os::unix::fs::PermissionsExt; + + let perms = Permissions::from_mode(mode); + fs::set_permissions(path, perms).await +} + +async fn extract_cpio_entry( + rd: cpio::NewcReader, + path: impl AsRef, +) -> Result<()> { + use std::os::unix::fs::chown; + use unix_mode::Type; + + let entry = rd.entry(); + let path = path.as_ref(); + + if let Some(parent) = path.parent() { + fs::create_dir_all(parent).await?; + } + + let mode = entry.mode(); + let uid = entry.uid(); + let gid = entry.gid(); + + match Type::from(mode) { + Type::Dir => { + fs::create_dir_all(path).await?; + } + Type::File => { + let mut data = vec![]; + rd.to_writer(&mut data)?; + + fs::write(path, data).await?; + } + Type::Symlink => { + let mut data = vec![]; + rd.to_writer(&mut data)?; + let target = &Path::new(std::str::from_utf8(&data)?); + + tokio::fs::symlink(target, path).await?; + return Ok(()); + } + _ => { + warn!("{path:?}: unknown file type: {:?}", Type::from(mode)); + return Ok(()); + } + } + + chmod(path, mode).await?; + chown(path, Some(uid), Some(gid))?; + + Ok(()) +} + +async fn switch_root(root: &str) -> Result<()> { + use std::ffi::CString; + + macro_rules! c { + ($s:expr) => { + CString::new($s)?.as_c_str() + }; + } + + info!("killing all processes and switching root"); + dklog::LOG.close().await; + + use nix::sys::signal::{kill, SIGKILL}; + use nix::unistd::Pid; + + if let Err(e) = kill(Pid::from_raw(-1), SIGKILL) { + eprintln!("failed to kill processes: {e}"); + } + + nix::unistd::execv( + c!("/sbin/switch_root"), + &[ + c!("switch_root"), + c!("-c"), + c!("/dev/console"), + c!(root), + c!("/sbin/init"), + ], + ) + .unwrap(); + + unreachable!(); +} + +async fn mount(src: &str, dst: &str, fstype: &str, opts: Option<&str>) { + if let Err(e) = fs::create_dir_all(dst).await { + error!("failed to create dir {dst}: {e}"); + } + + match fstype { + "ext4" => { + exec("fsck", &["-p", src]).await; + } + _ => {} + } + + let mut args = vec![src, dst]; + if !fstype.is_empty() { + args.extend(&["-t", fstype]); + } + if let Some(opts) = opts { + args.extend(["-o", opts]); + } + exec("mount", &args).await; +} + +async fn start_daemon(prog: &str, args: &[&str]) { + let (cmd_str, mut cmd) = cmd_str(prog, args); + retry_or_ignore(async || { + info!("starting as daemon: {cmd_str}"); + cmd.spawn()?; + Ok(()) + }) + .await; +} + +async fn try_exec(prog: &str, args: &[&str]) -> Result<()> { + let (cmd_str, mut cmd) = cmd_str(prog, args); + info!("# {cmd_str}"); + + let s = cmd.status().await?; + if s.success() { + Ok(()) + } else { + Err(format_err!("command failed: {s}")) + } +} + +async fn exec(prog: &str, args: &[&str]) { + retry_or_ignore(async || try_exec(prog, args).await).await; +} + +async fn retry_or_ignore(mut action: impl AsyncFnMut() -> Result<()>) { + loop { + match action().await { + Ok(_) => return, + Err(e) => { + error!("{e}"); + + match input::read_choice(["[r]etry", "[i]gnore", "[s]hell"]).await { + 'r' => {} + 'i' => return, + 's' => exec_shell().await, + _ => unreachable!(), + } + } + } + } +} + +async fn retry(mut action: impl AsyncFnMut() -> Result) -> T { + loop { + match action().await { + Ok(v) => return v, + Err(e) => { + error!("{e}"); + + match input::read_choice(["[r]etry", "[s]hell"]).await { + 'r' => {} + 's' => exec_shell().await, + _ => unreachable!(), + } + } + } + } +} + +async fn exec_shell() { + let mut child = match Command::new("ash").spawn() { + Ok(c) => c, + Err(e) => { + error!("failed to exec shell: {e}"); + return; + } + }; + + let _ = child.wait().await; +} + +fn cmd_str(prog: &str, args: &[&str]) -> (String, Command) { + use std::borrow::Cow; + + let mut buf = String::new(); + + buf.push_str(&shell_escape::escape(Cow::Borrowed(prog))); + + for &arg in args { + buf.push(' '); + buf.push_str(&shell_escape::escape(Cow::Borrowed(arg))); + } + + let mut cmd = Command::new(prog); + cmd.args(args); + + (buf, cmd) +} + +#[allow(unused)] +async fn child_reaper() { + use nix::sys::wait::{waitpid, WaitPidFlag}; + use nix::unistd::Pid; + use tokio::signal::unix::{signal, SignalKind}; + + let Ok(mut sigs) = + signal(SignalKind::child()).inspect_err(|e| warn!("failed to setup SIGCHLD handler: {e}")) + else { + return; + }; + + loop { + sigs.recv().await; + let _ = waitpid(Some(Pid::from_raw(-1)), Some(WaitPidFlag::WNOHANG)); + } +} diff --git a/src/cmd/init/bootstrap.rs b/src/cmd/init/bootstrap.rs new file mode 100644 index 0000000..f87f2eb --- /dev/null +++ b/src/cmd/init/bootstrap.rs @@ -0,0 +1,320 @@ +use eyre::{format_err, Result}; +use log::info; +use std::path::Path; +use tokio::{ + fs, + io::{AsyncBufReadExt, BufReader}, +}; + +use super::{exec, mount, retry, retry_or_ignore, try_exec}; +use crate::bootstrap::config::Config; +use crate::{dkl, utils}; + +pub async fn bootstrap(cfg: Config) { + let bs = cfg.bootstrap; + + retry_or_ignore(async || { + fs::create_dir_all("/boostrap").await?; + mount(&bs.dev, "/bootstrap", "auto", None).await; + Ok(()) + }) + .await; + + let boot_version = utils::param("version", "current"); + let base_dir = &format!("/bootstrap/{boot_version}"); + + retry_or_ignore(async || { + if !fs::try_exists(&base_dir).await? { + info!("creating {base_dir}"); + fs::create_dir_all(&base_dir).await? + } + Ok(()) + }) + .await; + + let sys_cfg: dkl::Config = retry(async || { + let sys_cfg_bytes = seed_config(base_dir, &bs.seed).await?; + Ok(serde_yaml::from_slice(&sys_cfg_bytes)?) + }) + .await; + + mount_system(&sys_cfg, base_dir).await; + + retry_or_ignore(async || { + let path = "/etc/resolv.conf"; + if fs::try_exists(path).await? { + info!("cp /etc/resolv.conf"); + fs::copy(path, &format!("/system{path}")).await?; + } + Ok(()) + }) + .await; + + retry_or_ignore(async || apply_files(&sys_cfg.files, "/system").await).await; + + apply_groups(&sys_cfg.groups, "/system").await; + apply_users(&sys_cfg.users, "/system").await; + + // TODO VPNs + + mount_filesystems(&sys_cfg.mounts, "/system").await; + + retry_or_ignore(async || { + info!("setting up root user"); + setup_root_user(&sys_cfg.root_user, "/system").await + }) + .await; +} + +async fn seed_config(base_dir: &str, seed_url: &Option) -> Result> { + let cfg_path = &format!("{base_dir}/config.yaml"); + + if fs::try_exists(cfg_path).await? { + return Ok(fs::read(cfg_path).await?); + } + + let bs_tar = "/bootstrap.tar"; + if !fs::try_exists(bs_tar).await? { + if let Some(seed_url) = seed_url.as_ref() { + fetch_bootstrap(seed_url, bs_tar).await?; + } else { + return Err(format_err!( + "no {cfg_path}, no {bs_tar} and no seed, can't bootstrap" + )); + } + } + + try_exec("tar", &["xf", bs_tar, "-C", base_dir]).await?; + + if !fs::try_exists(cfg_path).await? { + return Err(format_err!("{cfg_path} does not exist after seeding")); + } + + Ok(fs::read(cfg_path).await?) +} + +async fn fetch_bootstrap(seed_url: &str, output_file: &str) -> Result<()> { + let tmp_file = &format!("{output_file}.new"); + let _ = fs::remove_file(tmp_file).await; + try_exec("wget", &["-O", tmp_file, seed_url]).await?; + + fs::rename(tmp_file, output_file) + .await + .map_err(|e| format_err!("seed rename failed: {e}"))?; + + Ok(()) +} + +async fn mount_system(cfg: &dkl::Config, bs_dir: &str) { + let mem_dir = "/mem"; + mount("none", mem_dir, "tmpfs", Some("size=512m")).await; + + let layers_dir = &format!("{mem_dir}/layers"); + let mut lower_dir = String::new(); + + for layer in &cfg.layers { + let src = if layer == "modules" { + "/modules.sqfs" + } else { + &format!("{bs_dir}/{layer}.fs") + }; + let tgt = &format!("{mem_dir}/{layer}.fs"); + retry(async || { + info!("copying layer {layer} from {src}"); + fs::copy(src, tgt).await?; + Ok(()) + }) + .await; + + let layer_dir = &format!("{layers_dir}/{layer}"); + mount(tgt, layer_dir, "squashfs", None).await; + + if !lower_dir.is_empty() { + lower_dir.push(':'); + } + lower_dir.push_str(&layer_dir); + } + + let upper_dir = &format!