direktil/initrd
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

migrate to rust

Browse Source
This commit is contained in:
Mikaël Cluseau
2024-04-29 12:54:25 +02:00
parent 6e1cb57e03
commit fe61aedd4a
85 changed files with 3447 additions and 2460 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.dockerignore
View File

@ -1,4 +1,5 @@
Dockerfile
modd.*
tmp/**/*
dist/*
go.work
@ -6,3 +7,4 @@ go.work.sum
modd.*conf
test-initrd*
test-initrd/**/*
target

2
.gitignore vendored
View File

@ -2,6 +2,8 @@
/dist
/qemu.pid
/test-initrd.cpio
/bootstrap.tar
/tmp
/go.work
/go.work.sum
/target

766
Cargo.lock generated Normal file
View File

@ -0,0 +1,766 @@
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4
[[package]]
name = "addr2line"
version = "0.24.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
dependencies = [
"gimli",
]
[[package]]
name = "adler2"
version = "2.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
[[package]]
name = "aho-corasick"
version = "1.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
dependencies = [
"memchr",
]
[[package]]
name = "anstream"
version = "0.6.19"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
dependencies = [
"anstyle",
"anstyle-parse",
"anstyle-query",
"anstyle-wincon",
"colorchoice",
"is_terminal_polyfill",
"utf8parse",
]
[[package]]
name = "anstyle"
version = "1.0.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
[[package]]
name = "anstyle-parse"
version = "0.2.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
dependencies = [
"utf8parse",
]
[[package]]
name = "anstyle-query"
version = "1.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9"
dependencies = [
"windows-sys 0.59.0",
]
[[package]]
name = "anstyle-wincon"
version = "3.0.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882"
dependencies = [
"anstyle",
"once_cell_polyfill",
"windows-sys 0.59.0",
]
[[package]]
name = "backtrace"
version = "0.3.75"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
dependencies = [
"addr2line",
"cfg-if",
"libc",
"miniz_oxide",
"object",
"rustc-demangle",
"windows-targets",
]
[[package]]
name = "bitflags"
version = "2.9.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
[[package]]
name = "bytes"
version = "1.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
[[package]]
name = "cc"
version = "1.2.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d487aa071b5f64da6f19a3e848e3578944b726ee5a4854b82172f02aa876bfdc"
dependencies = [
"jobserver",
"libc",
"shlex",
]
[[package]]
name = "cfg-if"
version = "1.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
[[package]]
name = "cfg_aliases"
version = "0.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
[[package]]
name = "colorchoice"
version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
[[package]]
name = "cpio"
version = "0.4.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "938e716cb1ade5d6c8f959c13a7248b889c07491fc7e41167c3afe20f8f0de1e"
[[package]]
name = "either"
version = "1.15.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
[[package]]
name = "env_filter"
version = "0.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
dependencies = [
"log",
"regex",
]
[[package]]
name = "env_logger"
version = "0.11.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
dependencies = [
"anstream",
"anstyle",
"env_filter",
"jiff",
"log",
]
[[package]]
name = "equivalent"
version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
[[package]]
name = "eyre"
version = "0.6.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7cd915d99f24784cdc19fd37ef22b97e3ff0ae756c7e492e9fbfe897d61e2aec"
dependencies = [
"indenter",
"once_cell",
]
[[package]]
name = "getrandom"
version = "0.3.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
dependencies = [
"cfg-if",
"libc",
"r-efi",
"wasi 0.14.2+wasi-0.2.4",
]
[[package]]
name = "gimli"
version = "0.31.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
[[package]]
name = "hashbrown"
version = "0.15.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
[[package]]
name = "indenter"
version = "0.3.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ce23b50ad8242c51a442f3ff322d56b02f08852c77e4c0b4d3fd684abc89c683"
[[package]]
name = "indexmap"
version = "2.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
dependencies = [
"equivalent",
"hashbrown",
]
[[package]]
name = "init"
version = "2.4.0"
dependencies = [
"cpio",
"env_logger",
"eyre",
"itertools",
"libc",
"log",
"lz4",
"nix",
"regex",
"serde",
"serde_json",
"serde_yaml",
"shell-escape",
"termios",
"tokio",
"unix_mode",
"zstd",
]
[[package]]
name = "is_terminal_polyfill"
version = "1.70.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
[[package]]
name = "itertools"
version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
dependencies = [
"either",
]
[[package]]
name = "itoa"
version = "1.0.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
[[package]]
name = "jiff"
version = "0.2.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "be1f93b8b1eb69c77f24bbb0afdf66f54b632ee39af40ca21c4365a1d7347e49"
dependencies = [
"jiff-static",
"log",
"portable-atomic",
"portable-atomic-util",
"serde",
]
[[package]]
name = "jiff-static"
version = "0.2.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "03343451ff899767262ec32146f6d559dd759fdadf42ff0e227c7c48f72594b4"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "jobserver"
version = "0.1.33"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
dependencies = [
"getrandom",
"libc",
]
[[package]]
name = "libc"
version = "0.2.173"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d8cfeafaffdbc32176b64fb251369d52ea9f0a8fbc6f8759edffef7b525d64bb"
[[package]]
name = "log"
version = "0.4.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
[[package]]
name = "lz4"
version = "1.28.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a20b523e860d03443e98350ceaac5e71c6ba89aea7d960769ec3ce37f4de5af4"
dependencies = [
"lz4-sys",
]
[[package]]
name = "lz4-sys"
version = "1.11.1+lz4-1.10.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6bd8c0d6c6ed0cd30b3652886bb8711dc4bb01d637a68105a3d5158039b418e6"
dependencies = [
"cc",
"libc",
]
[[package]]
name = "memchr"
version = "2.7.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
[[package]]
name = "miniz_oxide"
version = "0.8.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
dependencies = [
"adler2",
]
[[package]]
name = "mio"
version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
dependencies = [
"libc",
"wasi 0.11.1+wasi-snapshot-preview1",
"windows-sys 0.59.0",
]
[[package]]
name = "nix"
version = "0.30.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
dependencies = [
"bitflags",
"cfg-if",
"cfg_aliases",
"libc",
]
[[package]]
name = "object"
version = "0.36.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
dependencies = [
"memchr",
]
[[package]]
name = "once_cell"
version = "1.21.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
[[package]]
name = "once_cell_polyfill"
version = "1.70.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
[[package]]
name = "pin-project-lite"
version = "0.2.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
[[package]]
name = "pkg-config"
version = "0.3.32"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
[[package]]
name = "portable-atomic"
version = "1.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
[[package]]
name = "portable-atomic-util"
version = "0.2.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
dependencies = [
"portable-atomic",
]
[[package]]
name = "proc-macro2"
version = "1.0.95"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
dependencies = [
"unicode-ident",
]
[[package]]
name = "quote"
version = "1.0.40"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
dependencies = [
"proc-macro2",
]
[[package]]
name = "r-efi"
version = "5.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
[[package]]
name = "regex"
version = "1.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
dependencies = [
"aho-corasick",
"memchr",
"regex-automata",
"regex-syntax",
]
[[package]]
name = "regex-automata"
version = "0.4.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
dependencies = [
"aho-corasick",
"memchr",
"regex-syntax",
]
[[package]]
name = "regex-syntax"
version = "0.8.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
[[package]]
name = "rustc-demangle"
version = "0.1.25"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
[[package]]
name = "ryu"
version = "1.0.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
[[package]]
name = "serde"
version = "1.0.219"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
dependencies = [
"serde_derive",
]
[[package]]
name = "serde_derive"
version = "1.0.219"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "serde_json"
version = "1.0.140"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
dependencies = [
"itoa",
"memchr",
"ryu",
"serde",
]
[[package]]
name = "serde_yaml"
version = "0.9.34+deprecated"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
dependencies = [
"indexmap",
"itoa",
"ryu",
"serde",
"unsafe-libyaml",
]
[[package]]
name = "shell-escape"
version = "0.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f"
[[package]]
name = "shlex"
version = "1.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
[[package]]
name = "signal-hook-registry"
version = "1.4.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
dependencies = [
"libc",
]
[[package]]
name = "socket2"
version = "0.5.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
dependencies = [
"libc",
"windows-sys 0.52.0",
]
[[package]]
name = "syn"
version = "2.0.103"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e4307e30089d6fd6aff212f2da3a1f9e32f3223b1f010fb09b7c95f90f3ca1e8"
dependencies = [
"proc-macro2",
"quote",
"unicode-ident",
]
[[package]]
name = "termios"
version = "0.3.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "411c5bf740737c7918b8b1fe232dca4dc9f8e754b8ad5e20966814001ed0ac6b"
dependencies = [
"libc",
]
[[package]]
name = "tokio"
version = "1.45.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "75ef51a33ef1da925cea3e4eb122833cb377c61439ca401b770f54902b806779"
dependencies = [
"backtrace",
"bytes",
"libc",
"mio",
"pin-project-lite",
"signal-hook-registry",
"socket2",
"tokio-macros",
"windows-sys 0.52.0",
]
[[package]]
name = "tokio-macros"
version = "2.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
dependencies = [
"proc-macro2",
"quote",
"syn",
]
[[package]]
name = "unicode-ident"
version = "1.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
[[package]]
name = "unix_mode"
version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b55eedc365f81a3c32aea49baf23fa965e3cd85bcc28fb8045708c7388d124ef"
[[package]]
name = "unsafe-libyaml"
version = "0.2.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
[[package]]
name = "utf8parse"
version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
[[package]]
name = "wasi"
version = "0.11.1+wasi-snapshot-preview1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
[[package]]
name = "wasi"
version = "0.14.2+wasi-0.2.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
dependencies = [
"wit-bindgen-rt",
]
[[package]]
name = "windows-sys"
version = "0.52.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
dependencies = [
"windows-targets",
]
[[package]]
name = "windows-sys"
version = "0.59.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
dependencies = [
"windows-targets",
]
[[package]]
name = "windows-targets"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
dependencies = [
"windows_aarch64_gnullvm",
"windows_aarch64_msvc",
"windows_i686_gnu",
"windows_i686_gnullvm",
"windows_i686_msvc",
"windows_x86_64_gnu",
"windows_x86_64_gnullvm",
"windows_x86_64_msvc",
]
[[package]]
name = "windows_aarch64_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
[[package]]
name = "windows_aarch64_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
[[package]]
name = "windows_i686_gnu"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
[[package]]
name = "windows_i686_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
[[package]]
name = "windows_i686_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
[[package]]
name = "windows_x86_64_gnu"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
[[package]]
name = "windows_x86_64_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
[[package]]
name = "windows_x86_64_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
[[package]]
name = "wit-bindgen-rt"
version = "0.39.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
dependencies = [
"bitflags",
]
[[package]]
name = "zstd"
version = "0.13.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
dependencies = [
"zstd-safe",
]
[[package]]
name = "zstd-safe"
version = "7.2.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
dependencies = [
"zstd-sys",
]
[[package]]
name = "zstd-sys"
version = "2.0.15+zstd.1.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "eb81183ddd97d0c74cedf1d50d85c8d08c1b8b68ee863bdee9e706eedba1a237"
dependencies = [
"cc",
"pkg-config",
]

30
Cargo.toml Normal file
View File

@ -0,0 +1,30 @@
[package]
name = "init"
version = "2.4.0"
edition = "2024"
[profile.release]
strip = true
panic = "abort"
opt-level = "z"
lto = true
codegen-units = 1
[dependencies]
libc = { version = "0.2", default-features = false }
env_logger = "0.11.3"
eyre = "0.6.12"
itertools = "0.14.0"
log = "0.4.21"
nix = { version = "0.30.1", features = ["feature", "mount", "process", "reboot", "signal"] }
regex = "1.11.1"
serde = { version = "1.0.198", features = ["derive"] }
serde_json = "1.0.116"
serde_yaml = "0.9.34"
shell-escape = "0.1.5"
tokio = { version = "1.38.0", features = ["rt", "net", "fs", "process", "io-std", "io-util", "sync", "macros", "signal"] }
termios = "0.3.3"
zstd = "0.13.3"
unix_mode = "0.1.4"
cpio = "0.4.1"
lz4 = "1.28.1"

