introduce rust

src/cmd/init.rs

@@ -0,0 +1,213 @@
+use eyre::{format_err, Result};
+use log::{error, info, warn};
+use std::os::unix::fs::symlink;
+use std::{fs, io, process::Command};
+
+use crate::{bootstrap::config::Config, cmd::version::version_string};
+
+mod networks;
+mod sshd;
+
+pub fn run() -> Result<()> {
+    if std::process::id() != 1 {
+        return Err(format_err!(
+            "init must run as PID 1, not {}",
+            std::process::id()
+        ));
+    }
+
+    info!("Welcome to {}", version_string());
+
+    let uname = nix::sys::utsname::uname()?;
+    let kernel_version = uname.release().to_string_lossy();
+    info!("Linux version {kernel_version}");
+
+    let cfg: Config = retry(|| {
+        let cfg = fs::read("config.yaml").map_err(|e| format_err!("failed to read config: {e}"))?;
+        serde_yaml::from_slice(cfg.as_slice())
+            .map_err(|e| format_err!("failed to parse config: {e}"))
+    });
+
+    info!("config loaded");
+    info!("anti-phishing-code: {}", cfg.anti_phishing_code);
+
+    // mount basic filesystems
+    mount("none", "/proc", "proc", None);
+    mount("none", "/sys", "sysfs", None);
+    mount("none", "/dev", "devtmpfs", None);
+    mount("none", "/dev/pts", "devpts", Some("gid=5,mode=620"));
+
+    // mount modules
+    if let Some(ref modules) = cfg.modules {
+        mount(modules, "/modules", "squashfs", None);
+
+        fs::create_dir_all("/lib/modules")?;
+        let modules_path = &format!("/modules/lib/modules/{kernel_version}");
+
+        if !fs::exists(modules_path)? {
+            let e = format_err!("invalid modules package: {modules_path} should exist");
+            error!("{e}");
+            return Err(e);
+        }
+
+        symlink(modules_path, format!("/lib/modules/{kernel_version}"))?;
+    } else {
+        warn!("modules NOT mounted (not configured)");
+    }
+
+    // init devices
+    info!("initializing devices");
+    start_daemon("udevd", &[]);
+
+    exec("udevadm", &["trigger", "-c", "add", "-t", "devices"]);
+    exec("udevadm", &["trigger", "-c", "add", "-t", "subsystems"]);
+    exec("udevadm", &["settle"]);
+
+    // networks
+    networks::setup(&cfg)?;
+
+    // Wireguard VPN
+    // TODO startVPN()
+
+    // SSH service
+    sshd::start(&cfg);
+
+    // dmcrypt blockdevs
+    // TODO setupCrypt(cfg.PreLVMCrypt, map[string]string{});
+
+    // LVM
+    // TODO setupLVM(cfg);
+
+    // bootstrap the system
+    // TODO bootstrap(cfg);
+
+    // finalize
+    // TODO finalizeBoot();
+
+    exec_shell();
+    Ok(())
+}
+
+fn mount(src: &str, dst: &str, fstype: &str, opts: Option<&str>) {
+    if let Err(e) = fs::create_dir_all(dst) {
+        error!("failed to create dir {dst}: {e}");
+    }
+
+    let mut args = vec![src, dst, "-t", fstype];
+    if let Some(opts) = opts {
+        args.extend(["-o", opts]);
+    }
+    exec("mount", &args);
+}
+
+fn start_daemon(prog: &str, args: &[&str]) {
+    let cmd_str = sh_str(prog, args);
+    retry_or_ignore(|| {
+        info!("starting as daemon: {cmd_str}");
+        let mut cmd = Command::new(prog);
+        cmd.args(args);
+        cmd.spawn()?;
+        Ok(())
+    });
+}
+
+fn exec(prog: &str, args: &[&str]) {
+    let cmd_str = sh_str(prog, args);
+    retry_or_ignore(|| {
+        info!("# {cmd_str}");
+        let mut cmd = Command::new(prog);
+        cmd.args(args);
+        let s = cmd.status()?;
+        if s.success() {
+            Ok(())
+        } else {
+            Err(format_err!("command failed: {s}"))
+        }
+    });
+}
+
+fn retry_or_ignore(mut action: impl FnMut() -> Result<()>) {
+    loop {
+        match action() {
+            Ok(_) => return,
+            Err(e) => {
+                error!("{e}");
+
+                loop {
+                    eprint!("[r]etry, [i]gnore, or [s]hell? ");
+
+                    let mut line = String::new();
+                    io::stdin().read_line(&mut line).unwrap();
+
+                    match line.trim() {
+                        "r" => break,
+                        "i" => return,
+                        "s" => {
+                            exec_shell();
+                            break;
+                        }
+                        v => {
+                            eprintln!("invalid choice: {v:?}");
+                        }
+                    };
+                }
+            }
+        }
+    }
+}
+
+fn retry<T>(mut action: impl FnMut() -> Result<T>) -> T {
+    loop {
+        match action() {
+            Ok(v) => return v,
+            Err(e) => {
+                error!("{e}");
+
+                loop {
+                    eprint!("[r]etry, or [s]hell? ");
+
+                    let mut line = String::new();
+                    io::stdin().read_line(&mut line).unwrap();
+
+                    match line.trim() {
+                        "r" => break,
+                        "s" => {
+                            exec_shell();
+                            break;
+                        }
+                        v => {
+                            eprintln!("invalid choice: {v:?}");
+                        }
+                    };
+                }
+            }
+        }
+    }
+}
+
+fn exec_shell() {
+    let mut child = match Command::new("ash").spawn() {
+        Ok(c) => c,
+        Err(e) => {
+            error!("failed to exec shell: {e}");
+            return;
+        }
+    };
+
+    let _ = child.wait();
+}
+
+fn sh_str(prog: &str, args: &[&str]) -> String {
+    use std::borrow::Cow;
+
+    let mut buf = String::new();
+
+    buf.push_str(&shell_escape::escape(Cow::Borrowed(prog)));
+
+    for &arg in args {
+        buf.push(' ');
+        buf.push_str(&shell_escape::escape(Cow::Borrowed(arg)));
+    }
+
+    buf
+}