("{mem_dir}/upper"); + let work_dir = &format!("{mem_dir}/work"); + + retry_or_ignore(async || { + fs::create_dir_all(upper_dir).await?; + fs::create_dir_all(work_dir).await?; + Ok(()) + }) + .await; + + mount( + "none", + "/system", + "overlay", + Some(&format!( + "lowerdir={lower_dir},upperdir={upper_dir},workdir={work_dir}" + )), + ) + .await; + + // make root rshared (default in systemd, required by Kubernetes 1.10+) + // equivalent to "mount --make-rshared /" + // see kernel's Documentation/sharedsubtree.txt (search rshared) + retry_or_ignore(async || { + use nix::mount::MsFlags as M; + const NONE: Option<&str> = None; + nix::mount::mount(NONE, "/system", NONE, M::MS_SHARED | M::MS_REC, NONE)?; + Ok(()) + }) + .await; +} + +fn chroot(root: &str, path: &str) -> String { + format!("{root}/{}", path.trim_start_matches(|c| c == '/')) +} + +async fn apply_files(files: &[dkl::File], root: &str) -> Result<()> { + for file in files { + let path = chroot(root, &file.path); + let path = Path::new(&path); + + if let Some(parent) = path.parent() { + fs::create_dir_all(parent).await?; + } + + use crate::dkl::FileKind as K; + match &file.kind { + K::Content(content) => fs::write(path, content.as_bytes()).await?, + K::Dir(true) => fs::create_dir(path).await?, + K::Dir(false) => {} // shouldn't happen, but semantic is to ignore + K::Symlink(tgt) => fs::symlink(tgt, path).await?, + } + + match file.kind { + K::Symlink(_) => {} + _ => set_perms(path, file.mode).await?, + } + + info!("created {}", file.path); + } + + Ok(()) +} + +async fn set_perms(path: impl AsRef, mode: Option) -> std::io::Result<()> { + if let Some(mode) = mode.filter(|m| *m != 0) { + use std::os::unix::fs::PermissionsExt; + let mode = std::fs::Permissions::from_mode(mode); + fs::set_permissions(path, mode).await?; + } + Ok(()) +} + +async fn apply_groups(groups: &[dkl::Group], root: &str) { + for group in groups { + let mut args = vec![root, "groupadd", "-r"]; + + let gid = group.gid.map(|s| s.to_string()); + if let Some(gid) = gid.as_ref() { + args.extend(&["-g", gid]); + } + + args.push(group.name.as_str()); + + exec("chroot", &args).await; + } +} + +async fn apply_users(users: &[dkl::User], root: &str) { + for user in users { + let mut args = vec![root, "useradd", "-r"]; + + let uid = user.uid.map(|s| s.to_string()); + if let Some(uid) = uid.as_ref() { + args.extend(&["-u", uid]); + } + let gid = user.gid.map(|s| s.to_string()); + if let Some(gid) = gid.as_ref() { + args.extend(&["-g", gid]); + } + + args.push(user.name.as_str()); + + exec("chroot", &args).await; + } +} + +async fn mount_filesystems(mounts: &[dkl::Mount], root: &str) { + for m in mounts { + let path = chroot(root, &m.path); + + mount( + &m.dev, + &path, + m.r#type.as_ref().map_or("", |v| v.as_str()), + m.options + .as_ref() + .filter(|v| !v.is_empty()) + .map(|s| s.as_str()), + ) + .await; + } +} + +async fn setup_root_user(user: &dkl::RootUser, root: &str) -> Result<()> { + if let Some(pw_hash) = user.password_hash.as_ref().filter(|v| !v.is_empty()) { + set_user_password("root", &pw_hash, root).await?; + } + + let mut authorized_keys = Vec::new(); + for ak in &user.authorized_keys { + authorized_keys.extend(ak.as_bytes()); + authorized_keys.push(b'\n'); + } + + let ssh_dir = &chroot(root, "root/.ssh"); + fs::create_dir_all(ssh_dir) + .await + .map_err(|e| format_err!("mkdir -p {ssh_dir} failed: {e}"))?; + set_perms(ssh_dir, Some(0o700)) + .await + .map_err(|e| format_err!("chmod {ssh_dir} failed: {e}"))?; + + let ak_path = &format!("{ssh_dir}/authorized_keys"); + fs::write(ak_path, authorized_keys) + .await + .map_err(|e| format_err!("write {ak_path} failed: {e}"))?; + + Ok(()) +} + +async fn set_user_password(user: &str, password_hash: &str, root: &str) -> Result<()> { + info!("setting password for {user}"); + + let user = user.as_bytes(); + let password_hash = password_hash.as_bytes(); + + let mut buf = Vec::new(); + + let pw_file = &chroot(root, "etc/shadow"); + let rd = fs::File::open(pw_file) + .await + .map_err(|e| format_err!("open {pw_file} failed: {e}"))?; + let mut rd = BufReader::new(rd); + + let mut line = Vec::new(); + while (rd.read_until(b'\n', &mut line).await) + .map_err(|e| format_err!("read {pw_file} failed: {e}"))? + != 0 + { + let mut split: Vec<_> = line.split(|c| *c == b':').collect(); + if split.len() > 2 && split[0] == user { + split[1] = password_hash; + buf.extend(split.join(&b':')); + } else { + buf.extend(&line); + } + line.clear(); + } + + fs::write(pw_file, buf).await?; + Ok(()) +} diff --git a/src/cmd/init/dmcrypt.rs b/src/cmd/init/dmcrypt.rs new file mode 100644 index 0000000..aae0472 --- /dev/null +++ b/src/cmd/init/dmcrypt.rs @@ -0,0 +1,151 @@ +use eyre::{format_err, Result}; +use log::{error, info, warn}; +use std::collections::BTreeSet as Set; +use std::process::Stdio; +use tokio::io::AsyncWriteExt; +use tokio::process::Command; +use tokio::sync::Mutex; + +use super::{retry_or_ignore, USED_DEVS}; +use crate::blockdev::{is_uninitialized, uninitialize}; +use crate::bootstrap::config::{CryptDev, DevFilter}; +use crate::fs::walk_dir; +use crate::input; + +pub async fn setup(devs: &[CryptDev]) { + if devs.is_empty() { + return; + } + + let mut used_devs = USED_DEVS.lock().await; + + // CryptDev.name that have a least one assignment done + let mut done = Set::new(); + + // dmcrypt devices opened here + let mut done_crypt = Set::new(); + + retry_or_ignore(async || { + let all_devs = walk_dir("/dev").await; + + for dev in devs { + let mut mappings = find_dev(dev, &all_devs); + mappings.retain(|(_, dev_path)| !used_devs.contains(dev_path)); + + if mappings.is_empty() && !dev.optional() && !done.contains(&dev.name) { + return Err(format_err!("no device found for crypt dev {}", dev.name)); + } + + for (crypt_dev, dev_path) in mappings { + if done_crypt.contains(&crypt_dev) { + continue; + } + + info!("crypt dev {crypt_dev}: using {dev_path}"); + + crypt_open(&crypt_dev, &dev_path).await?; + + done_crypt.insert(crypt_dev); + used_devs.insert(dev_path); + done.insert(&dev.name); + } + } + + Ok(()) + }) + .await; +} + +static PREV_PW: Mutex = Mutex::const_new(String::new()); + +async fn crypt_open(crypt_dev: &str, dev_path: &str) -> Result<()> { + 'open_loop: loop { + let mut prev_pw = PREV_PW.lock().await; + let prompt = if prev_pw.is_empty() { + format!("crypt password for {crypt_dev}? ") + } else { + format!("crypt password for {crypt_dev} (enter = reuse previous)? ") + }; + + let mut pw = input::read_password(prompt).await; + if pw.is_empty() { + pw = prev_pw.clone(); + } + if pw.is_empty() { + error!("empty password provided!"); + continue; + } + + *prev_pw = pw.clone(); + + if cryptsetup(&pw, ["open", dev_path, crypt_dev]).await? { + return Ok(()); + } + + error!("crypt open {crypt_dev} from {dev_path} failed"); + + if is_uninitialized(dev_path).await? { + // we can format the device + info!("{dev_path} looks uninitialized, it may be formatted"); + + match input::read_choice(["[f]ormat", "[r]etry", "[i]gnore"]).await { + 'r' => continue 'open_loop, + 'i' => return Ok(()), + 'f' => { + if !cryptsetup(&pw, ["luksFormat", dev_path]).await? { + return Err(format_err!("cryptsetup luksFormat failed")); + } + if !cryptsetup(&pw, ["open", dev_path, crypt_dev]).await? { + return Err(format_err!("open after format failed")); + } + + if let Err(e) = uninitialize(&format!("/dev/mapper/{crypt_dev}")).await { + warn!("uninitialize failed (ignored): {e}"); + } + + return Ok(()); + } + _ => unreachable!(), + } + } else { + // device looks initialized, don't allow format + warn!("{dev_path} looks initialized, formatting not allowed from init"); + + match input::read_choice(["[r]etry", "[i]gnore"]).await { + 'r' => continue 'open_loop, + 'i' => return Ok(()), + _ => unreachable!