45
Dockerfile
View File

@ -1,39 +1,44 @@
from golang:1.23.2-alpine3.20 as build
run apk add --no-cache gcc musl-dev linux-headers eudev-dev upx
from rust:1.88.0-alpine as rust
run apk add --no-cache git musl-dev libudev-zero-dev # pkgconfig cryptsetup-dev lvm2-dev clang-dev clang-static
workdir /src
copy . .
env CGO_ENABLED=1
run \
--mount=type=cache,id=gomod,target=/go/pkg/mod \
--mount=type=cache,id=gobuild,target=/root/.cache/go-build \
go test ./... \
&& go build -ldflags "-s -w" -o /go/bin/init -trimpath .
run upx /go/bin/init
run --mount=type=cache,id=novit-rs,target=/usr/local/cargo/registry \
--mount=type=cache,id=novit-rs-target,sharing=private,target=/src/target \
cargo build --release && cp target/release/init /
# ------------------------------------------------------------------------
from alpine:3.20.3 as initrd
from alpine:3.22.0 as initrd
run apk add zstd lz4
run apk add --no-cache xz
workdir /system
workdir /layer
run . /etc/os-release \
&& wget -O- https://dl-cdn.alpinelinux.org/alpine/v${VERSION_ID%.*}/releases/x86_64/alpine-minirootfs-${VERSION_ID}-x86_64.tar.gz |tar zxv
run apk add --no-cache -p . musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs lsblk
run rm -rf usr/share/apk var/cache/apk
run apk add --no-cache --update -p . musl coreutils \
lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup \
e2fsprogs lsblk openssh-server wireguard-tools-wg-quick \
&& rm -rf usr/share/apk var/cache/apk etc/motd
copy --from=build /go/bin/init .
copy etc/sshd_config etc/ssh/sshd_config
run mkdir /layer \
&& mv dev /layer \
# && find |cpio -H newc -o |lz4 >/layer/system.alz4
&& find |cpio -H newc -o |zstd -19 >/layer/system.azstd
workdir /layer
copy --from=rust /init init
run mkdir -p bin run var/log; cd bin && for cmd in init-version init-connect bootstrap; do ln -s ../init $cmd; done
# check viability
run chroot /layer /init hello
run chroot . init-version
run find |cpio -H newc -o >/initrd
# ------------------------------------------------------------------------
from alpine:3.20.3
from alpine:3.22.0
copy --from=initrd /initrd /
entrypoint ["base64","/initrd"]

5
Dockerfile.build Normal file
View File

@ -0,0 +1,5 @@
from rust:1.77.1-alpine as rust
run apk add --no-cache musl-dev
run apk add --no-cache musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs lsblk

2
Dockerfile.test Normal file
View File

@ -0,0 +1,2 @@
from alpine:3.19.0
run apk add --no-cache musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs btrfs-progs lsblk

140
apply-config.go
View File

@ -1,140 +0,0 @@
package main
import (
"os"
"path/filepath"
"strconv"
"strings"
"syscall"
"time"
"github.com/rs/zerolog/log"
yaml "gopkg.in/yaml.v2"
"novit.tech/direktil/pkg/config/apply"
)
var loopOffset = 0
func applyConfig(cfgPath string, bootMounted bool) (cfg *configV1) {
cfgBytes, err := os.ReadFile(cfgPath)
if err != nil {
fatalf("failed to read %s: %v", cfgPath, err)
}
cfg = &configV1{}
if err := yaml.Unmarshal(cfgBytes, cfg); err != nil {
fatal("failed to load config: ", err)
}
// mount layers
if len(cfg.Layers) == 0 {
fatal("no layers configured!")
}
layersInMemory := paramBool("layers-in-mem", false)
log.Info().Strs("layers", cfg.Layers).Bool("in-memory", layersInMemory).Msg("mounting layers")
const layersInMemDir = "/layers-in-mem"
if layersInMemory {
mkdir(layersInMemDir, 0700)
mount("layers-mem", layersInMemDir, "tmpfs", 0, "")
}
lowers := make([]string, len(cfg.Layers))
for i, layer := range cfg.Layers {
log := log.With().Str("layer", layer).Logger()
path := layerPath(layer)
info, err := os.Stat(path)
if err != nil {
fatal(err)
}
log.Info().Int64("size", info.Size()).Msg("layer found")
if layersInMemory {
log.Info().Msg("copying to memory")
targetPath := filepath.Join(layersInMemDir, layer)
cp(path, targetPath)
path = targetPath
}
dir := "/layers/" + layer
lowers[i] = dir
mountSquahfs(path, dir)
}
// prepare system root
mount("mem", "/changes", "tmpfs", 0, "")
mkdir("/changes/workdir", 0755)
mkdir("/changes/upperdir", 0755)
mount("overlay", "/system", "overlay", rootMountFlags,
"lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir")
// make root rshared (default in systemd, required by Kubernetes 1.10+)
// equivalent to "mount --make-rshared /"
// see kernel's Documentation/sharedsubtree.txt (search rshared)
if err := syscall.Mount("", "/system", "", syscall.MS_SHARED|syscall.MS_REC, ""); err != nil {
fatalf("FATAL: mount --make-rshared / failed: %v", err)
}
if bootMounted {
if layersInMemory {
if err := syscall.Unmount("/boot", 0); err != nil {
log.Warn().Err(err).Msg("failed to unmount /boot")
time.Sleep(2 * time.Second)
}
} else {
mount("/boot", "/system/boot", "", syscall.MS_BIND, "")
}
}
// - write files
apply.Files(cfg.Files, "/system")
// - groups
for _, group := range cfg.Groups {
logEvt := log.Info().Str("group", group.Name)
opts := make([]string, 0)
opts = append(opts /* chroot */, "/system", "groupadd", "-r")
if group.Gid != 0 {
opts = append(opts, "-g", strconv.Itoa(group.Gid))
logEvt.Int("gid", group.Gid)
}
opts = append(opts, group.Name)
logEvt.Msg("creating group")
run("chroot", opts...)
}
// - user
for _, user := range cfg.Users {
logEvt := log.Info().Str("user", user.Name)
opts := make([]string, 0)
opts = append(opts /* chroot */, "/system", "useradd", "-r")
if user.Gid != 0 {
opts = append(opts, "-g", strconv.Itoa(user.Gid))
logEvt.Int("gid", user.Gid)
}
if user.Uid != 0 {
opts = append(opts, "-u", strconv.Itoa(user.Uid))
logEvt.Int("uid", user.Uid)
}
opts = append(opts, user.Name)
logEvt.Msg("creating user")
run("chroot", opts...)
}
return
}

56
ask-secret.go
View File

@ -1,56 +0,0 @@
package main
import (
"bufio"
"bytes"
"fmt"
"io"
"os"
"sync"
"sync/atomic"
)
var (
inputTTYs = new(sync.Map)
askingSecret atomic.Bool
)
func registerInput(in *tty) { inputTTYs.Store(in, in) }
func unregiterInput(in *tty) { inputTTYs.Delete(in) }
func askSecret(prompt string) (s []byte) {
err := func() (err error) {
askingSecret.Store(true)
defer askingSecret.Store(false)
inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).EchoOff(); return true })
defer inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).Restore(); return true })
var (
in io.Reader = stdin
out io.Writer = stdout
)
if stdin == nil {
in = os.Stdin
out = os.Stdout
}
out.Write([]byte(prompt + ": "))
s, err = bufio.NewReader(in).ReadBytes('\n')
if err != nil {
return
}
fmt.Println()
s = bytes.TrimRight(s, "\r\n")
return
}()
if err != nil {
fatalf("failed to read from stdin: %v", err)
}
return
}

59
auth.go
View File

@ -1,59 +0,0 @@
package main
import (
"bytes"
"errors"
"github.com/rs/zerolog/log"
"golang.org/x/crypto/ssh"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
var (
auths []config.Auth
)
func localAuth() bool {
sec := askSecret("password")
for _, auth := range auths {
if auth.Password == "" {
continue
}
if config.CheckPassword(auth.Password, sec) {
log.Info().Msgf("login with auth %q", auth.Name)
return true
}
}
return false
}
func sshCheckPubkey(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
keyBytes := key.Marshal()
for _, auth := range auths {
if auth.SSHKey == "" {
continue
}
allowedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(auth.SSHKey))
if err != nil {
log.Warn().Err(err).Str("user", auth.Name).Str("key", auth.SSHKey).Msg("SSH public key is invalid")
return nil, err
}
if bytes.Equal(allowedKey.Marshal(), keyBytes) {
log.Info().Str("user", auth.Name).Msg("ssh: accepting public key")
return &ssh.Permissions{
Extensions: map[string]string{
"pubkey-fp": ssh.FingerprintSHA256(key),
},
}, nil
}
}
return nil, errors.New("no matching public key")
}

104
boot-v2.go
View File

@ -1,104 +0,0 @@
package main
import (
"os"
"os/exec"
"syscall"
"github.com/rs/zerolog/log"
"gopkg.in/yaml.v3"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func bootV2() {
log.Info().Msg("-- boot v2 --")
kernelVersion := unameRelease()
log.Info().Str("version", kernelVersion).Msg("Linux")
cfg := &config.Config{}
{
f, err := os.Open("/config.yaml")
if err != nil {
fatal("failed to open /config.yaml: ", err)
}
err = yaml.NewDecoder(f).Decode(cfg)
f.Close()
if err != nil {
fatal("failed to parse /config.yaml: ", err)
}
}
log.Info().Msg("config loaded")
if cfg.AntiPhishingCode != "" {
log.Info().Str("anti-phishing-code", cfg.AntiPhishingCode).Send()
}
auths = cfg.Auths
// mount kernel modules
if cfg.Modules == "" {
log.Warn().Msg("NOT mounting modules (\"modules:\" not specified)")
} else {
log.Info().Str("from", cfg.Modules).Msg("mounting modules")
mountSquahfs(cfg.Modules, "/modules")
modulesSourcePath := "/modules/lib/modules/" + kernelVersion
if _, err := os.Stat(modulesSourcePath); err != nil {
fatal("invalid modules dir: ", err)
}
os.MkdirAll("/lib/modules", 0755)
if err := os.Symlink(modulesSourcePath, "/lib/modules/"+kernelVersion); err != nil {
fatal("failed to symlink modules: ", err)
}
}
// devices init
log.Info().Msg("starting udevd")
err := exec.Command("udevd").Start()
if err != nil {
fatal("failed to start udevd: ", err)
}
log.Info().Msg("udevadm triggers")
run("udevadm", "trigger", "-c", "add", "-t", "devices")
run("udevadm", "trigger", "-c", "add", "-t", "subsystems")
log.Info().Msg("udevadm settle")
run("udevadm", "settle")
// networks
setupNetworks(cfg)
// Wireguard VPN
// TODO startVPN()
// SSH service
startSSH(cfg)
// dmcrypt blockdevs
setupCrypt(cfg.PreLVMCrypt, map[string]string{})
// LVM
setupLVM(cfg)
// bootstrap the system
bootstrap(cfg)
// finalize
finalizeBoot()
}
func finalizeBoot() {
// switch root
log.Info().Msg("switching root")
err := syscall.Exec("/sbin/switch_root", []string{"switch_root",
"-c", "/dev/console", "/system", "/sbin/init"}, os.Environ())
fatal("switch_root failed: ", err)
}