src/cmd/init/networks.rs

@@ -0,0 +1,93 @@
+use itertools::Itertools;
+use log::{info, warn};
+use std::collections::BTreeSet as Set;
+use std::process::Command;
+
+use super::{format_err, retry_or_ignore, Config, Result};
+use crate::{
+    udev,
+    utils::{select_n_by_regex, NameAliases},
+};
+
+pub fn setup(cfg: &Config) -> Result<()> {
+    if cfg.networks.is_empty() {
+        warn!("no networks configured");
+        return Ok(());
+    }
+
+    let mut assigned: Set<String> = Set::new();
+
+    for net in &cfg.networks {
+        retry_or_ignore(|| {
+            info!("setting up network {}", net.name);
+
+            let netdevs = get_interfaces()?
+                .filter(|dev| !assigned.contains(dev.name()))
+                .collect::<Vec<_>>();
+
+            for dev in &netdevs {
+                info!(
+                    "- available network device: {}, aliases [{}]",
+                    dev.name(),
+                    dev.aliases().join(", ")
+                );
+            }
+
+            let mut cmd = Command::new("ash");
+            cmd.arg("-c");
+            cmd.arg(&net.script);
+
+            let mut selected = Vec::new();
+
+            for iface in &net.interfaces {
+                let var = &iface.var;
+
+                let netdevs = netdevs.iter().filter(|na| !assigned.contains(na.name()));
+                let if_names = select_n_by_regex(iface.n, &iface.regexps, netdevs);
+
+                if if_names.is_empty() {
+                    return Err(format_err!("- no interface match for {var:?}"));
+                }
+
+                let value = if_names.join(" ");
+                info!("- {var}={value}");
+                cmd.env(var, value);
+
+                selected.extend(if_names);
+            }
+
+            info!("- running script");
+            let status = cmd.status()?;
+            if !status.success() {
+                return Err(format_err!("setup script failed: {status}"));
+            }
+
+            assigned.extend(selected);
+            Ok(())
+        });
+    }
+
+    Ok(())
+}
+
+fn get_interfaces() -> Result<impl Iterator<Item = NameAliases>> {
+    Ok(udev::get_devices("net")?.into_iter().map(|dev| {
+        let mut na = NameAliases::new(dev.sysname().to_string());
+
+        for (property, value) in dev.properties() {
+            if [
+                "INTERFACE",
+                "ID_NET_NAME",
+                "ID_NET_NAME_PATH",
+                "ID_NET_NAME_MAC",
+                "ID_NET_NAME_SLOT",
+            ]
+            .contains(&property)
+            {
+                na.push(value.to_string());
+            }
+        }
+
+        na
+    }))
+}