(), + } + } + } +} + +async fn cryptsetup(pw: &str, args: [&str; N]) -> Result { + let mut child = Command::new("cryptsetup") + .args(args) + .arg("--key-file=-") + .stdin(Stdio::piped()) + .spawn()?; + + (child.stdin.as_mut().unwrap()) + .write_all(pw.as_bytes()) + .await?; + + Ok(child.wait().await?.success()) +} + +fn find_dev(dev: &CryptDev, all_devs: &[String]) -> Vec<(String, String)> { + let dev_name = &dev.name; + match dev.filter { + DevFilter::Dev(ref path) => (all_devs.iter()) + .filter(|dev_path| dev_path == &path) + .map(|dev_path| (dev.name.clone(), dev_path.clone())) + .collect(), + DevFilter::Prefix(ref prefix) => (all_devs.iter()) + .filter_map(|path| { + let suffix = path.strip_prefix(prefix)?; + Some((format!("{dev_name}{suffix}"), path.clone())) + }) + .collect(), + } +} diff --git a/src/cmd/init/lvm.rs b/src/cmd/init/lvm.rs new file mode 100644 index 0000000..fbfc6cd --- /dev/null +++ b/src/cmd/init/lvm.rs @@ -0,0 +1,212 @@ +use eyre::{format_err, Result}; +use log::{error, info, warn}; +use tokio::process::Command; + +use super::{exec, retry, retry_or_ignore, USED_DEVS}; +use crate::bootstrap::config::{Config, Filesystem, LvSize, LvmLV, LvmVG, TAKE_ALL}; +use crate::fs::walk_dir; +use crate::{blockdev, lvm}; + +pub async fn setup(cfg: &Config) { + if cfg.lvm.is_empty() { + info!("no LVM VG configured"); + return; + } + + exec("pvscan", &[]).await; + exec("vgscan", &["--mknodes"]).await; + + for vg in &cfg.lvm { + retry_or_ignore(async || setup_vg(vg).await).await + } + + let lvs = retry(lvm::lvs).await; + + for vg in &cfg.lvm { + let vg_name = vg.name.as_str(); + + for lv in &vg.lvs { + let lv_name = lv.name.as_str(); + + if (lvs.iter()).any(|lv| lv.equal_name(vg_name, lv_name)) { + info!("LVM LV {vg_name}/{lv_name} exists"); + } else { + retry_or_ignore(async || setup_lv(&vg, &lv).await).await; + } + } + } + + exec("vgchange", &["--sysinit", "-a", "ly"]).await; + + for vg in &cfg.lvm { + for lv in &vg.lvs { + retry_or_ignore(async || format_lv(&vg, &lv).await).await; + } + } +} + +async fn setup_vg(vg: &LvmVG) -> Result<()> { + let vg_name = vg.name.as_str(); + + let pvs = retry(lvm::pvs).await; + + let mut dev_done = pvs.iter().filter(|pv| pv.vg_name == vg.name).count(); + let dev_needed = vg.pvs.n; + macro_rules! missing_count { + () => { + (dev_needed as usize) - dev_done + }; + } + + if dev_needed == TAKE_ALL { + if dev_done == 0 { + info!("setting up LVM VG {vg_name} using all matching devices"); + } else { + // in "take all" mode, don't extend as existing vg at boot + info!("LVM VG {vg_name} exists"); + return Ok(()); + } + } else if dev_done >= (dev_needed as usize) { + info!("LVM VG {vg_name} exists with enough devices"); + return Ok(()); // already set up + } else { + info!("setting up LVM VG {vg_name} ({dev_done}/{dev_needed} devices configured)"); + } + + let regexps: Vec = (vg.pvs.regexps.iter()) + .filter_map(|re_str| { + (re_str.parse()) + .inspect_err(|e| error!("invalid regex ignored: {re_str:?}: {e}")) + .ok() + }) + .collect(); + + let mut used_devs = USED_DEVS.lock().await; + + let matching_devs = (walk_dir("/dev").await.into_iter()) + .filter(|path| !used_devs.contains(path.as_str())) + .filter(|path| regexps.iter().any(|re| re.is_match(path))); + + let devs: Vec<_> = if dev_needed == TAKE_ALL { + matching_devs.collect() + } else { + matching_devs.take(missing_count!()).collect() + }; + + let cmd = if dev_done == 0 { + "vgcreate" + } else { + "vgextend" + }; + let status = (Command::new(cmd).arg(vg_name).args(&devs)) + .status() + .await?; + if !status.success() { + return Err(format_err!("{cmd} failed: {status}")); + } + + dev_done += devs.len(); + used_devs.extend(devs); + + if dev_needed != TAKE_ALL && dev_done < (dev_needed as usize) { + return Err(format_err!( + "LVM VG {vg_name} needs {} more device(s)", + missing_count!() + )); + } + + Ok(()) +} + +async fn setup_lv(vg: &LvmVG, lv: &LvmLV) -> Result<()> { + let name = format!("{}/{}", vg.name, lv.name); + info!("creating LV {name}"); + + let mut cmd = Command::new("lvcreate"); + cmd.arg(&vg.name); + cmd.args(&["--name", &lv.name]); + + match &lv.size { + LvSize::Size(sz) => cmd.args(&["-L", sz]), + LvSize::Extents(sz) => cmd.args(&["-l", sz]), + }; + + let raid = lv.raid.as_ref().unwrap_or(&vg.defaults.raid); + + if let Some(mirrors) = raid.mirrors { + cmd.args(&["--mirrors", &mirrors.to_string()]); + } + if let Some(stripes) = raid.stripes { + cmd.args(&["--stripes", &stripes.to_string()]); + } + + let status = cmd.status().await?; + if !status.success() { + return Err(format_err!("lvcreate failed: {status}")); + } + + if let Err(e) = blockdev::uninitialize(&format!("/dev/{name}")).await { + warn!("uninitialize failed (ignored): {e}"); + } + + Ok(()) +} + +async fn format_lv(vg: &LvmVG, lv: &LvmLV) -> Result<()> { + let name = &format!("{}/{}", vg.name, lv.name); + let dev = &format!("/dev/{name}"); + + if !blockdev::is_uninitialized(&dev).await? { + info!("{dev} looks initialized"); + return Ok(()); + } + + let fs = lv.fs.as_ref().unwrap_or(&vg.defaults.fs); + info!("initializing {} filesystem on {dev}", fs.fstype()); + + let mkfs = format!("mkfs.{}", fs.fstype()); + + let mut cmd = Command::new(&mkfs); + + // filesystem specific flags + match fs { + Filesystem::Ext4 => { + cmd.arg("-F"); + } + Filesystem::Btrfs | Filesystem::Xfs => { + cmd.arg("-f"); + } + &Filesystem::Other(_) => {} + } + + cmd.arg(dev); + + let mut child = match cmd.spawn() { + Ok(v) => v, + Err(e) => { + // try simple fixes + match fs { + Filesystem::Xfs => install_package("xfsprogs").await?, + Filesystem::Btrfs => install_package("btrs-progs").await?, + _ => Err(format_err!("{mkfs} failed: {e}"))?, + } + cmd.spawn().map_err(|e| format_err!("{mkfs} failed: {e}"))? + } + }; + + let status = child.wait().await?; + if !status.success() { + return Err(format_err!("{mkfs} failed: {status}")); + } + + Ok(()) +} + +async fn install_package(pkg: &str) -> Result<()> { + let status = Command::new("apk").arg("add").arg(pkg).status().await?; + if status.success() { + Ok(()) + } else { + Err(format_err!("failed to install package {pkg}: {status}")) + } +} diff --git a/src/cmd/init/networks.rs b/src/cmd/init/networks.rs new file mode 100644 index 0000000..1ecaeef --- /dev/null +++ b/src/cmd/init/networks.rs @@ -0,0 +1,94 @@ +use itertools::Itertools; +use log::{info, warn}; +use std::collections::BTreeSet as Set; +use tokio::process::Command; + +use super::{format_err, retry_or_ignore, Config, Result}; +use crate::{ + bootstrap::config, + udev, + utils::{select_n_by_regex, NameAliases}, +}; + +pub async fn setup(cfg: &Config) { + if cfg.networks.is_empty() { + warn!("no networks configured"); + return; + } + + let mut assigned = Set::new(); + + for net in &cfg.networks { + retry_or_ignore(async || setup_network(net, &mut assigned).await).await; + } +} + +async fn setup_network(net: &config::Network, assigned: &mut Set) -> Result<()> { + info!("setting up network {}", net.name); + + let netdevs = get_interfaces()? + .filter(|dev| !assigned.contains(dev.name())) + .collect::>(); + + for dev in &netdevs { + info!( + "- available network device: {}, aliases [{}]", + dev.name(), + dev.aliases().join(", ") + ); + } + + let mut cmd = Command::new("ash"); + cmd.arg("-c"); + cmd.arg(&net.script); + + let mut selected = Vec::new(); + + for iface in &net.interfaces { + let var = &iface.var; + + let netdevs = netdevs.iter().filter(|na| !assigned.contains(na.name())); + let if_names = select_n_by_regex(iface.n, &iface.regexps, netdevs); + + if if_names.is_empty() { + return Err(format_err!("- no interface match for {var:?}")); + } + + let value = if_names.join(" "); + info!("- {var}={value}"); + cmd.env(var, value); + + selected.extend(if_names); + } + + info!