192
bootstrap.go
View File

@ -1,192 +0,0 @@
package main
import (
"bytes"
"fmt"
"io"
"net/http"
"os"
"path/filepath"
"strings"
"time"
"github.com/rs/zerolog/log"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func bootstrap(cfg *config.Config) {
if cfg.Bootstrap.Dev == "" {
fatalf("bootstrap device not defined!")
}
const bsDir = "/bootstrap"
os.MkdirAll(bsDir, 0700)
run("mount", cfg.Bootstrap.Dev, bsDir)
baseDir := filepath.Join(bsDir, bootVersion)
sysCfgPath := filepath.Join(baseDir, "config.yaml")
if _, err := os.Stat(sysCfgPath); os.IsNotExist(err) {
log.Warn().Msgf("bootstrap %q does not exist", bootVersion)
seed := cfg.Bootstrap.Seed
if seed == "" {
fatalf("boostrap seed not defined, admin required")
}
log.Info().Str("from", seed).Msgf("seeding bootstrap")
err = os.MkdirAll(baseDir, 0700)
if err != nil {
fatalf("failed to create bootstrap dir: %v", err)
}
bootstrapFile := filepath.Join(baseDir, "bootstrap.tar")
err = func() (err error) {
var resp *http.Response
start := time.Now()
for time.Since(start) <= time.Minute {
resp, err = http.Get(seed)
if err == nil {
break
}
time.Sleep(time.Second)
}
if err != nil {
return fmt.Errorf("failed to fetch bootstrap")
}
if resp.StatusCode != http.StatusOK {
err = fmt.Errorf("bad HTTP status: %s", resp.Status)
return
}
defer resp.Body.Close()
out, err := os.Create(bootstrapFile)
if err != nil {
return
}
defer out.Close()
_, err = io.Copy(out, resp.Body)
return
}()
if err != nil {
fatalf("seeding failed: %v", err)
}
log.Info().Msg("unpacking bootstrap file")
run("tar", "xvf", bootstrapFile, "-C", baseDir)
}
layersDir = baseDir
layersOverride["modules"] = "/modules.sqfs"
sysCfg := applyConfig(sysCfgPath, false)
// load requested modules
for _, mod := range sysCfg.Modules {
log.Info().Str("module", mod).Msg("loading module")
run("modprobe", mod)
}
// localy-generated assets dir
localGenDir := filepath.Join(bsDir, "local-gen")
// vpns are v2+
for _, vpn := range sysCfg.VPNs {
setupVPN(vpn, localGenDir)
}
// mounts are v2+
for _, mount := range sysCfg.Mounts {
log.Info().Str("source", mount.Dev).Str("target", mount.Path).Msg("mount")
path := filepath.Join("/system", mount.Path)
os.MkdirAll(path, 0755)
args := []string{mount.Dev, path}
if mount.Type != "" {
args = append(args, "-t", mount.Type)
}
if mount.Options != "" {
args = append(args, "-o", mount.Options)
}
run("mount", args...)
}
// setup root user
if ph := sysCfg.RootUser.PasswordHash; ph != "" {
log.Info().Msg("setting root's password")
setUserPass("root", ph)
}
if ak := sysCfg.RootUser.AuthorizedKeys; len(ak) != 0 {
log.Info().Msg("setting root's authorized keys")
setAuthorizedKeys(ak)
}
// update-ca-certificates
log.Info().Msg("updating CA certificates")
run("chroot", "/system", "update-ca-certificates")
}
func setUserPass(user, passwordHash string) {
const fpath = "/system/etc/shadow"
ba, err := os.ReadFile(fpath)
if err != nil {
fatalf("failed to read shadow: %v", err)
}
lines := bytes.Split(ba, []byte{'\n'})
buf := new(bytes.Buffer)
for _, line := range lines {
line := string(line)
p := strings.Split(line, ":")
if len(p) < 2 || p[0] != user {
buf.WriteString(line)
buf.WriteByte('\n')
continue
}
p[1] = passwordHash
line = strings.Join(p, ":")
buf.WriteString(line)
buf.WriteByte('\n')
}
err = os.WriteFile(fpath, buf.Bytes(), 0600)
if err != nil {
fatalf("failed to write shadow: %v", err)
}
}
func setAuthorizedKeys(ak []string) {
buf := new(bytes.Buffer)
for _, k := range ak {
buf.WriteString(k)
buf.WriteByte('\n')
}
const sshDir = "/system/root/.ssh"
err := os.MkdirAll(sshDir, 0700)
if err != nil {
fatalf("failed to create %s: %v", sshDir, err)
}
err = os.WriteFile(filepath.Join(sshDir, "authorized_keys"), buf.Bytes(), 0600)
if err != nil {
fatalf("failed to write authorized keys: %v", err)
}
}

27
build-init Executable file
View File

@ -0,0 +1,27 @@
set -ex
which podman &>/dev/null && docker=podman || docker=docker
mkdir -p empty
$docker build -t nv-rs-build --network=host -f Dockerfile.build empty
case $1 in
release)
opts=--release
bindir=target/release
;;
"")
bindir=target/debug
;;
*)
echo >&2 "invalid arg: $1"
exit 1
;;
esac
$docker run --rm -i --net=host --user=$UID \
nv-rs-build \
cargo build $opts
mkdir -p dist
cp $bindir/init dist/

9
build.rs Normal file
View File

@ -0,0 +1,9 @@
use std::process::Command;
fn main() {
let output = Command::new("git")
.args(&["rev-parse", "HEAD"])
.output()
.unwrap();
let git_commit = String::from_utf8(output.stdout).unwrap();
println!("cargo:rustc-env=GIT_COMMIT={}", git_commit);
}

45
colorio/colorio.go
View File

@ -1,45 +0,0 @@
package colorio
import "io"
var (
Reset = []byte("\033[0m")
Bold = []byte("\033[1m")
Dim = []byte("\033[2m")
Underlined = []byte("\033[4m")
Blink = []byte("\033[5m")
Reverse = []byte("\033[7m")
Hidden = []byte("\033[8m")
)
type writer struct {
before []byte
after []byte
w io.Writer
}
func NewWriter(color []byte, w io.Writer) io.Writer {
return writer{
before: color,
after: Reset,
w: w,
}
}
func (w writer) Write(ba []byte) (n int, err error) {
b := make([]byte, len(w.before)+len(ba)+len(w.after))
copy(b, w.before)
copy(b[len(w.before):], ba)
copy(b[len(w.before)+len(ba):], w.after)
n, err = w.w.Write(b)
n -= len(w.before)
if n < 0 {
n = 0
} else if n > len(ba) {
n = len(ba)
}
return
}

21
colorio/colorio_test.go
View File

@ -1,21 +0,0 @@
package colorio
import (
"bytes"
"fmt"
"testing"
)
func TestWriter(t *testing.T) {
buf := new(bytes.Buffer)
w := NewWriter(Bold, buf)
buf.WriteByte('{')
fmt.Fprintln(w, "hello")
buf.WriteByte('}')
if s, exp := buf.String(), "{"+string(Bold)+"hello\n"+string(Reset)+"}"; s != exp {
t.Errorf("%q != %q", s, exp)
}
}

7
config.go
View File

@ -1,7 +0,0 @@
package main
import (
nconfig "novit.tech/direktil/pkg/config"
)
type configV1 = nconfig.Config

1
debug/bootstrap Symbolic link
View File

@ -0,0 +1 @@
../target/debug/init

1
debug/connect-boot Symbolic link
View File

@ -0,0 +1 @@
../target/debug/init

1
debug/init Symbolic link
View File

@ -0,0 +1 @@
../target/debug/init

1
debug/init-version Symbolic link
View File

@ -0,0 +1 @@
../target/debug/init

7
etc/sshd_config Normal file
View File

@ -0,0 +1,7 @@
KbdInteractiveAuthentication no
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin yes
AllowUsers root

22
filter.go
View File

@ -1,22 +0,0 @@
package main
func filter[T any](values []T, accept func(T) bool) []T {
r := make([]T, 0, len(values))
for _, v := range values {
if accept(v) {
r = append(r, v)
}
}
return r
}
func contains[T any](values []T, accept func(T) bool) bool {
for _, v := range values {
if accept(v) {
return true
}
}
return false
}

13
filter_test.go
View File

@ -1,13 +0,0 @@
package main
import (
"fmt"
"testing"
)
func TestFilter(t*testing.T) {
a := filter([]string{"a","b","c"}, func(v string) bool { return v != "b" })
if fmt.Sprint(a) != "[a c]" {
t.Errorf("bad result: %v", a)
}
}

35
go.mod
View File

@ -1,35 +0,0 @@
module novit.tech/direktil/initrd
require (
github.com/creack/pty v1.1.24
github.com/freddierice/go-losetup/v2 v2.0.1
github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b
github.com/pkg/term v1.1.0
github.com/rs/zerolog v1.34.0
golang.org/x/crypto v0.38.0
golang.org/x/sys v0.33.0
golang.org/x/term v0.32.0
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
gopkg.in/yaml.v2 v2.4.0
gopkg.in/yaml.v3 v3.0.1
novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6
)
require (
github.com/cavaliergopher/cpio v1.0.1 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 // indirect
github.com/josharian/native v1.1.0 // indirect
github.com/mattn/go-colorable v0.1.14 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/mdlayher/genetlink v1.3.2 // indirect
github.com/mdlayher/netlink v1.7.2 // indirect
github.com/mdlayher/socket v0.5.1 // indirect
golang.org/x/net v0.40.0 // indirect
golang.org/x/sync v0.14.0 // indirect
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect
)
go 1.23.1
toolchain go1.24.3

104
go.sum
View File

@ -1,104 +0,0 @@
github.com/cavaliergopher/cpio v1.0.1 h1:KQFSeKmZhv0cr+kawA3a0xTQCU4QxXF1vhU7P7av2KM=
github.com/cavaliergopher/cpio v1.0.1/go.mod h1:pBdaqQjnvXxdS/6CvNDwIANIFSP0xRKI16PX4xejRQc=
github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
github.com/freddierice/go-losetup/v2 v2.0.1 h1:wPDx/Elu9nDV8y/CvIbEDz5Xi5Zo80y4h7MKbi3XaAI=
github.com/freddierice/go-losetup/v2 v2.0.1/go.mod h1:TEyBrvlOelsPEhfWD5rutNXDmUszBXuFnwT1kIQF4J8=
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 h1:smvLGU3obGU5kny71BtE/ibR0wIXRUiRFDmSn0Nxz1E=
github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1/go.mod h1:fP/NdyhRVOv09PLRbVXrSqHhrfQypdZwgE2L4h2U5C8=
github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b h1:Pzf7tldbCVqwl3NnOnTamEWdh/rL41fsoYCn2HdHgRA=
github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b/go.mod h1:IBDUGq30U56w969YNPomhMbRje1GrhUsCh7tHdwgLXA=
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6 h1:D0TN5GyZ4d88ILpgVZgcZ62027lW8/LLnQSpQyN2yOw=
novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6/go.mod h1:zjezU6tELE880oYHs/WAauGBupKIEQQ7KqWTB69RW10=

1
init-rs Symbolic link
View File

@ -0,0 +1 @@
target/debug/init

26
losetup.go
View File

@ -1,26 +0,0 @@
package main
import (
"syscall"
"github.com/freddierice/go-losetup/v2"
)
var loDevices = map[string]losetup.Device{}
func losetupAttach(file string) losetup.Device {
if _, ok := loDevices[file]; !ok {
dev, err := losetup.Attach(file, 0, true)
if err != nil {
fatalf("failed to attach %q to a loop device: %v", file, err)
}
loDevices[file] = dev
}
return loDevices[file]
}
func mountSquahfs(source, target string) {
dev := losetupAttach(source)
mount(dev.Path(), target, "squashfs", syscall.MS_RDONLY, "")
}