src/cmd/init/sshd.rs

@@ -0,0 +1,81 @@
+use log::{info, warn};
+use std::fs;
+use std::io::Write;
+use std::net;
+use std::os::unix::fs::PermissionsExt;
+use std::process::{Command, Stdio};
+use std::thread;
+
+use super::{retry_or_ignore, Config};
+
+pub fn start(cfg: &Config) {
+    retry_or_ignore(|| {
+        info!("ssh: writing authorized keys");
+
+        let ssh_dir = "/root/.ssh";
+        let authorized_keys = format!("{ssh_dir}/authorized_keys");
+
+        fs::create_dir_all(ssh_dir)?;
+        fs::set_permissions(ssh_dir, fs::Permissions::from_mode(0o700))?;
+
+        let mut ak = Vec::new();
+
+        for auth in &cfg.auths {
+            writeln!(ak, "{} {}", auth.ssh_key, auth.name)?;
+        }
+
+        fs::write(authorized_keys, ak)?;
+        Ok(())
+    });
+
+    retry_or_ignore(|| {
+        let mut sshd_args = Vec::new();
+
+        sshd_args.extend(["-i", "-E", "/var/log/sshd.log"]);
+
+        for key_path in cfg.ssh.keys.iter() {
+            if !fs::exists(key_path).is_ok_and(|b| b) {
+                info!("ssh: host key not found (ignored): {key_path}");
+                continue;
+            }
+            sshd_args.extend(["-h", key_path]);
+        }
+
+        let sshd_args = sshd_args.into_iter().map(String::from).collect();
+
+        // don't pre-start sshd as it should rarely be useful at this stage, use inetd-style.
+        let listen_addr = cfg.ssh.listen.clone();
+        info!("ssh: starting listener on {listen_addr}");
+
+        let listener = net::TcpListener::bind(listen_addr)?;
+
+        thread::spawn(move || handle_ssh_connections(listener, sshd_args));
+
+        Ok(())
+    });
+}
+
+fn handle_ssh_connections(listener: net::TcpListener, sshd_args: Vec<String>) {
+    loop {
+        let Ok((stream, remote)) = listener.accept() else {
+            warn!("ssh: listener stopped");
+            break;
+        };
+
+        info!("ssh: new connection from {remote}");
+
+        use std::os::unix::io::{AsRawFd, FromRawFd};
+        let fd = stream.as_raw_fd();
+
+        let mut cmd = Command::new("/usr/sbin/sshd");
+        cmd.args(&sshd_args);
+
+        cmd.stdin(unsafe { Stdio::from_raw_fd(fd) });
+        cmd.stdout(unsafe { Stdio::from_raw_fd(fd) });
+        cmd.stderr(Stdio::null());
+
+        if let Err(e) = cmd.spawn() {
+            warn!("ssh: failed to start server: {e}");
+        };
+    }
+}

src/cmd/version.rs

@@ -0,0 +1,12 @@
+pub fn run() {
+    println!("{}", version_string());
+}
+
+pub fn version_string() -> String {
+    format!(
+        "Direktil {} v{} (git commit {})",
+        env!("CARGO_PKG_NAME"),
+        env!("CARGO_PKG_VERSION"),
+        env!("GIT_COMMIT")
+    )
+}