("- running script"); + let status = cmd.status().await?; + if !status.success() { + return Err(format_err!("setup script failed: {status}")); + } + + assigned.extend(selected); + Ok(()) +} + +fn get_interfaces() -> Result> { + Ok(udev::get_devices("net")?.into_iter().map(|dev| { + let mut na = NameAliases::new(dev.sysname().to_string()); + + for (property, value) in dev.properties() { + if [ + "INTERFACE", + "ID_NET_NAME", + "ID_NET_NAME_PATH", + "ID_NET_NAME_MAC", + "ID_NET_NAME_SLOT", + ] + .contains(&property) + { + na.push(value.to_string()); + } + } + + na + })) +} diff --git a/src/cmd/init/sshd.rs b/src/cmd/init/sshd.rs new file mode 100644 index 0000000..cb59f00 --- /dev/null +++ b/src/cmd/init/sshd.rs @@ -0,0 +1,96 @@ +use log::{info, warn}; +use std::fs; +use std::io::Write; +use std::os::unix::fs::PermissionsExt; +use std::process::Stdio; +use tokio::net; +use tokio::process::Command; + +use super::{retry_or_ignore, Config}; + +pub async fn start(cfg: &Config) { + retry_or_ignore(async || { + info!("ssh: writing authorized keys"); + + let ssh_dir = "/root/.ssh"; + let authorized_keys = format!("{ssh_dir}/authorized_keys"); + + fs::create_dir_all(ssh_dir)?; + fs::set_permissions(ssh_dir, fs::Permissions::from_mode(0o700))?; + + let mut ak = Vec::new(); + + for auth in &cfg.auths { + let Some(ref key) = auth.ssh_key else { + continue; + }; + writeln!(ak, "{key} {}", auth.name)?; + } + + fs::write(authorized_keys, ak)?; + Ok(()) + }) + .await; + + retry_or_ignore(async || { + let mut sshd_args = Vec::new(); + + sshd_args.extend(["-i", "-E", "/var/log/sshd.log"]); + + for key_path in cfg.ssh.keys.iter() { + if !fs::exists(key_path).is_ok_and(|b| b) { + info!("ssh: host key not found (ignored): {key_path}"); + continue; + } + sshd_args.extend(["-h", key_path]); + } + + let sshd_args = sshd_args.into_iter().map(String::from).collect(); + + // don't pre-start sshd as it should rarely be useful at this stage, use inetd-style. + let listen_addr = cfg.ssh.listen.clone(); + info!("ssh: starting listener on {listen_addr}"); + + let listener = net::TcpListener::bind(listen_addr).await?; + + tokio::spawn(handle_ssh_connections(listener, sshd_args)); + + Ok(()) + }) + .await; +} + +async fn handle_ssh_connections(listener: net::TcpListener, sshd_args: Vec) { + loop { + let (stream, remote) = match listener.accept().await { + Ok(v) => v, + Err(e) => { + warn!("ssh: listener stopped: {e}"); + return; + } + }; + + use std::os::unix::io::{AsRawFd, FromRawFd}; + let fd = stream.as_raw_fd(); + + let mut cmd = Command::new("/usr/sbin/sshd"); + cmd.args(&sshd_args); + + cmd.stdin(unsafe { Stdio::from_raw_fd(fd) }); + cmd.stdout(unsafe { Stdio::from_raw_fd(fd) }); + cmd.stderr(Stdio::null()); + + let Ok(mut child) = + (cmd.spawn()).inspect_err(|e| warn!("ssh: failed to start server: {e}")) + else { + continue; + }; + + let pid = child.id().unwrap(); + info!("ssh: new connection from {remote}, sshd PID {pid}"); + + tokio::spawn(async move { + let _ = child.wait().await; + }); + } +} diff --git a/src/cmd/init_input.rs b/src/cmd/init_input.rs new file mode 100644 index 0000000..c5aa78b --- /dev/null +++ b/src/cmd/init_input.rs @@ -0,0 +1,11 @@ +use crate::input; + +pub async fn run() { + tokio::spawn(async { + if let Err(e) = input::forward_requests_from_socket().await { + eprintln!("failed to forwards requests from socket: {e}"); + std::process::exit(1); + } + }); + input::answer_requests_from_stdin().await; +} diff --git a/src/cmd/version.rs b/src/cmd/version.rs new file mode 100644 index 0000000..9ec38d8 --- /dev/null +++ b/src/cmd/version.rs @@ -0,0 +1,12 @@ +pub fn run() { + println!("{}", version_string()); +} + +pub fn version_string() -> String { + format!( + "Direktil {} v{} (git commit {})", + env!("CARGO_PKG_NAME"), + env!("CARGO_PKG_VERSION"), + env!("GIT_COMMIT") + ) +} diff --git a/src/dkl.rs b/src/dkl.rs new file mode 100644 index 0000000..05db81a --- /dev/null +++ b/src/dkl.rs @@ -0,0 +1,61 @@ +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct Config { + pub layers: Vec, + pub root_user: RootUser, + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub mounts: Vec, + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub files: Vec, + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub groups: Vec, + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub users: Vec, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct RootUser { + #[serde(skip_serializing_if = "Option::is_none")] + pub password_hash: Option, + pub authorized_keys: Vec, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct Mount { + pub r#type: Option, + pub dev: String, + pub path: String, + pub options: Option, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct Group { + pub name: String, + #[serde(skip_serializing_if = "Option::is_none")] + pub gid: Option, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct User { + pub name: String, + #[serde(skip_serializing_if = "Option::is_none")] + pub uid: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub gid: Option, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct File { + pub path: String, + #[serde(skip_serializing_if = "Option::is_none")] + pub mode: Option, + #[serde(flatten)] + pub kind: FileKind, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FileKind { + Content(String), + Symlink(String), + Dir(bool), +} diff --git a/src/dklog.rs b/src/dklog.rs new file mode 100644 index 0000000..f8108bc --- /dev/null +++ b/src/dklog.rs @@ -0,0 +1,136 @@ +use std::io::Write; +use std::sync::{LazyLock, Mutex}; +use std::time::SystemTime; +use tokio::sync::watch; +use tokio::task::JoinSet; + +pub static LOG: LazyLock = LazyLock::new(Log::new); + +pub fn init() { + log::set_logger(&*LOG).expect("set_logger should not fail"); + log::set_max_level(log::LevelFilter::Info); +} + +pub struct Log { + start: SystemTime, + log: Mutex>, + tx: Mutex>>, + rx: watch::Receiver, + tasks: Mutex>>, +} + +impl Log { + pub fn new() -> Self { + let (tx, rx) = watch::channel(0); + Self { + start: SystemTime::now(), + log: Mutex::new(Vec::new()), + tx: Mutex::new(Some(tx)), + rx, + tasks: Mutex::new(Some(JoinSet::new())), + } + } + + pub fn spawn(&self, task: impl Future + Send + 'static) { + if let Some(tasks) = self.tasks.lock().unwrap().as_mut() { + tasks.spawn(task); + } + } + + pub fn subscribe(&self) -> LogWatch { + LogWatch { + log: self, + pos: 0, + rx: self.rx.clone(), + } + } + + pub async fn copy_to(&self, mut out: W) { + let mut log = self.subscribe(); + use tokio::io::AsyncWriteExt; + while let Some(chunk) = log.next().await { + let _ = out.write_all(&chunk).await; + let _ = out.flush().await; + } + } + + pub async fn close(&self) { + self.tx.lock().unwrap().take(); + if let Some(tasks) = self.tasks.lock().unwrap().take() { + tasks.join_all().await; + } + } +} + +impl log::Log for Log { + fn enabled(&self, metadata: &log::Metadata) -> bool { + use log::Level::*; + match metadata.level() { + Trace | Debug => false, + Info | Warn | Error => true, + } + } + + fn log(&self, record: &log::Record) { + if !self.enabled(record.metadata()) { + return; + } + + let ts = self.start.elapsed().unwrap_or_default(); + + use log::Level::*; + let level = match record.level() { + Trace => "\x1b[2mTRC\x1b[0m", + Debug => "\x1b[34mDBG\x1b[0m", + Info => "\x1b[32mINF\x1b[0m", + Warn => "\x1b[93mWRN\x1b[0m", + Error => "\x1b[91mERR\x1b[0m", + }; + + let Ok(mut log) = self.log.lock() else { + return; + }; + + writeln!( + log, + "{:3}.