410
lvm.go
View File

@ -1,410 +0,0 @@
package main
import (
"bytes"
"io/fs"
"os"
"os/exec"
"path/filepath"
"sort"
"strconv"
"syscall"
udev "github.com/jochenvg/go-udev"
"github.com/rs/zerolog/log"
config "novit.tech/direktil/pkg/bootstrapconfig"
"novit.tech/direktil/initrd/lvm"
)
func sortedKeys[T any](m map[string]T) (keys []string) {
keys = make([]string, 0, len(m))
for k := range m {
keys = append(keys, k)
}
sort.Strings(keys)
return
}
func setupLVM(cfg *config.Config) {
if len(cfg.LVM) == 0 {
log.Info().Msg("no LVM VG configured.")
return
}
// [dev] = filesystem
// eg: [/dev/sda1] = ext4
createdDevs := map[string]string{}
run("pvscan")
run("vgscan", "--mknodes")
for _, vg := range cfg.LVM {
setupVG(vg)
}
for _, vg := range cfg.LVM {
setupLVs(vg, createdDevs)
}
run("vgchange", "--sysinit", "-a", "ly")
setupCrypt(cfg.Crypt, createdDevs)
devs := make([]string, 0, len(createdDevs))
for k := range createdDevs {
devs = append(devs, k)
}
sort.Strings(devs)
for _, dev := range devs {
setupFS(dev, createdDevs[dev])
}
}
func setupVG(vg config.LvmVG) {
pvs := lvm.PVSReport{}
err := runJSON(&pvs, "pvs", "--reportformat", "json")
if err != nil {
fatalf("failed to list LVM PVs: %v", err)
}
vgExists := false
devNeeded := vg.PVs.N
for _, pv := range pvs.PVs() {
if pv.VGName == vg.VG {
vgExists = true
devNeeded--
}
}
log := log.With().Str("vg", vg.VG).Logger()
if devNeeded <= 0 {
log.Info().Msg("LVM VG has all its devices")
return
}
if vgExists {
log.Info().Msgf("LVM VG misses %d devices", devNeeded)
} else {
log.Info().Msg("LVM VG does not exists, creating")
}
devNames := make([]NameAliases, 0)
{
devRefs := map[uint64]*NameAliases{}
enum := new(udev.Udev).NewEnumerate()
enum.AddMatchSubsystem("block")
devs, err := enum.Devices()
if err != nil {
fatal("udev enumeration failed")
}
for _, dev := range devs {
num := dev.Devnum()
n := dev.PropertyValue("DEVNAME")
idx := len(devNames)
devNames = append(devNames, nameAlias(n))
ref := uint64(num.Major())<<8 | uint64(num.Minor())
devRefs[ref] = &devNames[idx]
}
err = filepath.Walk("/dev", func(n string, fi fs.FileInfo, err error) error {
if fi.Mode().Type() == os.ModeDevice {
stat := fi.Sys().(*syscall.Stat_t)
ref := stat.Rdev
if na := devRefs[ref]; na != nil {
na.AddAlias(n)
}
}
return err
})
if err != nil {
fatalf("failed to walk /dev: %v", err)
}
}
for _, dev := range devNames {
log.Info().Str("name", dev.Name).Any("aliases", dev.Aliases).Msg("found block device")
}
m := regexpSelectN(vg.PVs.N, vg.PVs.Regexps, devNames)
if len(m) == 0 {
log.Error().Strs("regexps", vg.PVs.Regexps).Msg("no device match the regexps")
fatalf("failed to setup VG %s", vg.VG)
}
if vgExists {
log.Info().Strs("devices", m).Msg("LVM VG: extending")
run("vgextend", append([]string{vg.VG}, m...)...)
devNeeded -= len(m)
} else {
log.Info().Strs("devices", m).Msg("LVM VG: creating")
run("vgcreate", append([]string{vg.VG}, m...)...)
devNeeded -= len(m)
}
if devNeeded > 0 {
fatalf("VG %s does not have enough devices (%d missing)", vg.VG, devNeeded)
}
}
func setupLVs(vg config.LvmVG, createdDevs map[string]string) {
lvsRep := lvm.LVSReport{}
err := runJSON(&lvsRep, "lvs", "--reportformat", "json")
if err != nil {
fatalf("lvs failed: %v", err)
}
lvs := lvsRep.LVs()
defaults := vg.Defaults
for idx, lv := range vg.LVs {
log := log.With().Str("vg", vg.VG).Str("lv", lv.Name).Logger()
if contains(lvs, func(v lvm.LV) bool {
return v.VGName == vg.VG && v.Name == lv.Name
}) {
log.Info().Msg("LV exists")
continue
}
log.Info().Msg("LV does not exist")
if lv.Raid == nil {
lv.Raid = defaults.Raid
}
args := make([]string, 0)
if lv.Name == "" {
fatalf("LV[%d] has no name", idx)
}
args = append(args, vg.VG, "--name", lv.Name)
if lv.Size != "" && lv.Extents != "" {
fatalf("LV has both size and extents defined!")
} else if lv.Size == "" && lv.Extents == "" {
fatalf("LV does not have size or extents defined!")
} else if lv.Size != "" {
args = append(args, "-L", lv.Size)
} else /* if lv.Extents != "" */ {
args = append(args, "-l", lv.Extents)
}
if raid := lv.Raid; raid != nil {
if raid.Mirrors != 0 {
args = append(args, "--mirrors", strconv.Itoa(raid.Mirrors))
}
if raid.Stripes != 0 {
args = append(args, "--stripes", strconv.Itoa(raid.Stripes))
}
}
log.Info().Strs("args", args).Msg("LV: creating")
run("lvcreate", args...)
dev := "/dev/" + vg.VG + "/" + lv.Name
zeroDevStart(dev)
fs := lv.FS
if fs == "" {
fs = vg.Defaults.FS
}
createdDevs[dev] = fs
}
}
func zeroDevStart(dev string) {
f, err := os.OpenFile(dev, os.O_WRONLY, 0600)
if err != nil {
fatalf("failed to open %s: %v", dev, err)
}
defer f.Close()
_, err = f.Write(make([]byte, 8192))
if err != nil {
fatalf("failed to zero the beginning of %s: %v", dev, err)
}
}
var cryptDevs = map[string]bool{}
func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) {
var password []byte
passwordVerified := false
// flat, expanded devices to open
devNames := make([]config.CryptDev, 0, len(devSpecs))
for _, devSpec := range devSpecs {
if devSpec.Dev == "" && devSpec.Prefix == "" {
fatalf("crypt: name %q: no dev or match set", devSpec.Name)
}
if devSpec.Dev != "" && devSpec.Prefix != "" {
fatalf("crypt: name %q: both dev (%q) and match (%q) are set", devSpec.Name, devSpec.Dev, devSpec.Prefix)
}
if devSpec.Dev != "" {
// already flat
devNames = append(devNames, devSpec)
continue
}
matches, err := filepath.Glob(devSpec.Prefix + "*")
if err != nil {
fatalf("failed to search for device matches: %v", err)
}
for _, m := range matches {
suffix := m[len(devSpec.Prefix):]
devNames = append(devNames, config.CryptDev{Dev: m, Name: devSpec.Name + suffix})
}
}
for _, devName := range devNames {
name, dev := devName.Name, devName.Dev
if name == "" {
name = filepath.Base(dev)
}
if cryptDevs[name] {
fatalf("duplicate crypt device name: %s", name)
}
cryptDevs[name] = true
retryOpen:
if len(password) == 0 {
password = askSecret("crypt password")
if len(password) == 0 {
fatalf("empty password given")
}
}
fs := createdDevs[dev]
delete(createdDevs, dev)
tgtDev := "/dev/mapper/" + name
needFormat := !devInitialized(dev)
if needFormat {
if !passwordVerified {
retry:
p2 := askSecret("verify crypt password")
eq := bytes.Equal(password, p2)
for i := range p2 {
p2[i] = 0
}
if !eq {
log.Error().Msg("passwords don't match")
goto retry
}
}
log.Info().Str("dev", dev).Msg("formatting encrypted device")
cmd := exec.Command("cryptsetup", "luksFormat", dev, "--key-file=-")
cmd.Stdin = bytes.NewBuffer(password)
cmd.Stdout = stdout
cmd.Stderr = stderr
err := cmd.Run()
if err != nil {
fatalf("failed luksFormat: %v", err)
}
createdDevs[tgtDev] = fs
}
if len(password) == 0 {
password = askSecret("crypt password")
if len(password) == 0 {
fatalf("empty password given")
}
}
log.Info().Str("name", name).Str("dev", dev).Msg("openning encrypted device")
cmd := exec.Command("cryptsetup", "open", dev, name, "--key-file=-")
cmd.Stdin = bytes.NewBuffer(password)
cmd.Stdout = stdout
cmd.Stderr = stderr
err := cmd.Run()
if err != nil {
// maybe the password is wrong
for i := range password {
password[i] = 0
}
password = password[:0]
passwordVerified = false
goto retryOpen
}
if needFormat {
zeroDevStart(tgtDev)
}
passwordVerified = true
}
for i := range password {
password[i] = 0
}
}
func devInitialized(dev string) bool {
f, err := os.Open(dev)
if err != nil {
fatalf("failed to open %s: %v", dev, err)
}
defer f.Close()
ba := make([]byte, 8192)
_, err = f.Read(ba)
if err != nil {
fatalf("failed to read %s: %v", dev, err)
}
for _, b := range ba {
if b != 0 {
return true
}
}
return false
}
func setupFS(dev, fs string) {
if devInitialized(dev) {
log.Info().Str("dev", dev).Msg("device already formatted")
return
}
if fs == "" {
fs = "ext4"
}
log.Info().Str("dev", dev).Str("fs", fs).Msg("formatting device")
args := make([]string, 0)
switch fs {
case "btrfs":
args = append(args, "-f")
case "ext4":
args = append(args, "-F")
}
run("mkfs."+fs, append(args, dev)...)
}

19
lvm/lv.go
View File

@ -1,19 +0,0 @@
package lvm
type LVSReport struct {
Report []struct {
LV []LV `json:"lv"`
} `json:"report"`
}
type LV struct {
Name string `json:"lv_name"`
VGName string `json:"vg_name"`
}
func (r LVSReport) LVs() (ret []LV) {
for _, rep := range r.Report {
ret = append(ret, rep.LV...)
}
return
}

19
lvm/pv.go
View File

@ -1,19 +0,0 @@
package lvm
type PVSReport struct {
Report []struct {
PV []PV `json:"pv"`
} `json:"report"`
}
type PV struct {
Name string `json:"pv_name"`
VGName string `json:"vg_name"`
}
func (r PVSReport) PVs() (ret []PV) {
for _, rep := range r.Report {
ret = append(ret, rep.PV...)
}
return
}

245
main.go
View File

@ -1,245 +0,0 @@
package main
import (
"fmt"
"io"
"os"
"os/exec"
"path/filepath"
"runtime"
"syscall"
"time"
"github.com/pkg/term/termios"
"github.com/rs/zerolog"
"github.com/rs/zerolog/log"
"golang.org/x/term"
"novit.tech/direktil/initrd/colorio"
"novit.tech/direktil/initrd/shio"
)
const (
// VERSION is the current version of init
VERSION = "Direktil init v2.0"
rootMountFlags = 0
bootMountFlags = syscall.MS_NOEXEC | syscall.MS_NODEV | syscall.MS_NOSUID | syscall.MS_RDONLY
layerMountFlags = syscall.MS_RDONLY
)
var (
bootVersion string
stdin,
stdinPipe = newPipe()
stdout = shio.New()
stderr = colorio.NewWriter(colorio.Bold, stdout)
)
func newPipe() (io.ReadCloser, io.WriteCloser) {
return io.Pipe()
}
func main() {
log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
registerInput(newTTY(os.Stdin.Fd()))
switch baseName := filepath.Base(os.Args[0]); baseName {
case "init":
runInit()
default:
log.Fatal().Msgf("unknown sub-command: %q", baseName)
}
}
func runInit() {
if len(os.Args) > 1 && os.Args[1] == "hello" {
fmt.Println("hello world!")
os.Exit(0)
}
runtime.LockOSThread()
// move log to shio
go io.Copy(os.Stdout, stdout.NewReader())
log.Logger = log.Output(zerolog.ConsoleWriter{Out: stderr})
// check the PID is 1
if pid := os.Getpid(); pid != 1 {
log.Fatal().Int("pid", pid).Msg("init must be PID 1")
}
// copy os.Stdin to my stdin pipe
go io.Copy(stdinPipe, os.Stdin)
log.Info().Msg("Welcome to " + VERSION)
// essential mounts
mount("none", "/proc", "proc", 0, "")
mount("none", "/sys", "sysfs", 0, "")
mount("none", "/dev", "devtmpfs", 0, "")
mount("none", "/dev/pts", "devpts", 0, "gid=5,mode=620")
// get the "boot version"
bootVersion = param("version", "current")
log.Info().Msgf("booting system %q", bootVersion)
os.Setenv("PATH", "/usr/bin:/bin:/usr/sbin:/sbin")
_, err := os.Stat("/config.yaml")
if err != nil {
log.Error().Err(err).Msg("config not found")
fatal()
}
bootV2()
}
var (
layersDir = "/boot/current/layers/"
layersOverride = map[string]string{}
)
func layerPath(name string) string {
if override, ok := layersOverride[name]; ok {
return override
}
return filepath.Join(layersDir, name+".fs")
}
func fatal(v ...interface{}) {
log.Error().Msg("*** FATAL ***")
log.Error().Msg(fmt.Sprint(v...))
die()
}
func fatalf(pattern string, v ...interface{}) {
log.Error().Msg("*** FATAL ***")
log.Error().Msgf(pattern, v...)
die()
}
func die() {
log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
stdout.Close()
stdin.Close()
stdinPipe.Close()
stdin = nil
mainLoop:
for {
termios.Tcdrain(os.Stdin.Fd())
termios.Tcdrain(os.Stdout.Fd())
termios.Tcdrain(os.Stderr.Fd())
fmt.Print("\nr to reboot, o to power off, s to get a shell: ")
// TODO flush stdin (first char lost here?)
deadline := time.Now().Add(time.Minute)
os.Stdin.SetReadDeadline(deadline)
term.MakeRaw(int(os.Stdin.Fd()))
termios.Tcflush(os.Stdin.Fd(), termios.TCIFLUSH)
b := make([]byte, 1)
_, err := os.Stdin.Read(b)
if err != nil {
log.Error().Err(err).Msg("failed to read from stdin")
time.Sleep(5 * time.Second)
syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
}
fmt.Println()
switch b[0] {
case 'o':
run("sync")
syscall.Reboot(syscall.LINUX_REBOOT_CMD_POWER_OFF)
case 'r':
run("sync")
syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
case 's':
for _, sh := range []string{"bash", "ash", "sh", "busybox"} {
fullPath, err := exec.LookPath(sh)
if err != nil {
continue
}
args := make([]string, 0)
if sh == "busybox" {
args = append(args, "sh")
}
if !localAuth() {
continue mainLoop
}
cmd := exec.Command(fullPath, args...)
cmd.Env = os.Environ()
cmd.Stdin = os.Stdin
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
err = cmd.Run()
if err != nil {
fmt.Println("shell failed:", err)
}
continue mainLoop
}
log.Error().Msg("failed to find a shell!")
default:
log.Error().Msgf("unknown choice: %q", string(b))
}
}
}
func run(cmd string, args ...string) {
if output, err := exec.Command(cmd, args...).CombinedOutput(); err != nil {
fatalf("command %s %q failed: %v\n%s", cmd, args, err, string(output))
}
}
func mkdir(dir string, mode os.FileMode) {
if err := os.MkdirAll(dir, mode); err != nil {
fatalf("mkdir %q failed: %v", dir, err)
}
}
func mount(source, target, fstype string, flags uintptr, data string) {
if _, err := os.Stat(target); os.IsNotExist(err) {
mkdir(target, 0755)
}
if err := syscall.Mount(source, target, fstype, flags, data); err != nil {
fatalf("mount %q %q -t %q -o %q failed: %v", source, target, fstype, data, err)
}
log.Info().Str("target", target).Msg("mounted")
}
func cp(srcPath, dstPath string) {
var err error
defer func() {
if err != nil {
fatalf("cp %s %s failed: %v", srcPath, dstPath, err)
}
}()
src, err := os.Open(srcPath)
if err != nil {
return
}
defer src.Close()
dst, err := os.Create(dstPath)
if err != nil {
return
}
defer dst.Close()
_, err = io.Copy(dst, src)
}

16
modd.conf
View File

@ -1,14 +1,14 @@
modd.conf {}
go.??? **/*.go {
prep: go test ./...
prep: mkdir -p dist
prep: go build -o dist/init .
prep: go build -o dist/ ./tools/...
**/*.rs Cargo.* {
prep: cargo test
prep: cargo build
prep: debug/init-version
}
dist/init Dockerfile {
prep: docker build -t novit-initrd-gen .
prep: docker run novit-initrd-gen |base64 -d >dist/initrd.new
target/debug/init Dockerfile {
prep: docker build --network host -t novit-initrd-gen .
prep: docker run --net=host --rm novit-initrd-gen |base64 -d >dist/initrd.new
prep: mv dist/initrd.new dist/initrd
prep: ls -sh dist/initrd
}

7
modd.test.conf
View File

@ -1,10 +1,9 @@
modd.test.conf {}
dist/initrd dist/cpiocat dist/testconf test-initrd/**/* {
prep: dist/testconf test-initrd/config.yaml
dist/initrd test-initrd/**/* {
prep: cp -f dist/initrd test-initrd.cpio
prep: cd test-initrd && cat ../dist/initrd | ../dist/cpiocat * |lz4 -l9v >../test-initrd.cpio.new
prep: mv test-initrd.cpio.new test-initrd.cpio
prep: cd test-initrd && find |cpio -oAv -H newc -F ../test-initrd.cpio
prep: lz4 -l9v test-initrd.cpio && mv test-initrd.cpio.lz4 test-initrd.cpio
prep: if lz4cat test-initrd.cpio | cpio -t 2>&1 |grep bytes.of.junk; then echo "bad cpio archive"; exit 1; fi
prep: kill $(<qemu.pid)
}

87
network.go
View File

@ -1,87 +0,0 @@
package main
import (
"os/exec"
"strings"
udev "github.com/jochenvg/go-udev"
"github.com/rs/zerolog/log"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func setupNetworks(cfg *config.Config) {
if len(cfg.Networks) == 0 {
log.Info().Msg("no networks configured.")
return
}
type Iface struct {
Name string
AliasOf string
}
ifaces := make([]NameAliases, 0)
{
enum := new(udev.Udev).NewEnumerate()
enum.AddMatchSubsystem("net")
devs, err := enum.Devices()
if err != nil {
fatal("udev enumeration failed")
}
for _, dev := range devs {
iface := nameAliases(dev.Sysname(),
dev.PropertyValue("INTERFACE"),
dev.PropertyValue("ID_NET_NAME"),
dev.PropertyValue("ID_NET_NAME_PATH"),
dev.PropertyValue("ID_NET_NAME_MAC"),
dev.PropertyValue("ID_NET_NAME_SLOT"),
)
log.Info().Str("name", iface.Name).Any("aliases", iface.Aliases).Msg("found network device")
ifaces = append(ifaces, iface)
}
}
assigned := map[string]bool{}
for _, network := range cfg.Networks {
log := log.With().Str("network", network.Name).Logger()
log.Info().Msg("setting up network")
unassigned := filter(ifaces, func(iface NameAliases) bool {
return !assigned[iface.Name]
})
// assign envvars
envvars := make([]string, 0, 1+len(network.Interfaces))
envvars = append(envvars, "PATH=/bin:/sbin:/usr/bin:/usr/sbin")
for _, match := range network.Interfaces {
envvar := new(strings.Builder)
envvar.WriteString(match.Var)
envvar.WriteByte('=')
for i, m := range regexpSelectN(match.N, match.Regexps, unassigned) {
assigned[m] = true
if i != 0 {
envvar.WriteByte(' ')
}
envvar.WriteString(m)
}
envvars = append(envvars, envvar.String())
}
log.Info().Strs("env", envvars).Msg("running script")
cmd := exec.Command("/bin/sh", "-c", network.Script)
cmd.Env = envvars
cmd.Stdout = stdout
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
fatal("failed to setup network: ", err)
}
}
}

39
params.go
View File

@ -1,39 +0,0 @@
package main
import (
"os"
"strings"
)
func param(name, defaultValue string) (value string) {
ba, err := os.ReadFile("/proc/cmdline")
if err != nil {
fatal("could not read /proc/cmdline: ", err)
}
prefixes := []string{
"direktil." + name + "=",
"dkl." + name + "=",
}
value = defaultValue
for _, part := range strings.Split(string(ba), " ") {
for _, prefix := range prefixes {
if strings.HasPrefix(part, prefix) {
value = strings.TrimSpace(part[len(prefix):])
}
}
}
return
}
func paramBool(name string, defaultValue bool) (value bool) {
defaultValueS := "false"
if defaultValue {
defaultValueS = "true"
}
return "true" == param(name, defaultValueS)
}

65
regexp.go
View File

@ -1,65 +0,0 @@
package main
import (
"regexp"
"github.com/rs/zerolog/log"
)
type NameAliases struct {
Name string
Aliases []string
}
func nameAlias(name string) NameAliases {
return NameAliases{Name: name, Aliases: []string{name}}
}
func nameAliases(name string, aliases ...string) NameAliases {
na := NameAliases{Name: name, Aliases: make([]string, 0, len(aliases)+1)}
na.Aliases = append(na.Aliases, name)
for _, alias := range aliases {
na.AddAlias(alias)
}
return na
}
func (na *NameAliases) AddAlias(alias string) {
if alias == "" {
return
}
if contains(na.Aliases, func(s string) bool { return s == alias }) {
return
}
na.Aliases = append(na.Aliases, alias)
}
func regexpSelectN(n int, regexps []string, nameAliases []NameAliases) (matches []string) {
matches = make([]string, 0)
res := make([]*regexp.Regexp, 0, len(regexps))
for _, reStr := range regexps {
re, err := regexp.Compile(reStr)
if err != nil {
log.Warn().Err(err).Str("regexp", reStr).Msg("invalid regexp, ignored")
continue
}
res = append(res, re)
}
nameAliasesLoop:
for _, item := range nameAliases {
if len(matches) == n {
break
}
for _, re := range res {
for _, alias := range item.Aliases {
if re.MatchString(alias) {
matches = append(matches, item.Name)
continue nameAliasesLoop
}
}
}
}
return
}

2
run-docker Executable file
View File

@ -0,0 +1,2 @@
docker build -t nv-initrd-test -f Dockerfile.test empty
docker run -d --name nv-initrd-test -it --privileged -v $PWD:/src --workdir /src/test-initrd nv-initrd-test

5
run-test.sh
View File

@ -10,10 +10,11 @@ if ! [ -e $disk2 ]; then
qemu-img create -f qcow2 $disk2 10G
fi
exec qemu-system-x86_64 -pidfile qemu.pid -kernel test-kernel -initrd test-initrd.cpio \
exec qemu-system-x86_64 -pidfile qemu.pid \
-kernel test-kernel -initrd test-initrd.cpio \
-smp 2 -m 2048 \
-netdev bridge,br=novit,id=eth0 -device virtio-net-pci,netdev=eth0 \
-drive file=$disk1,if=virtio \
-drive file=$disk2,if=virtio \
-nographic -serial mon:stdio -append 'console=ttyS0'
-nographic -serial mon:stdio -append 'console=ttyS0 dkl.debug'
# -display curses

18
run.go
View File

@ -1,18 +0,0 @@
package main
import (
"encoding/json"
"os/exec"
)
func runJSON(v interface{}, cmd string, args ...string) (err error) {
c := exec.Command(cmd, args...)
c.Stderr = stderr
ba, err := c.Output()
if err != nil {
return
}
err = json.Unmarshal(ba, v)
return
}

118
shio/shio.go
View File

@ -1,118 +0,0 @@
// Shared IO
package shio
import (
"io"
"sync"
"novit.tech/direktil/initrd/colorio"
)
type ShIO struct {
buf []byte
closed bool
cond *sync.Cond
hideInput bool
}
func New() *ShIO {
return NewWithCap(1024)
}
func NewWithCap(capacity int) *ShIO {
return NewWithBytes(make([]byte, 0, capacity))
}
func NewWithBytes(content []byte) *ShIO {
return &ShIO{
buf: content,
cond: sync.NewCond(&sync.Mutex{}),
}
}
var (
_ io.WriteCloser = New()
)
func (s *ShIO) Write(data []byte) (n int, err error) {
s.cond.L.Lock()
defer s.cond.L.Unlock()
if s.closed {
err = io.EOF
return
}
if s.hideInput {
s.buf = append(s.buf, colorio.Reset...)
}
s.buf = append(s.buf, data...)
n = len(data)
if s.hideInput {
s.buf = append(s.buf, colorio.Hidden...)
}
s.cond.Broadcast()
return
}
func (s *ShIO) HideInput() {
s.cond.L.Lock()
defer s.cond.L.Unlock()
if s.closed {
return
}
s.buf = append(s.buf, colorio.Hidden...)
s.hideInput = true
}
func (s *ShIO) ShowInput() {
s.cond.L.Lock()
defer s.cond.L.Unlock()
if s.closed {
return
}
s.buf = append(s.buf, colorio.Reset...)
s.hideInput = false
}
func (s *ShIO) Close() (err error) {
s.cond.L.Lock()
defer s.cond.L.Unlock()
s.closed = true
s.cond.Broadcast()
return
}
func (s *ShIO) NewReader() io.Reader {
return &shioReader{s, 0}
}
type shioReader struct {
in *ShIO
pos int
}
func (r *shioReader) Read(ba []byte) (n int, err error) {
r.in.cond.L.Lock()
defer r.in.cond.L.Unlock()
for r.pos == len(r.in.buf) && !r.in.closed {
r.in.cond.Wait()
}
if r.pos == len(r.in.buf) && r.in.closed {
err = io.EOF
return
}
n = copy(ba, r.in.buf[r.pos:])
r.pos += n
return
}

52
shio/shio_test.go
View File

@ -1,52 +0,0 @@
package shio
import (
"fmt"
"io"
"os"
"sync"
"time"
)
func Example_output() {
done := false
defer func() { done = true }()
go func() {
time.Sleep(time.Second)
if !done {
panic("timeout")
}
}()
shio := NewWithCap(3)
r1 := shio.NewReader()
// read as you write
wg := new(sync.WaitGroup)
wg.Add(1)
go func() {
defer wg.Done()
io.Copy(os.Stdout, r1)
fmt.Println("-- r1 done --")
}()
fmt.Fprintln(shio, "hello1")
fmt.Fprintln(shio, "hello2")
shio.Close()
wg.Wait()
// read after close
r2 := shio.NewReader()
io.Copy(os.Stdout, r2)
fmt.Println("-- r2 done --")
// Output:
// hello1
// hello2
// -- r1 done --
// hello1
// hello2
// -- r2 done --
}