{:03} {level} {}", + ts.as_secs(), + ts.subsec_millis(), + record.args() + ) + .expect("write to buf should not fail"); + + if let Some(tx) = self.tx.lock().unwrap().as_mut() { + tx.send_replace(log.len()); + } + } + + fn flush(&self) { + // always flushed + } +} + +pub struct LogWatch<'t> { + log: &'t Log, + pos: usize, + rx: watch::Receiver, +} + +impl<'t> LogWatch<'t> { + pub async fn next(&mut self) -> Option> { + loop { + let new_pos = self.rx.borrow_and_update().clone(); + if new_pos <= self.pos { + if self.rx.changed().await.is_err() { + return None; // finished + } + continue; + } + + let mut chunk = Vec::new(); + chunk.extend(&self.log.log.lock().unwrap()[self.pos..new_pos]); + self.pos = new_pos; + return Some(chunk); + } + } +} diff --git a/src/fs.rs b/src/fs.rs new file mode 100644 index 0000000..a1fcf75 --- /dev/null +++ b/src/fs.rs @@ -0,0 +1,43 @@ +use log::warn; +use std::io::Result; +use tokio::fs; + +pub async fn walk_dir(dir: &str) -> Vec { + let mut todo = Vec::new(); + if let Ok(rd) = read_dir(dir).await { + todo.push(rd); + } + + let mut results = Vec::new(); + + while let Some(rd) = todo.pop() { + for (path, is_dir) in rd { + if is_dir { + let Ok(child_rd) = (read_dir(&path).await) + .inspect_err(|e| warn!("reading dir {path} failed: {e}")) + else { + continue; + }; + todo.push(child_rd); + } else { + results.push(path); + } + } + } + + results +} + +async fn read_dir(dir: &str) -> Result> { + let mut rd = fs::read_dir(dir).await?; + let mut entries = Vec::new(); + + while let Some(entry) = rd.next_entry().await? { + if let Some(path) = entry.path().to_str() { + entries.push((path.to_string(), entry.file_type().await?.is_dir())); + } + } + + entries.sort(); // we want a deterministic & intuitive order + Ok(entries) +} diff --git a/src/input.rs b/src/input.rs new file mode 100644 index 0000000..7b9ad3c --- /dev/null +++ b/src/input.rs @@ -0,0 +1,343 @@ +use log::warn; +use std::fmt::Display; +use std::sync::{Arc, LazyLock}; +use tokio::io::{self, AsyncBufReadExt, AsyncWriteExt, BufReader}; +use tokio::net; +use tokio::sync::{oneshot, watch, Mutex}; + +pub async fn read_line(prompt: impl Display) -> String { + read(prompt, false).await +} + +pub async fn read_password(prompt: impl Display) -> String { + read(prompt, true).await +} + +fn choice_char(s: &str) -> char { + s.chars().skip_while(|c| *c != '[').skip(1).next().unwrap() +} + +#[test] +fn test_choice_char() { + assert_eq!('r', choice_char("[r]etry")); + assert_eq!('b', choice_char("re[b]boot")); +} + +/// ```no_run +/// use init::input; +/// +/// #[tokio::main(flavor = "current_thread")] +/// async fn main() { +/// tokio::spawn(input::answer_requests_from_stdin()); +/// match input::read_choice(["[r]etry","[i]gnore","re[b]oot"]).await { +/// 'r' => todo!(), +/// 'i' => todo!(), +/// 'b' => todo!(), +/// _ => unreachable!(), +/// } +/// } +/// ``` +pub async fn read_choice(choices: [&str; N]) -> char { + let chars = choices.map(choice_char); + + let mut prompt = String::new(); + for s in choices { + if !prompt.is_empty() { + prompt.push_str(", "); + } + prompt.push_str(s); + } + prompt.push_str("? "); + + loop { + let line = read_line(&prompt).await; + let Some(ch) = line.chars().nth(0) else { + continue; + }; + + for choice in chars { + if ch == choice { + return choice; + } + } + } +} + +#[derive(Clone, serde::Deserialize, serde::Serialize)] +pub struct InputRequest { + prompt: String, + hide: bool, +} + +pub type Reply = Arc>>>; + +static REQ: LazyLock>>> = LazyLock::new(|| { + let (tx, _) = watch::channel(None); + Mutex::new(tx) +}); +static READ_MUTEX: Mutex<()> = Mutex::const_new(()); + +async fn read(prompt: impl Display, hide_input: bool) -> String { + let _read_lock = READ_MUTEX.lock(); + + let req = InputRequest { + prompt: prompt.to_string(), + hide: hide_input, + }; + + let (tx, rx) = oneshot::channel(); + let reply = Arc::new(Mutex::new(Some(tx))); + + REQ.lock().await.send_replace(Some((req, reply))); + + let input = rx.await.expect("reply sender should not be closed"); + + REQ.lock().await.send_replace(None); + + input +} + +pub async fn answer_requests_from_stdin() { + let mut stdin = BufReader::new(io::stdin()).lines(); + let mut stdout = io::stdout(); + + let mut current_req = REQ.lock().await.subscribe(); + current_req.mark_changed(); + + loop { + // TODO check is stdin has been closed (using C-c is enough for now) + (current_req.changed().await).expect("input request should not close"); + + let Some((req, reply)) = current_req.borrow_and_update().clone() else { + continue; + }; + + // handle hide + let mut saved_termios = None; + if req.hide { + match termios::Termios::from_fd(0) { + Ok(mut tio) => { + saved_termios = Some(tio.clone()); + tio.c_lflag &= !termios::ECHO; + if let Err(e) = termios::tcsetattr(0, termios::TCSAFLUSH, &tio) { + warn!("password may be echoed! {e}"); + } + } + Err(e) => { + warn!("password may be echoed! {e}"); + } + } + } + + // print the prompt and wait for user input + stdout.write_all(req.prompt.as_bytes()).await.unwrap(); + stdout.flush().await.unwrap(); + + tokio::select!( + r = stdin.next_line() => { + let Ok(Some(line)) = r else { + warn!("stdin closed"); + return; + }; + + if let Some(tx) = reply.lock().await.take() { + let _ = tx.send(line); + } + + if saved_termios.is_some() { + // final '\n' is hidden too so fix it + stdout.write_all(b"\n").await.unwrap(); + stdout.flush().await.unwrap(); + } + } + _ = current_req.changed() => { + // reply came from somewhere else + stdout.write_all(b"\n").await.unwrap(); + stdout.flush().await.unwrap(); + + current_req.mark_changed(); + } + ); + + // restore term if input was hidden + if let Some(tio) = saved_termios { + if let Err(e) = termios::tcsetattr(0, termios::TCSAFLUSH, &tio) { + warn!("failed to restore pty attrs: {e}"); + } + } + } +} + +const SOCKET_PATH: &str = "/run/init.sock"; + +pub async fn answer_requests_from_socket() { + let Ok(listener) = net::UnixListener::bind(SOCKET_PATH) + .inspect_err(|e| warn!("failed start input socket listener: {e}")) + else { + return; + }; + + loop { + let Ok((conn, _)) = (listener.accept()) + .await + .inspect_err(|e| warn!("input socket listener failed: {e}")) + else { + return; + }; + + tokio::spawn(handle_connection(conn)); + } +} + +#[derive(serde::Deserialize, serde::Serialize)] +enum Message { + #[serde(rename = "l")] + Log(Vec), + #[serde(rename = "r")] + Req(Option), +} + +async fn handle_connection(conn: net::UnixStream) { + use crate::dklog; + + let mut log = dklog::LOG.subscribe(); + + let mut current_req = REQ.lock().await.subscribe(); + current_req.mark_changed(); + + let (rd, mut wr) = io::split(conn); + let mut rd = BufReader::new(rd).lines(); + + macro_rules! wr { + ($msg:expr) => { + let mut buf = serde_json::to_vec(&$msg).unwrap(); + buf.push(b'\n'); + + if wr.write_all(&buf).await.is_err() { + return; + } + if wr.flush().await.is_err() { + return; + } + }; + } + + loop { + tokio::select!( + r = current_req.changed() => { + r.expect("input request should not close"); + }, + l = log.next() => { + let Some(l) = l else { return; }; + wr!(Message::Log(l)); + continue; + }, + ); + + let Some((req, reply)) = current_req.borrow_and_update().clone() else { + wr!(Message::Req(None)); + continue; + }; + + wr!(Message::Req(Some(req))); + + loop { + tokio::select!( + r = rd.next_line() => { + let Ok(Some(line)) = r else { + return; // closed + }; + + if let Some(tx) = reply.lock().await.take() { + let _ = tx.send(line); + } + } + _ = current_req.changed() => { + // reply came from somewhere else + current_req.mark_changed(); + } + l = log.next() => { + let Some(l) = l else { return; }; + wr!(Message::Log(l)); + continue; + }, + ); + break; + } + } +} + +pub async fn forward_requests_from_socket() -> eyre::Result<()> { + let stream = net::UnixStream::connect(SOCKET_PATH).await?; + + let (rd, mut wr) = io::split(stream); + let mut rd = BufReader::new(rd).lines(); + + let (tx, mut rx) = tokio::sync::mpsc::channel(1); + + tokio::spawn(async move { + loop { + let Ok(line) = (rd.next_line().await).inspect_err(|e| warn!