21
src/blockdev.rs Normal file
View File

@ -0,0 +1,21 @@
use tokio::fs;
use tokio::io::{AsyncReadExt, AsyncWriteExt, Result};
/// Checks if a block device is uninitialized.
/// It assumed that a initialized device always has a non-zero byte in the first 8kiB.
pub async fn is_uninitialized(dev_path: &str) -> Result<bool> {
let mut dev = fs::File::open(dev_path).await?;
let mut buf = [0u8; 8 << 10];
dev.read_exact(&mut buf).await?;
Ok(buf.into_iter().all(|b| b == 0))
}
/// zeroes the first 8kiB of the device so it looks uninitialized again.
pub async fn uninitialize(dev_path: &str) -> Result<()> {
let mut dev = fs::File::options().write(true).open(dev_path).await?;
let buf = [0u8; 8 << 10];
dev.write_all(&buf).await
}

1
src/bootstrap.rs Normal file
View File

@ -0,0 +1 @@
pub mod config;

189
src/bootstrap/config.rs Normal file
View File

@ -0,0 +1,189 @@
use std::collections::BTreeMap as Map;
pub const TAKE_ALL: i16 = -1;
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct Config {
pub anti_phishing_code: String,
#[serde(skip_serializing_if = "Option::is_none")]
pub keymap: Option<String>,
#[serde(skip_serializing_if = "Option::is_none")]
pub modules: Option<String>,
#[serde(skip_serializing_if = "Option::is_none")]
pub resolv_conf: Option<String>,
#[serde(default)]
pub vpns: Map<String, String>,
pub networks: Vec<Network>,
pub auths: Vec<Auth>,
#[serde(default)]
pub ssh: SSHServer,
#[serde(default)]
pub pre_lvm_crypt: Vec<CryptDev>,
#[serde(default)]
pub lvm: Vec<LvmVG>,
#[serde(default)]
pub crypt: Vec<CryptDev>,
pub bootstrap: Bootstrap,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct Auth {
pub name: String,
#[serde(alias = "sshKey")]
#[serde(skip_serializing_if = "Option::is_none")]
pub ssh_key: Option<String>,
#[serde(skip_serializing_if = "Option::is_none")]
pub password: Option<String>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct Network {
pub name: String,
pub interfaces: Vec<NetworkInterface>,
pub script: String,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct NetworkInterface {
pub var: String,
pub n: i16,
pub regexps: Vec<String>,
}
#[derive(Clone, Debug, serde::Deserialize, serde::Serialize)]
pub struct SSHServer {
pub listen: String,
pub user_ca: Option<String>,
}
impl Default for SSHServer {
fn default() -> Self {
Self {
listen: "[::]:22".to_string(),
user_ca: None,
}
}
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct LvmVG {
#[serde(alias = "vg")]
pub name: String,
pub pvs: LvmPV,
#[serde(default)]
pub defaults: LvmLVDefaults,
pub lvs: Vec<LvmLV>,
}
#[derive(Debug, Default, serde::Deserialize, serde::Serialize)]
pub struct LvmLVDefaults {
#[serde(default)]
pub fs: Filesystem,
#[serde(default)]
pub raid: Raid,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
#[serde(rename_all = "snake_case")]
pub enum Filesystem {
Ext4,
Xfs,
Btrfs,
Other(String),
}
impl Filesystem {
pub fn fstype(&self) -> &str {
use Filesystem as F;
match self {
F::Ext4 => "ext4",
F::Xfs => "xfs",
F::Btrfs => "btrfs",
F::Other(t) => t,
}
}
}
impl Default for Filesystem {
fn default() -> Self {
Filesystem::Ext4
}
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct LvmLV {
pub name: String,
#[serde(skip_serializing_if = "Option::is_none")]
pub fs: Option<Filesystem>,
#[serde(skip_serializing_if = "Option::is_none")]
pub raid: Option<Raid>,
#[serde(flatten)]
pub size: LvSize,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
#[serde(rename_all = "snake_case")]
pub enum LvSize {
Size(String),
Extents(String),
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct LvmPV {
pub n: i16,
pub regexps: Vec<String>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct CryptDev {
pub name: String,
#[serde(flatten)]
pub filter: DevFilter,
pub optional: Option<bool>,
}
impl CryptDev {
pub fn optional(&self) -> bool {
self.optional.unwrap_or_else(|| self.filter.is_prefix())
}
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
#[serde(rename_all = "snake_case")]
pub enum DevFilter {
Dev(String),
Prefix(String),
}
impl DevFilter {
pub fn is_dev(&self) -> bool {
match self {
Self::Dev(_) => true,
_ => false,
}
}
pub fn is_prefix(&self) -> bool {
match self {
Self::Prefix(_) => true,
_ => false,
}
}
}
#[derive(Debug, Default, Clone, serde::Deserialize, serde::Serialize)]
pub struct Raid {
pub mirrors: Option<u8>,
pub stripes: Option<u8>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct Bootstrap {
pub dev: String,
pub seed: Option<String>,
}

5
src/cmd.rs Normal file
View File

@ -0,0 +1,5 @@
pub mod bootstrap;
pub mod connect_boot;
pub mod init;
pub mod init_input;
pub mod version;

19
src/cmd/bootstrap.rs Normal file
View File

@ -0,0 +1,19 @@
use eyre::Result;
use tokio::{fs, io, io::AsyncWriteExt};
pub async fn run() -> Result<()> {
let mut input = io::stdin();
let mut out = fs::File::create("/bootstrap.tar.part").await?;
let n = io::copy(&mut input, &mut out).await?;
out.flush().await?;
drop(out);
eprintln!("copied {n} bytes");
fs::rename("/bootstrap.tar.part", "/bootstrap.tar").await?;
eprintln!("/bootstrap.tar ready to use");
Ok(())
}

0
src/cmd/connect_boot.rs Normal file
View File

433
src/cmd/init.rs Normal file
View File

@ -0,0 +1,433 @@
use eyre::{format_err, Result};
use log::{error, info, warn};
use std::collections::BTreeSet as Set;
use std::os::unix::fs::symlink;
use tokio::sync::Mutex;
use tokio::{fs, process::Command};
use crate::{bootstrap::config::Config, cmd::version::version_string, dklog, input, utils};
mod bootstrap;
mod dmcrypt;
mod lvm;
mod networks;
mod sshd;
const INIT_LOG: &str = "/var/log/init.log";
// devices used by any block target (DM, LVM...)
static USED_DEVS: Mutex<Set<String>> = Mutex::const_new(Set::new());
pub async fn run() {
if std::process::id() != 1 {
error!("init must run as PID 1, not {}", std::process::id());
std::process::exit(1);
}
unsafe {
use std::env;
env::set_var("PATH", "/bin:/sbin:/usr/bin:/usr/sbin");
env::set_var("HOME", "/root");
}
// open input channels
tokio::spawn(crate::input::answer_requests_from_stdin());
tokio::spawn(crate::input::answer_requests_from_socket());
// also log to file
dklog::LOG.spawn(async {
let Ok(log_file) = (tokio::fs::File::create(INIT_LOG).await)
.inspect_err(|e| warn!("failed to open init.log: {e}"))
else {
return;
};
dklog::LOG.copy_to(log_file).await;
});
// welcome
info!("Welcome to {}", version_string());
let uname = nix::sys::utsname::uname().expect("uname should work");
let kernel_version = uname.release().to_string_lossy();
info!("Linux version {kernel_version}");
// mount basic filesystems
mount(None, "/proc", Some("proc"), None).await;
mount(None, "/sys", Some("sysfs"), None).await;
mount(None, "/dev", Some("devtmpfs"), None).await;
mount(None, "/dev/pts", Some("devpts"), Some("gid=5,mode=620")).await;
if utils::bool_param("debug") {
log::set_max_level(log::LevelFilter::Debug);
}
// extract system archive
retry_or_ignore(async || {
if fs::try_exists("system.azstd").await? {
info!("unpacking system.azstd");
let zarch = fs::read("system.azstd").await?;
let arch = zstd::Decoder::new(zarch.as_slice())?;
extract_cpio(arch).await
} else if fs::try_exists("system.alz4").await? {
info!("unpacking system.alz4");
let zarch = fs::read("system.alz4").await?;
let arch = lz4::Decoder::new(zarch.as_slice())?;
extract_cpio(arch).await
} else {
return Ok(());
}
})
.await;
// load config
let cfg: Config = retry(async || {
let cfg = (fs::read("config.yaml").await)
.map_err(|e| format_err!("failed to read config: {e}"))?;
serde_yaml::from_slice(cfg.as_slice())
.map_err(|e| format_err!("failed to parse config: {e}"))
})
.await;
info!("config loaded");
info!("anti-phishing-code: {}", cfg.anti_phishing_code);
// seem to occasionaly race with Child::wait
// tokio::spawn(child_reaper());
// mount modules
if let Some(ref modules) = cfg.modules {
retry_or_ignore(async || {
info!("mounting modules");
mount(Some(modules), "/modules", Some("squashfs"), None).await;
fs::create_dir_all("/lib/modules").await?;
let modules_path = &format!("/modules/lib/modules/{kernel_version}");
if !std::fs::exists(modules_path)? {
return Err(format_err!(
"invalid modules package: {modules_path} should exist"
));
}
symlink(modules_path, format!("/lib/modules/{kernel_version}"))?;
Ok(())
})
.await;
} else {
warn!("modules NOT mounted (not configured)");
}
// init devices
info!("initializing devices");
start_daemon("udevd", &[]).await;
exec("udevadm", &["trigger", "-c", "add", "-t", "devices"]).await;
exec("udevadm", &["trigger", "-c", "add", "-t", "subsystems"]).await;
exec("udevadm", &["settle"]).await;
// resolv.conf
if let Some(ref resolv_conf) = cfg.resolv_conf {
retry_or_ignore(async || {
let path = "/etc/resolv.conf";
info!("writing /etc/resolv.conf");
fs::write(path, resolv_conf.as_bytes()).await?;
Ok(())
})
.await;
}
// Wireguard VPNs
for (name, conf) in &cfg.vpns {
retry_or_ignore(async || {
let dir = "/etc/wireguard";
fs::create_dir_all(dir).await?;
let path = &format!("{dir}/{name}.conf");
fs::write(path, conf.as_bytes()).await?;
chmod(path, 0o600).await?;
try_exec("wg-quick", &["up", name]).await?;
Ok(())
})
.await
}
// SSH service
sshd::start(&cfg).await;
// networks
networks::setup(&cfg).await;
// pre-lvm dmcrypt devs
dmcrypt::setup(&cfg.pre_lvm_crypt).await;
// LVM
lvm::setup(&cfg).await;
// post-lvm dmcrypt devs
dmcrypt::setup(&cfg.crypt).await;
// bootstrap the system
bootstrap::bootstrap(cfg).await;
// finalize
if let Err(e) = tokio::fs::copy(INIT_LOG, format!("/system{INIT_LOG}")).await {
warn!("failed to copy {INIT_LOG} to system: {e}");
}
retry(async || switch_root("/system").await).await;
}
use std::path::Path;
async fn chmod(path: impl AsRef<Path>, mode: u32) -> std::io::Result<()> {
use std::fs::Permissions;
use std::os::unix::fs::PermissionsExt;
let perms = Permissions::from_mode(mode);
fs::set_permissions(path, perms).await
}
async fn extract_cpio(mut arch: impl std::io::Read) -> Result<()> {
loop {
let rd = cpio::NewcReader::new(&mut arch)?;
let entry = rd.entry();
if entry.is_trailer() {
return Ok(());
}
let path = entry.name().to_string();
if let Err(e) = extract_cpio_entry(rd, &path).await {
return Err(format_err!("failed to extract {path}: {e}"));
}
}
}
async fn extract_cpio_entry<R: std::io::Read>(
rd: cpio::NewcReader<R>,
path: impl AsRef<Path>,
) -> Result<()> {
use std::os::unix::fs::chown;
use unix_mode::Type;
let entry = rd.entry();
let path = path.as_ref();
if let Some(parent) = path.parent() {
fs::create_dir_all(parent).await?;
}
let mode = entry.mode();
let uid = entry.uid();
let gid = entry.gid();
match Type::from(mode) {
Type::Dir => {
fs::create_dir_all(path).await?;
}
Type::File => {
let mut data = vec![];
rd.to_writer(&mut data)?;
fs::write(path, data).await?;
}
Type::Symlink => {
let mut data = vec![];
rd.to_writer(&mut data)?;
let target = &Path::new(std::str::from_utf8(&data)?);
tokio::fs::symlink(target, path).await?;
return Ok(());
}
_ => {
warn!("{path:?}: unknown file type: {:?}", Type::from(mode));
return Ok(());
}
}
chmod(path, mode).await?;
chown(path, Some(uid), Some(gid))?;
Ok(())
}
async fn mount(src: Option<&str>, dst: &str, fstype: Option<&str>, opts: Option<&str>) {
if let Err(e) = fs::create_dir_all(dst).await {
error!("failed to create dir {dst}: {e}");
}
match (fstype, src) {
(Some("ext4"), Some(src)) => {
exec("fsck", &["-p", src]).await;
}
_ => {}
}
let mut args = vec![src.unwrap_or("none"), dst];
if let Some(fstype) = fstype {
args.extend(&["-t", fstype]);
}
if let Some(opts) = opts {
args.extend(["-o", opts]);
}
retry_or_ignore(async || {
// check source, use a loopdev if needed
if let Some(src) = src {
if fs::metadata(src).await?.is_file() {
// loopdev crate has annoying dependencies, just use the normal mount program
return try_exec("mount", &args).await;
}
}
let (cmd_str, _) = cmd_str("mount", &args);
let flags = nix::mount::MsFlags::empty();
info!("# {cmd_str}",);
nix::mount::mount(src, dst, fstype, flags, opts)
.map_err(|e| format_err!("mount {dst} failed: {e}"))
})
.await
}
async fn start_daemon(prog: &str, args: &[&str]) {
let (cmd_str, mut cmd) = cmd_str(prog, args);
retry_or_ignore(async || {
info!("starting as daemon: {cmd_str}");
cmd.spawn()?;
Ok(())
})
.await;
}
async fn try_exec(prog: &str, args: &[&str]) -> Result<()> {
let (cmd_str, mut cmd) = cmd_str(prog, args);
info!("# {cmd_str}");
let s = cmd.status().await?;
if s.success() {
Ok(())
} else {
Err(format_err!("command failed: {s}"))
}
}
async fn exec(prog: &str, args: &[&str]) {
retry_or_ignore(async || try_exec(prog, args).await).await;
}
async fn retry_or_ignore(mut action: impl AsyncFnMut() -> Result<()>) {
loop {
match action().await {
Ok(_) => return,
Err(e) => {
error!("{e}");
match input::read_choice(["[r]etry", "[i]gnore", "[s]hell"]).await {
'r' => {}
'i' => return,
's' => exec_shell().await,
_ => unreachable!(),
}
}
}
}
}
async fn retry<T>(mut action: impl AsyncFnMut() -> Result<T>) -> T {
loop {
match action().await {
Ok(v) => return v,
Err(e) => {
error!("{e}");
match input::read_choice(["[r]etry", "[s]hell"]).await {
'r' => {}
's' => exec_shell().await,
_ => unreachable!(),
}
}
}
}
}
async fn exec_shell() {
let mut child = match Command::new("ash").spawn() {
Ok(c) => c,
Err(e) => {
error!("failed to exec shell: {e}");
return;
}
};
let _ = child.wait().await;
}
fn cmd_str(prog: &str, args: &[&str]) -> (String, Command) {
use std::borrow::Cow;
let mut buf = String::new();
buf.push_str(&shell_escape::escape(Cow::Borrowed(prog)));
for &arg in args {
buf.push(' ');
buf.push_str(&shell_escape::escape(Cow::Borrowed(arg)));
}
let mut cmd = Command::new(prog);
cmd.args(args);
(buf, cmd)
}
#[allow(unused)]
async fn child_reaper() {
use nix::sys::wait::{waitpid, WaitPidFlag};
use nix::unistd::Pid;
use tokio::signal::unix::{signal, SignalKind};
let Ok(mut sigs) =
signal(SignalKind::child()).inspect_err(|e| warn!("failed to setup SIGCHLD handler: {e}"))
else {
return;
};
loop {
sigs.recv().await;
let _ = waitpid(Some(Pid::from_raw(-1)), Some(WaitPidFlag::WNOHANG));
}
}
macro_rules! cstr {
($s:expr) => {
std::ffi::CString::new($s)?.as_c_str()
};
}
async fn switch_root(root: &str) -> Result<()> {
info!("killing all processes and switching root");
dklog::LOG.close().await;
use nix::sys::signal::{kill, SIGKILL};
use nix::unistd::Pid;
if let Err(e) = kill(Pid::from_raw(-1), SIGKILL) {
eprintln!("failed to kill processes: {e}");
}
nix::unistd::execv(
cstr!("/sbin/switch_root"),
&[
cstr!("switch_root"),
cstr!("-c"),
cstr!("/dev/console"),
cstr!(root),
cstr!("/sbin/init"),
],
)
.unwrap();
unreachable!();
}

320
src/cmd/init/bootstrap.rs Normal file
View File

@ -0,0 +1,320 @@
use eyre::{format_err, Result};
use log::info;
use std::path::Path;
use tokio::{
fs,
io::{AsyncBufReadExt, BufReader},
};
use super::{exec, mount, retry, retry_or_ignore, try_exec};
use crate::bootstrap::config::Config;
use crate::{dkl, utils};
pub async fn bootstrap(cfg: Config) {
let bs = cfg.bootstrap;
retry_or_ignore(async || {
fs::create_dir_all("/boostrap").await?;
mount(Some(&bs.dev), "/bootstrap", Some("ext4"), None).await;
Ok(())
})
.await;
let boot_version = utils::param("version", "current");
let base_dir = &format!("/bootstrap/{boot_version}");
retry_or_ignore(async || {
if !fs::try_exists(&base_dir).await? {
info!("creating {base_dir}");
fs::create_dir_all(&base_dir).await?
}
Ok(())
})
.await;
let sys_cfg: dkl::Config = retry(async || {
let sys_cfg_bytes = seed_config(base_dir, &bs.seed).await?;
Ok(serde_yaml::from_slice(&sys_cfg_bytes)?)
})
.await;
mount_system(&sys_cfg, base_dir).await;
retry_or_ignore(async || {
let path = "/etc/resolv.conf";
if fs::try_exists(path).await? {
info!("cp /etc/resolv.conf");
fs::copy(path, &format!("/system{path}")).await?;
}
Ok(())
})
.await;
retry_or_ignore(async || apply_files(&sys_cfg.files, "/system").await).await;
apply_groups(&sys_cfg.groups, "/system").await;
apply_users(&sys_cfg.users, "/system").await;
// TODO VPNs
mount_filesystems(&sys_cfg.mounts, "/system").await;
retry_or_ignore(async || {
info!("setting up root user");
setup_root_user(&sys_cfg.root_user, "/system").await
})
.await;
}
async fn seed_config(base_dir: &str, seed_url: &Option<String>) -> Result<Vec<u8>> {
let cfg_path = &format!("{base_dir}/config.yaml");
if fs::try_exists(cfg_path).await? {
return Ok(fs::read(cfg_path).await?);
}
let bs_tar = "/bootstrap.tar";
if !fs::try_exists(bs_tar).await? {
if let Some(seed_url) = seed_url.as_ref() {
fetch_bootstrap(seed_url, bs_tar).await?;
} else {
return Err(format_err!(
"no {cfg_path}, no {bs_tar} and no seed, can't bootstrap"
));
}
}
try_exec("tar", &["xf", bs_tar, "-C", base_dir]).await?;
if !fs::try_exists(cfg_path).await? {
return Err(format_err!("{cfg_path} does not exist after seeding"));
}
Ok(fs::read(cfg_path).await?)
}
async fn fetch_bootstrap(seed_url: &str, output_file: &str) -> Result<()> {
let tmp_file = &format!("{output_file}.new");
let _ = fs::remove_file(tmp_file).await;
try_exec("wget", &["-O", tmp_file, seed_url]).await?;
fs::rename(tmp_file, output_file)
.await
.map_err(|e| format_err!("seed rename failed: {e}"))?;
Ok(())
}
async fn mount_system(cfg: &dkl::Config, bs_dir: &str) {
let mem_dir = "/mem";
mount(None, mem_dir, Some("tmpfs"), Some("size=512m")).await;
let layers_dir = &format!("{mem_dir}/layers");
let mut lower_dir = String::new();
for layer in &cfg.layers {
let src = if layer == "modules" {
"/modules.sqfs"
} else {
&format!("{bs_dir}/{layer}.fs")
};
let tgt = &format!("{mem_dir}/{layer}.fs");
retry(async || {
info!("copying layer {layer} from {src}");
fs::copy(src, tgt).await?;
Ok(())
})
.await;
let layer_dir = &format!("{layers_dir}/{layer}");
mount(Some(tgt), layer_dir, Some("squashfs"), None).await;
if !lower_dir.is_empty() {
lower_dir.push(':');
}
lower_dir.push_str(&layer_dir);
}
let upper_dir = &format!("{mem_dir}/upper");
let work_dir = &format!("{mem_dir}/work");
retry_or_ignore(async || {
fs::create_dir_all(upper_dir).await?;
fs::create_dir_all(work_dir).await?;
Ok(())
})
.await;
mount(
None,
"/system",
Some("overlay"),
Some(&format!(
"lowerdir={lower_dir},upperdir={upper_dir},workdir={work_dir}"
)),
)
.await;
// make root rshared (default in systemd, required by Kubernetes 1.10+)
// equivalent to "mount --make-rshared /"
// see kernel's Documentation/sharedsubtree.txt (search rshared)
retry_or_ignore(async || {
use nix::mount::MsFlags as M;
const NONE: Option<&str> = None;
nix::mount::mount(NONE, "/system", NONE, M::MS_SHARED | M::MS_REC, NONE)?;
Ok(())
})
.await;
}
fn chroot(root: &str, path: &str) -> String {
format!("{root}/{}", path.trim_start_matches(|c| c == '/'))
}
async fn apply_files(files: &[dkl::File], root: &str) -> Result<()> {
for file in files {
let path = chroot(root, &file.path);
let path = Path::new(&path);
if let Some(parent) = path.parent() {
fs::create_dir_all(parent).await?;
}
use crate::dkl::FileKind as K;
match &file.kind {
K::Content(content) => fs::write(path, content.as_bytes()).await?,
K::Dir(true) => fs::create_dir(path).await?,
K::Dir(false) => {} // shouldn't happen, but semantic is to ignore
K::Symlink(tgt) => fs::symlink(tgt, path).await?,
}
match file.kind {
K::Symlink(_) => {}
_ => set_perms(path, file.mode).await?,
}
info!("created {}", file.path);
}
Ok(())
}
async fn set_perms(path: impl AsRef<Path>, mode: Option<u32>) -> std::io::Result<()> {
if let Some(mode) = mode.filter(|m| *m != 0) {
use std::os::unix::fs::PermissionsExt;
let mode = std::fs::Permissions::from_mode(mode);
fs::set_permissions(path, mode).await?;
}
Ok(())
}
async fn apply_groups(groups: &[dkl::Group], root: &str) {
for group in groups {
let mut args = vec![root, "groupadd", "-r"];
let gid = group.gid.map(|s| s.to_string());
if let Some(gid) = gid.as_ref() {
args.extend(&["-g", gid]);
}
args.push(group.name.as_str());
exec("chroot", &args).await;
}
}
async fn apply_users(users: &[dkl::User], root: &str) {
for user in users {
let mut args = vec![root, "useradd", "-r"];
let uid = user.uid.map(|s| s.to_string());
if let Some(uid) = uid.as_ref() {
args.extend(&["-u", uid]);
}
let gid = user.gid.map(|s| s.to_string());
if let Some(gid) = gid.as_ref() {
args.extend(&["-g", gid]);
}
args.push(user.name.as_str());
exec("chroot", &args).await;
}
}
async fn mount_filesystems(mounts: &[dkl::Mount], root: &str) {
for m in mounts {
let path = chroot(root, &m.path);
mount(
Some(&m.dev),
&path,
m.r#type.as_ref().map(|v| v.as_str()),
m.options
.as_ref()
.filter(|v| !v.is_empty())
.map(|s| s.as_str()),
)
.await;
}
}
async fn setup_root_user(user: &dkl::RootUser, root: &str) -> Result<()> {
if let Some(pw_hash) = user.password_hash.as_ref().filter(|v| !v.is_empty()) {
set_user_password("root", &pw_hash, root).await?;
}
let mut authorized_keys = Vec::new();
for ak in &user.authorized_keys {
authorized_keys.extend(ak.as_bytes());
authorized_keys.push(b'\n');
}
let ssh_dir = &chroot(root, "root/.ssh");
fs::create_dir_all(ssh_dir)
.await
.map_err(|e| format_err!("mkdir -p {ssh_dir} failed: {e}"))?;
set_perms(ssh_dir, Some(0o700))
.await
.map_err(|e| format_err!("chmod {ssh_dir} failed: {e}"))?;
let ak_path = &format!("{ssh_dir}/authorized_keys");
fs::write(ak_path, authorized_keys)
.await
.map_err(|e| format_err!("write {ak_path} failed: {e}"))?;
Ok(())
}
async fn set_user_password(user: &str, password_hash: &str, root: &str) -> Result<()> {
info!("setting password for {user}");
let user = user.as_bytes();
let password_hash = password_hash.as_bytes();
let mut buf = Vec::new();
let pw_file = &chroot(root, "etc/shadow");
let rd = fs::File::open(pw_file)
.await
.map_err(|e| format_err!("open {pw_file} failed: {e}"))?;
let mut rd = BufReader::new(rd);
let mut line = Vec::new();
while (rd.read_until(b'\n', &mut line).await)
.map_err(|e| format_err!("read {pw_file} failed: {e}"))?
!= 0
{
let mut split: Vec<_> = line.split(|c| *c == b':').collect();
if split.len() > 2 && split[0] == user {
split[1] = password_hash;
buf.extend(split.join(&b':'));
} else {
buf.extend(&line);
}
line.clear();
}
fs::write(pw_file, buf).await?;
Ok(())
}