("socket read error: {e}")) + else { + return; + }; + + let Some(line) = line else { + // end of stream + return; + }; + + let Ok(msg) = serde_json::from_str::(&line) + .inspect_err(|e| warn!("invalid message received: {e}")) + else { + continue; + }; + + match msg { + Message::Req(req) => { + if tx.send(req).await.is_err() { + // closed + return; + } + } + Message::Log(l) => { + let mut out = io::stderr(); + let _ = out.write_all(&l).await; + let _ = out.flush().await; + } + }; + } + }); + + // the recv request if any, otherwise wait for the next + let mut recv = None; + + loop { + let req = match recv.take() { + // value already available + Some(v) => v, + // no value available, wait for the next + None => match rx.recv().await { + Some(v) => v, + // end of requests + None => return Ok(()), + }, + }; + + let Some(req) = req else { + REQ.lock().await.send_replace(None); + continue; + }; + + tokio::select!( + mut r = read(req.prompt, req.hide) => { + r.push('\n'); + wr.write_all(r.as_bytes()).await?; + wr.flush().await?; + } + r = rx.recv() => { + recv = r + } + ); + } +} diff --git a/src/lib.rs b/src/lib.rs new file mode 100644 index 0000000..228056a --- /dev/null +++ b/src/lib.rs @@ -0,0 +1,11 @@ +pub mod bootstrap; +pub mod cmd; +pub mod lsblk; +pub mod lvm; +pub mod udev; +pub mod utils; +pub mod input; +pub mod blockdev; +pub mod fs; +pub mod dkl; +pub mod dklog; diff --git a/src/lsblk.rs b/src/lsblk.rs new file mode 100644 index 0000000..15049e2 --- /dev/null +++ b/src/lsblk.rs @@ -0,0 +1,27 @@ +use std::io; +use std::process::Command; + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct Report { + pub blockdevices: Vec, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +pub struct BlockDev { + pub name: String, + #[serde(rename = "maj:min")] + pub maj_min: String, + pub rm: bool, + pub size: String, + pub ro: bool, + #[serde(rename = "type")] + pub dev_type: String, + pub mountpoints: Vec>, + #[serde(default)] + pub children: Vec, +} + +pub fn report() -> io::Result { + let output = Command::new("lsblk").arg("--json").output()?; + Ok(serde_json::from_slice(output.stdout.as_slice()).unwrap()) +} diff --git a/src/lvm.rs b/src/lvm.rs new file mode 100644 index 0000000..784326b --- /dev/null +++ b/src/lvm.rs @@ -0,0 +1,102 @@ +use eyre::{format_err, Result}; +use tokio::process::Command; + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +struct Report { + report: Vec, +} + +#[derive(Debug, serde::Deserialize, serde::Serialize)] +enum ReportObj { + #[serde(rename = "pv")] + PV(Vec), + #[serde(rename = "vg")] + VG(Vec), + #[serde(rename = "lv")] + LV(Vec), +} + +#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)] +pub struct PV { + pub pv_name: String, + pub vg_name: String, + pub pv_fmt: String, + pub pv_attr: String, + pub pv_size: String, + pub pv_free: String, +} + +#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)] +pub struct VG { + pub vg_name: String, + pub pv_count: String, + pub lv_count: String, + pub snap_count: String, + pub vg_attr: String, + pub vg_size: String, + pub vg_free: String, +} + +#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)] +pub struct LV { + pub lv_name: String, + pub vg_name: String, + pub lv_attr: String, + pub lv_size: String, + pub pool_lv: String, + pub origin: String, + pub data_percent: String, + pub metadata_percent: String, + pub move_pv: String, + pub mirror_log: String, + pub copy_percent: String, + pub convert_lv: String, +} + +impl LV { + pub fn equal_name(&self, vg_name: &str, lv_name: &str) -> bool { + vg_name == &self.vg_name && lv_name == &self.lv_name + } +} + +pub async fn pvs() -> Result> { + report_cmd("pvs", |o| match o { + ReportObj::PV(pv) => Some(pv), + _ => None, + }) + .await +} + +pub async fn vgs() -> Result> { + report_cmd("vgs", |o| match o { + ReportObj::VG(vg) => Some(vg), + _ => None, + }) + .await +} + +pub async fn lvs() -> Result> { + report_cmd("lvs", |o| match o { + ReportObj::LV(lv) => Some(lv), + _ => None, + }) + .await +} + +async fn report_cmd(cmd: &str, find: fn(ReportObj) -> Option>) -> Result> { + let output = Command::new(cmd) + .arg("--reportformat=json") + .output() + .await?; + + if !output.status.success() { + let stderr = String::from_utf8_lossy(&output.stderr.trim_ascii()); + return Err(format_err!("{cmd} failed: {}", stderr)); + } + + let report: Report = serde_json::from_slice(&output.stdout).unwrap(); + Ok((report.report.into_iter()) + .filter_map(find) + .flatten() + .collect()) +} diff --git a/src/main.rs b/src/main.rs new file mode 100644 index 0000000..80b224c --- /dev/null +++ b/src/main.rs @@ -0,0 +1,52 @@ +use eyre::Result; +use log::warn; +use std::env; +use std::process::exit; + +use init::cmd; +use init::dklog; + +#[tokio::main(flavor = "current_thread")] +async fn main() -> Result<()> { + dklog::LOG.spawn(dklog::LOG.copy_to(tokio::io::stderr())); + + dklog::init(); + + let call_name = env::args().next().unwrap_or("init".into()); + let call_name = (call_name.rsplit_once('/').map(|(_, n)| n)).unwrap_or(call_name.as_str()); + + if call_name == "init" { + dklog::LOG.spawn(async { + let Ok(log_file) = (tokio::fs::File::create("/var/log/init.log").await) + .inspect_err(|e| warn!("failed to open init.log: {e}")) + else { + return; + }; + dklog::LOG.copy_to(log_file).await; + }); + } + + let result = match call_name { + "init" => { + cmd::init::run().await; + Ok(()) + } + "init-version" => { + cmd::version::run(); + Ok(()) + } + "init-connect" => { + cmd::init_input::run().await; + Ok(()) + } + "bootstrap" => cmd::bootstrap::run().await, + + _ => { + eprintln!("invalid call name: {call_name:?}"); + exit(1); + } + }; + + dklog::LOG.close().await; + result +} diff --git a/src/udev.rs b/src/udev.rs new file mode 100644 index 0000000..67c5f72 --- /dev/null +++ b/src/udev.rs @@ -0,0 +1,65 @@ +use eyre::Result; +use log::error; + +pub struct Device { + sysname: String, + output: String, +} + +impl Device { + pub fn sysname(&self) -> &str { + self.sysname.as_str() + } + + pub fn properties(&self) -> impl Iterator { + self.output + .lines() + .filter_map(|line| line.strip_prefix("E: ")?.split_once('=')) + } +} + +pub fn get_devices(class: &str) -> Result> { + let mut devices = Vec::new(); + + // none of libudev and udev crates were able to list network devices. + // falling back to manual sysfs scanning :( + // + // Even when given a syspath, + // - udev crate failed to see all properties; + // - libudev crate segfaulted on the second property (SYSNUM ok, then segfault). + // falling back to parsing udevadm output :( + // + // The best fix would be to check what's wrong with udev crate. + + let entries = std::fs::read_dir(format!("/sys/class/{class}"))?; + for entry in entries { + let Ok(entry) = entry else { + continue; + }; + + let path = entry.path(); + let path = path.to_string_lossy(); + + let output = std::process::Command::new("udevadm") + .args(&["info", &format!("--path={path}")]) + .stderr(std::process::Stdio::piped()) + .output()?; + + if !output.status.success() { + error!("udevadm fail for {path}"); + continue; + } + + let output = String::from_utf8_lossy(&output.stdout); + + let name = entry.file_name(); + let dev = Device { + sysname: name.to_string_lossy().to_string(), + output: output.into_owned(), + }; + + devices.push(dev); + } + + Ok(devices) +} diff --git a/src/utils.rs b/src/utils.rs new file mode 100644 index 0000000..9276b44 --- /dev/null +++ b/src/utils.rs @@ -0,0 +1,81 @@ +use log::error; +use std::collections::BTreeSet as Set; +use std::sync::LazyLock; + +static CMDLINE: LazyLock = LazyLock::new(|| { + std::fs::read("/proc/cmdline") + .map(|c| String::from_utf8_lossy(&c).to_string()) + .unwrap_or_default() +}); + +pub fn param<'t>(name: &'t str, default: &'t str) -> &'t str { + let prefix1 = &format!("dkl.{name}="); + let prefix2 = &format!("direktil.{name}="); + + CMDLINE + .split_ascii_whitespace() + .find_map(|part| { + part.strip_prefix(prefix1) + .or_else(|| part.strip_prefix(prefix2)) + }) + .unwrap_or(default) +} + +pub struct NameAliases { + name: String, + aliases: Set, +} + +impl NameAliases { + pub fn new(name: String) -> Self { + Self { + name, + aliases: Set::new(), + } + } + + pub fn name(&self) -> &str { + self.name.as_str() + } + pub fn aliases(&self) -> impl Iterator { + self.aliases.iter().map(|s| s.as_str()) + } + + pub fn iter(&self) -> impl Iterator { + std::iter::once(self.name()).chain(self.aliases()) + } + + pub fn push(&mut self, alias: String) { + if self.name == alias { + return; + } + self.aliases.insert(alias); + } +} + +pub fn select_n_by_regex<'t>( + n: i16, + regexs: &Vec, + nas: impl Iterator, +) -> Vec { + // compile regexs + let regexs: Vec<_> = (regexs.iter()) + .filter_map(|re| { + regex::Regex::new(re) + .inspect_err(|e| error!("invalid regex ignored: {re:?}: {e}")) + .ok() + }) + .collect(); + + let matching = |name| regexs.iter().any(|re| re.is_match(name)); + + let nas = nas + .filter(|na| na.iter().any(matching)) + .map(|na| na.name().to_string()); + + if n == -1 { + nas.collect() + } else { + nas.take(n as usize).collect() + } +} diff --git a/ssh.go b/ssh.go deleted file mode 100644 index 5fe9eb8..0000000 --- a/ssh.go +++ /dev/null @@ -1,281 +0,0 @@ -package main - -import ( - "encoding/binary" - "fmt" - "io" - "net" - "os" - "os/exec" - "sync" - "syscall" - "time" - "unsafe" - - "github.com/creack/pty" - "github.com/rs/zerolog/log" - "golang.org/x/crypto/ssh" - - config "novit.tech/direktil/pkg/bootstrapconfig" -) - -func startSSH(cfg *config.Config) { - sshConfig := &ssh.ServerConfig{ - PublicKeyCallback: sshCheckPubkey, - } - - hostKeyLoaded := false - - for _, format := range []string{"rsa", "dsa", "ecdsa", "ed25519"} { - log := log.With().Str("format", format).Logger() - - pkBytes, err := os.ReadFile("/id_" + format) - if err != nil { - log.Error().Err(err).Msg("ssh: failed to load host key") - continue - } - - pk, err := ssh.ParsePrivateKey(pkBytes) - if err != nil { - log.Error().Err(err).Msg("ssh: failed to parse host key") - continue - } - - sshConfig.AddHostKey(pk) - hostKeyLoaded = true - - log.Info().Msg("ssh: loaded host key") - } - - if !hostKeyLoaded { - fatalf("ssh: failed to load any host key") - } - - sshBind := ":22" // TODO configurable - listener, err := net.Listen("tcp", sshBind) - if err != nil { - fatalf("ssh: failed to listen on %s: %v", sshBind, err) - } - - log.Info().Str("bind-address", sshBind).Msg("SSH server listening") - - go func() { - for { - conn, err := listener.Accept() - if err != nil { - log.Info().Err(err).Msg("ssh: accept conn failed") - continue - } - - go sshHandleConn(conn, sshConfig) - } - }() -} - -func sshHandleConn(conn net.Conn, sshConfig *ssh.ServerConfig) { - sshConn, chans, reqs, err := ssh.NewServerConn(conn, sshConfig) - - if err != nil { - log.Error().Err(err).Msg("ssh: handshake failed") - return - } - - remoteAddr := sshConn.User() + "@" + sshConn.RemoteAddr().String() - log.Info().Str("remote", remoteAddr).Msg("ssh: new connection") - - go sshHandleReqs(reqs) - go sshHandleChannels(remoteAddr, chans) -} - -func sshHandleReqs(reqs <-chan *ssh.Request) { - for req := range reqs { - switch req.Type { - case "keepalive@openssh.com": - req.Reply(true, nil) - - default: - log.Info().Str("type", req.Type).Msg("ssh: discarding request") - req.Reply(false, nil) - } - } -} - -func sshHandleChannels(remoteAddr string, chans <-chan ssh.NewChannel) { - for newChannel := range chans { - if t := newChannel.ChannelType(); t != "session" { - newChannel.Reject(ssh.UnknownChannelType, fmt.Sprintf("unknown channel type: %s", t)) - continue - } - - channel, requests, err := newChannel.Accept() - if err != nil { - log.Error().Err(err).Msg("ssh: failed to accept channel") - continue - } - - go sshHandleChannel(remoteAddr, channel, requests) - } -} - -func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *ssh.Request) { - var ( - ptyF, ttyF *os.File - termEnv string - ) - - defer func() { - if ptyF != nil { - ptyF.Close() - } - if ttyF != nil { - ttyF.Close() - } - }() - - var once sync.Once - closeCh := func() { - channel.Close() - } - - for req := range requests { - switch req.Type { - case "exec": - command := string(req.Payload[4 : req.Payload[3]+4]) - switch command { - case "init": - if ptyF == nil { - go func() { - channel.Stderr().Write([]byte("\033[5m\033[31;1m\n\nWARNING: no TTY requested, passwords will be echoed!\n\n\033[0m")) - time.Sleep(3 * time.Second) - io.Copy(channel, stdout.NewReader()) - once.Do(closeCh) - }() - go func() { - io.Copy(stdinPipe, channel) - once.Do(closeCh) - }() - - } else { - stdinTTY := newTTY(ptyF.Fd()) - if askingSecret.Load() { - stdinTTY.EchoOff() - } - registerInput(stdinTTY) - defer unregiterInput(stdinTTY) - - go func() { - io.Copy(ttyF, stdout.NewReader()) - once.Do(closeCh) - }() - go func() { - io.Copy(stdinPipe, ttyF) - once.Do(closeCh) - }() - } - - req.Reply(true, nil) - - case "bootstrap": - // extract a new bootstrap package - os.MkdirAll("/bootstrap/current", 0750) - - cmd := exec.Command("/bin/tar", "xv", "-C", "/bootstrap/current") - cmd.Stdin = channel - cmd.Stdout = channel - cmd.Stderr = channel.Stderr() - - go func() { - cmd.Run() - closeCh() - }() - - req.Reply(true, nil) - - default: - req.Reply(false, nil) - } - - case "shell": - cmd := exec.Command("/bin/ash") - cmd.Env = []string{"TERM=" + termEnv} - cmd.Stdin = ttyF - cmd.Stdout = ttyF - cmd.Stderr = ttyF - cmd.SysProcAttr = &syscall.SysProcAttr{ - Setctty: true, - Setsid: true, - Pdeathsig: syscall.SIGKILL, - } - - cmd.Start() - - go func() { - cmd.Wait() - ptyF.Close() - ptyF = nil - ttyF.Close() - ttyF = nil - }() - - req.Reply(true, nil) - - case "pty-req": - if ptyF != nil || ttyF != nil { - req.Reply(false, nil) - continue - } - - var err error - ptyF, ttyF, err = pty.Open() - if err != nil { - log.Error().Err(err).Msg("ssh: PTY open failed") - req.Reply(false, nil) - continue - } - - termLen := req.Payload[3] - termEnv = string(req.Payload[4 : termLen+4]) - w, h := sshParseDims(req.Payload[termLen+4:]) - sshSetWinsize(ptyF.Fd(), w, h) - - req.Reply(true, nil) - - go func() { - io.Copy(channel, ptyF) - once.Do(closeCh) - }() - go func() { - io.Copy(ptyF, channel) - once.Do(closeCh) - }() - - case "window-change": - w, h := sshParseDims(req.Payload) - sshSetWinsize(ptyF.Fd(), w, h) - // no response - - default: - req.Reply(false, nil) - } - } -} - -func sshParseDims(b []byte) (uint32, uint32) { - w := binary.BigEndian.Uint32(b) - h := binary.BigEndian.Uint32(b[4:]) - return w, h -} - -// SetWinsize sets the size of the given pty. -func sshSetWinsize(fd uintptr, w, h uint32) { - // Winsize stores the Height and Width of a terminal. - type Winsize struct { - Height uint16 - Width uint16 - x uint16 // unused - y uint16 // unused - } - - ws := &Winsize{Width: uint16(w), Height: uint16(h)} - syscall.Syscall(syscall.SYS_IOCTL, fd, uintptr(syscall.TIOCSWINSZ), uintptr(unsafe.Pointer(ws))) -} diff --git a/test-initrd/config.yaml b/test-initrd/config.yaml index 18fc337..cc83e07 100644 --- a/test-initrd/config.yaml +++ b/test-initrd/config.yaml @@ -4,6 +4,18 @@ anti_phishing_code: "direktil<3" modules: /modules.sqfs +vpns: + wgprov: |- + [Interface] + PrivateKey = GGM/MwPYrN9HZHsWrEv0RtX/aHXcXzkrZnZWiMgNrEg= + ListenPort = 54321 + Address = 10.9.8.7/24 + + [Peer] # admin1 + PresharedKey = oH1OhMWGPg+Qvq3w5mmp6paIi/1bMKl48r0Su2P1F3g= + PublicKey = /j/uawB3nM+36fOxWgI/kK412TvHlYU3T8qxr38hpAs= + AllowedIPs = 10.9.8.1/24 + auths: - name: novit sshKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkpbU6sf4t0f6XAv9DuW3XH5iLM0AI5rc8PT2jwea1N diff --git a/test-initrd/id_ecdsa b/test-initrd/id_ecdsa new file mode 100644 index 0000000..11b52c0 --- /dev/null +++ b/test-initrd/id_ecdsa @@ -0,0 +1,9 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS +1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSlevO48OA0/yB8zTP1naijVU3wsB0c +4s6Jc/8y7YwNq51/SlieeGeRFcCSke5Z67rNX2JFiv+tsGQB6TczZm/6AAAAqDU5b2c1OW +9nAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKV687jw4DT/IHzN +M/WdqKNVTfCwHRzizolz/zLtjA2rnX9KWJ54Z5EVwJKR7lnrus1fYkWK/62wZAHpNzNmb/ +oAAAAhANenGXlP1ZPgcyb/+O57MbpGDOZS4e7UNiyvkD8I3hNnAAAACW53cmtAbndyawEC +AwQFBg== +-----END OPENSSH PRIVATE KEY----- diff --git a/test-initrd/id_ed25519 b/test-initrd/id_ed25519 new file mode 100644 index 0000000..7c91e4c --- /dev/null +++ b/test-initrd/id_ed25519 @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACCCMX0zm3Fi7vXWevHuJvzU30l5F06NAC2qloUewVSoDQAAAJDnq/y456v8 +uAAAAAtzc2gtZWQyNTUxOQAAACCCMX0zm3Fi7vXWevHuJvzU30l5F06NAC2qloUewVSoDQ +AAAEDXYq507MsjSN34Qw87guf3d5D4Dt2IrF788CeBcYSNe4IxfTObcWLu9dZ68e4m/NTf +SXkXTo0ALaqWhR7BVKgNAAAACW53cmtAbndyawECAwQ= +-----END OPENSSH PRIVATE KEY----- diff --git a/test-initrd/id_rsa.pub b/test-initrd/id_rsa.pub deleted file mode 100644 index 3abde42..0000000 --- a/test-initrd/id_rsa.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLo+mv+0GJViwFiK14bAw8j4HYFIGf4I/fpmIqzHohf70TT+cYqAKSHBYV+uYjNLYQib6Ii/thPexeypw73pq7Z7CHvubnFQUiuqJ7lzXeV4146f5eHL76/TvTmKthS4FVFta6SlCOE6unR6q8HM52VSijavtoX3musxugCwhaHmBNOdUJcNIRCIey8QaOztPK05dDrOZhMQJgSST/BRaNrtY0/xRmJo+5TbQeyjyDuQdK2EoS51QMWzsT/LH6drQBgKd8RRHqjEhscfaV2CmdfuVO/liEdW82epMgFCGYtMetP/rs3bPkC90ULxPZSytaz7d5ux1dvSgrPHzX4306k/GP3d6EvOedy4IKAB53J7lebvrRI5pTVPZvd/RsSGGxUIwjf2Y8TF5nbC2d2D5Oauqfevn29veIRh8mq+AsJMnkvUFwVRN+6WDsZ+F82+AGaCKJFNQLYbRKtXW0zzi+wTsnLJNwlpevRf61SCxehSqeVfnc4TDsAGyRa9nSbR8= test@novit.io diff --git a/test-initrd/modules.sqfs b/test-initrd/modules.sqfs index 46a0317..c30f395 100644 Binary files a/test-initrd/modules.sqfs and b/test-initrd/modules.sqfs differ diff --git a/test-kernel b/test-kernel index fb09b86..8c090b4 100644 Binary files a/test-kernel and b/test-kernel differ diff --git a/tools/cpiocat/main.go b/tools/cpiocat/main.go deleted file mode 100644 index 40f2282..0000000 --- a/tools/cpiocat/main.go +++ /dev/null @@ -1,19 +0,0 @@ -package main - -import ( - "flag" - "fmt" - "os" - - "novit.tech/direktil/pkg/cpiocat" -) - -func main() { - flag.Parse() - - err := cpiocat.Append(os.Stdout, os.Stdin, flag.Args()) - if err != nil { - fmt.Fprintln(os.Stderr, err.Error()) - os.Exit(1) - } -} diff --git a/tools/testconf/main.go b/tools/testconf/main.go deleted file mode 100644 index 500d661..0000000 --- a/tools/testconf/main.go +++ /dev/null @@ -1,37 +0,0 @@ -package main - -import ( - "bytes" - "flag" - "fmt" - "os" - - "gopkg.in/yaml.v3" - config "novit.tech/direktil/pkg/bootstrapconfig" -) - -func main() { - flag.Parse() - - for _, arg := range flag.Args() { - fmt.Println("testing", arg) - - cfgBytes, err := os.ReadFile(arg) - fail(err) - - cfg := config.Config{} - - dec := yaml.NewDecoder(bytes.NewBuffer(cfgBytes)) - dec.KnownFields(true) - - err = dec.Decode(&cfg) - fail(err) - } -} - -func fail(err error) { - if err != nil { - fmt.Fprintln(os.Stderr, err.Error()) - os.Exit(1) - } -} diff --git a/tty.go b/tty.go deleted file mode 100644 index f418227..0000000 --- a/tty.go +++ /dev/null @@ -1,35 +0,0 @@ -package main - -import ( - "golang.org/x/sys/unix" -) - -type tty struct { - fd int - termios *unix.Termios -} - -func newTTY(fd uintptr) *tty { - termios, _ := unix.IoctlGetTermios(int(fd), unix.TCGETS) - return &tty{int(fd), termios} -} - -func (t *tty) EchoOff() { - if t.termios == nil { - return - } - - newState := *t.termios - newState.Lflag &^= unix.ECHO - newState.Lflag |= unix.ICANON | unix.ISIG - newState.Iflag |= unix.ICRNL - unix.IoctlSetTermios(t.fd, unix.TCSETS, &newState) -} - -func (t *tty) Restore() { - if t.termios == nil { - return - } - - unix.IoctlSetTermios(t.fd, unix.TCSETS, t.termios) -} diff --git a/uname.go b/uname.go deleted file mode 100644 index 8213dba..0000000 --- a/uname.go +++ /dev/null @@ -1,20 +0,0 @@ -package main - -import "syscall" - -func unameRelease() string { - uname := &syscall.Utsname{} - if err := syscall.Uname(uname); err != nil { - fatalf("failed to get kernel version: %v", err) - } - - ba := make([]byte, 0, len(uname.Release)) - for _, c := range uname.Release { - if c == 0 { - break - } - ba = append(ba, byte(c)) - } - - return string(ba) -} diff --git a/vpn.go b/vpn.go deleted file mode 100644 index 408d9a3..0000000 --- a/vpn.go +++ /dev/null @@ -1,137 +0,0 @@ -package main - -import ( - "net" - "os" - "path/filepath" - - "github.com/rs/zerolog/log" - "golang.zx2c4.com/wireguard/wgctrl" - "golang.zx2c4.com/wireguard/wgctrl/wgtypes" - - "novit.tech/direktil/pkg/config" -) - -func setupVPN(vpn config.VPNDef, localGenDir string) { - log := log.With().Str("vpn", vpn.Name).Logger() - - log.Info().Msg("VPN: setting up") - - vpnDir := filepath.Join(localGenDir, vpn.Name) - os.MkdirAll(vpnDir, 0750) - - logMsg := log.Info() - if vpn.ListenPort != nil { - logMsg.Int("ListenPort", *vpn.ListenPort) - } - - // public/private key - keyFile := filepath.Join(vpnDir, "key") - keyBytes, err := os.ReadFile(keyFile) - if os.IsNotExist(err) { - key, err := wgtypes.GeneratePrivateKey() - if err != nil { - fatalf("failed to generate VPN key: %v", err) - } - - keyBytes = []byte(key.String()) - - os.WriteFile(keyFile, keyBytes, 0600) - } else if err != nil { - fatalf("failed to read VPN key: %v", err) - } - - key, err := wgtypes.ParseKey(string(keyBytes)) - if err != nil { - fatalf("bad VPN key: %v", err) - } - - logMsg.Stringer("PublicKey", key.PublicKey()) - - // pre-shared key - pskeyFile := filepath.Join(vpnDir, "pskey") - pskeyBytes, err := os.ReadFile(pskeyFile) - if os.IsNotExist(err) { - key, err := wgtypes.GenerateKey() - if err != nil { - fatalf("failed to generate VPN pre-shared key: %v", err) - } - - pskeyBytes = []byte(key.String()) - - os.WriteFile(pskeyFile, pskeyBytes, 0600) - } else if err != nil { - fatalf("failed to read VPN pre-shared key: %v", err) - } - - pskey, err := wgtypes.ParseKey(string(pskeyBytes)) - if err != nil { - fatalf("bad VPN pre-shared key: %v", err) - } - - { - keyStr := key.String() - logMsg.Str("PresharedKey", keyStr[0:4]+"..."+keyStr[len(keyStr)-4:]) - } - - // setup interface - cfg := wgtypes.Config{ - PrivateKey: &key, - ListenPort: vpn.ListenPort, - Peers: make([]wgtypes.PeerConfig, 0, len(vpn.Peers)), - } - - for idx, vpnPeer := range vpn.Peers { - vpnPeer := vpnPeer - - wgPeer := wgtypes.PeerConfig{ - Endpoint: vpnPeer.Endpoint, - AllowedIPs: make([]net.IPNet, 0, len(vpnPeer.AllowedIPs)), - - PersistentKeepaliveInterval: &vpnPeer.KeepAlive, - } - - if vpnPeer.WithPreSharedKey { - wgPeer.PresharedKey = &pskey - } - - pubkey, err := wgtypes.ParseKey(vpnPeer.PublicKey) - if err != nil { - fatalf("bad VPN peer[%d] public key: %v", idx, err) - } - - wgPeer.PublicKey = pubkey - - for _, ipnetStr := range vpnPeer.AllowedIPs { - _, ipnet, err := net.ParseCIDR(ipnetStr) - if err != nil { - fatalf("bad IP/net: %q: %v", ipnetStr, err) - } - - wgPeer.AllowedIPs = append(wgPeer.AllowedIPs, *ipnet) - } - - cfg.Peers = append(cfg.Peers, wgPeer) - } - - wg, err := wgctrl.New() - if err != nil { - fatalf("failed to setup WireGuard client: %v", err) - } - defer wg.Close() - - log.Info().Strs("ips", vpn.IPs).Msg("VPN: creating interface") - run("ip", "link", "add", vpn.Name, "type", "wireguard") - - for _, ip := range vpn.IPs { - run("ip", "addr", "add", ip, "dev", vpn.Name) - } - - logMsg.Msg("VPN: configuring interface") - err = wg.ConfigureDevice(vpn.Name, cfg) - if err != nil { - fatalf("failed to setup VPN %s: %v", vpn.Name, err) - } - - run("ip", "link", "set", vpn.Name, "up") -}