151
src/cmd/init/dmcrypt.rs Normal file
View File

@ -0,0 +1,151 @@
use eyre::{format_err, Result};
use log::{error, info, warn};
use std::collections::BTreeSet as Set;
use std::process::Stdio;
use tokio::io::AsyncWriteExt;
use tokio::process::Command;
use tokio::sync::Mutex;
use super::{retry_or_ignore, USED_DEVS};
use crate::blockdev::{is_uninitialized, uninitialize};
use crate::bootstrap::config::{CryptDev, DevFilter};
use crate::fs::walk_dir;
use crate::input;
pub async fn setup(devs: &[CryptDev]) {
if devs.is_empty() {
return;
}
let mut used_devs = USED_DEVS.lock().await;
// CryptDev.name that have a least one assignment done
let mut done = Set::new();
// dmcrypt devices opened here
let mut done_crypt = Set::new();
retry_or_ignore(async || {
let all_devs = walk_dir("/dev").await;
for dev in devs {
let mut mappings = find_dev(dev, &all_devs);
mappings.retain(|(_, dev_path)| !used_devs.contains(dev_path));
if mappings.is_empty() && !dev.optional() && !done.contains(&dev.name) {
return Err(format_err!("no device found for crypt dev {}", dev.name));
}
for (crypt_dev, dev_path) in mappings {
if done_crypt.contains(&crypt_dev) {
continue;
}
info!("crypt dev {crypt_dev}: using {dev_path}");
crypt_open(&crypt_dev, &dev_path).await?;
done_crypt.insert(crypt_dev);
used_devs.insert(dev_path);
done.insert(&dev.name);
}
}
Ok(())
})
.await;
}
static PREV_PW: Mutex<String> = Mutex::const_new(String::new());
async fn crypt_open(crypt_dev: &str, dev_path: &str) -> Result<()> {
'open_loop: loop {
let mut prev_pw = PREV_PW.lock().await;
let prompt = if prev_pw.is_empty() {
format!("crypt password for {crypt_dev}? ")
} else {
format!("crypt password for {crypt_dev} (enter = reuse previous)? ")
};
let mut pw = input::read_password(prompt).await;
if pw.is_empty() {
pw = prev_pw.clone();
}
if pw.is_empty() {
error!("empty password provided!");
continue;
}
*prev_pw = pw.clone();
if cryptsetup(&pw, ["open", dev_path, crypt_dev]).await? {
return Ok(());
}
error!("crypt open {crypt_dev} from {dev_path} failed");
if is_uninitialized(dev_path).await? {
// we can format the device
info!("{dev_path} looks uninitialized, it may be formatted");
match input::read_choice(["[f]ormat", "[r]etry", "[i]gnore"]).await {
'r' => continue 'open_loop,
'i' => return Ok(()),
'f' => {
if !cryptsetup(&pw, ["luksFormat", dev_path]).await? {
return Err(format_err!("cryptsetup luksFormat failed"));
}
if !cryptsetup(&pw, ["open", dev_path, crypt_dev]).await? {
return Err(format_err!("open after format failed"));
}
if let Err(e) = uninitialize(&format!("/dev/mapper/{crypt_dev}")).await {
warn!("uninitialize failed (ignored): {e}");
}
return Ok(());
}
_ => unreachable!(),
}
} else {
// device looks initialized, don't allow format
warn!("{dev_path} looks initialized, formatting not allowed from init");
match input::read_choice(["[r]etry", "[i]gnore"]).await {
'r' => continue 'open_loop,
'i' => return Ok(()),
_ => unreachable!(),
}
}
}
}
async fn cryptsetup<const N: usize>(pw: &str, args: [&str; N]) -> Result<bool> {
let mut child = Command::new("cryptsetup")
.args(args)
.arg("--key-file=-")
.stdin(Stdio::piped())
.spawn()?;
(child.stdin.as_mut().unwrap())
.write_all(pw.as_bytes())
.await?;
Ok(child.wait().await?.success())
}
fn find_dev(dev: &CryptDev, all_devs: &[String]) -> Vec<(String, String)> {
let dev_name = &dev.name;
match dev.filter {
DevFilter::Dev(ref path) => (all_devs.iter())
.filter(|dev_path| dev_path == &path)
.map(|dev_path| (dev.name.clone(), dev_path.clone()))
.collect(),
DevFilter::Prefix(ref prefix) => (all_devs.iter())
.filter_map(|path| {
let suffix = path.strip_prefix(prefix)?;
Some((format!("{dev_name}{suffix}"), path.clone()))
})
.collect(),
}
}

215
src/cmd/init/lvm.rs Normal file
View File

@ -0,0 +1,215 @@
use eyre::{format_err, Result};
use log::{error, info, warn};
use tokio::process::Command;
use super::{exec, retry, retry_or_ignore, USED_DEVS};
use crate::bootstrap::config::{Config, Filesystem, LvSize, LvmLV, LvmVG, TAKE_ALL};
use crate::fs::walk_dir;
use crate::{blockdev, lvm};
pub async fn setup(cfg: &Config) {
if cfg.lvm.is_empty() {
info!("no LVM VG configured");
return;
}
exec("pvscan", &[]).await;
exec("vgscan", &["--mknodes"]).await;
for vg in &cfg.lvm {
retry_or_ignore(async || setup_vg(vg).await).await
}
let lvs = retry(lvm::lvs).await;
for vg in &cfg.lvm {
let vg_name = vg.name.as_str();
for lv in &vg.lvs {
let lv_name = lv.name.as_str();
if (lvs.iter()).any(|lv| lv.equal_name(vg_name, lv_name)) {
info!("LVM LV {vg_name}/{lv_name} exists");
} else {
retry_or_ignore(async || setup_lv(&vg, &lv).await).await;
}
}
}
exec("vgchange", &["--sysinit", "-a", "ly"]).await;
for vg in &cfg.lvm {
for lv in &vg.lvs {
retry_or_ignore(async || format_lv(&vg, &lv).await).await;
}
}
}
async fn setup_vg(vg: &LvmVG) -> Result<()> {
let vg_name = vg.name.as_str();
let pvs = retry(lvm::pvs).await;
let mut dev_done = pvs.iter().filter(|pv| pv.vg_name == vg.name).count();
let dev_needed = vg.pvs.n;
macro_rules! missing_count {
() => {
(dev_needed as usize) - dev_done
};
}
if dev_needed == TAKE_ALL {
if dev_done == 0 {
info!("setting up LVM VG {vg_name} using all matching devices");
} else {
// in "take all" mode, don't extend as existing vg at boot
info!("LVM VG {vg_name} exists");
return Ok(());
}
} else if dev_done >= (dev_needed as usize) {
info!("LVM VG {vg_name} exists with enough devices");
return Ok(()); // already set up
} else {
info!("setting up LVM VG {vg_name} ({dev_done}/{dev_needed} devices configured)");
}
let regexps: Vec<regex::Regex> = (vg.pvs.regexps.iter())
.filter_map(|re_str| {
(re_str.parse())
.inspect_err(|e| error!("invalid regex ignored: {re_str:?}: {e}"))
.ok()
})
.collect();
let mut used_devs = USED_DEVS.lock().await;
let matching_devs = (walk_dir("/dev").await.into_iter())
.filter(|path| !used_devs.contains(path.as_str()))
.filter(|path| regexps.iter().any(|re| re.is_match(path)));
let devs: Vec<_> = if dev_needed == TAKE_ALL {
matching_devs.collect()
} else {
matching_devs.take(missing_count!()).collect()
};
let cmd = if dev_done == 0 {
if devs.is_empty() {
return Err(format_err!("creating but no devices found"));
}
"vgcreate"
} else {
"vgextend"
};
let status = (Command::new(cmd).arg(vg_name).args(&devs))
.status()
.await?;
if !status.success() {
return Err(format_err!("{cmd} failed: {status}"));
}
dev_done += devs.len();
used_devs.extend(devs);
if dev_needed != TAKE_ALL && dev_done < (dev_needed as usize) {
return Err(format_err!(
"LVM VG {vg_name} needs {} more device(s)",
missing_count!()
));
}
Ok(())
}
async fn setup_lv(vg: &LvmVG, lv: &LvmLV) -> Result<()> {
let name = format!("{}/{}", vg.name, lv.name);
info!("creating LV {name}");
let mut cmd = Command::new("lvcreate");
cmd.arg(&vg.name);
cmd.args(&["--name", &lv.name]);
match &lv.size {
LvSize::Size(sz) => cmd.args(&["-L", sz]),
LvSize::Extents(sz) => cmd.args(&["-l", sz]),
};
let raid = lv.raid.as_ref().unwrap_or(&vg.defaults.raid);
if let Some(mirrors) = raid.mirrors {
cmd.args(&["--mirrors", &mirrors.to_string()]);
}
if let Some(stripes) = raid.stripes {
cmd.args(&["--stripes", &stripes.to_string()]);
}
let status = cmd.status().await?;
if !status.success() {
return Err(format_err!("lvcreate failed: {status}"));
}
if let Err(e) = blockdev::uninitialize(&format!("/dev/{name}")).await {
warn!("uninitialize failed (ignored): {e}");
}
Ok(())
}
async fn format_lv(vg: &LvmVG, lv: &LvmLV) -> Result<()> {
let name = &format!("{}/{}", vg.name, lv.name);
let dev = &format!("/dev/{name}");
if !blockdev::is_uninitialized(&dev).await? {
info!("{dev} looks initialized");
return Ok(());
}
let fs = lv.fs.as_ref().unwrap_or(&vg.defaults.fs);
info!("initializing {} filesystem on {dev}", fs.fstype());
let mkfs = format!("mkfs.{}", fs.fstype());
let mut cmd = Command::new(&mkfs);
// filesystem specific flags
match fs {
Filesystem::Ext4 => {
cmd.arg("-F");
}
Filesystem::Btrfs | Filesystem::Xfs => {
cmd.arg("-f");
}
&Filesystem::Other(_) => {}
}
cmd.arg(dev);
let mut child = match cmd.spawn() {
Ok(v) => v,
Err(e) => {
// try simple fixes
match fs {
Filesystem::Xfs => install_package("xfsprogs").await?,
Filesystem::Btrfs => install_package("btrs-progs").await?,
_ => Err(format_err!("{mkfs} failed: {e}"))?,
}
cmd.spawn().map_err(|e| format_err!("{mkfs} failed: {e}"))?
}
};
let status = child.wait().await?;
if !status.success() {
return Err(format_err!("{mkfs} failed: {status}"));
}
Ok(())
}
async fn install_package(pkg: &str) -> Result<()> {
let status = Command::new("apk").arg("add").arg(pkg).status().await?;
if status.success() {
Ok(())
} else {
Err(format_err!("failed to install package {pkg}: {status}"))
}
}

94
src/cmd/init/networks.rs Normal file
View File

@ -0,0 +1,94 @@
use itertools::Itertools;
use log::{info, warn};
use std::collections::BTreeSet as Set;
use tokio::process::Command;
use super::{format_err, retry_or_ignore, Config, Result};
use crate::{
bootstrap::config,
udev,
utils::{select_n_by_regex, NameAliases},
};
pub async fn setup(cfg: &Config) {
if cfg.networks.is_empty() {
warn!("no networks configured");
return;
}
let mut assigned = Set::new();
for net in &cfg.networks {
retry_or_ignore(async || setup_network(net, &mut assigned).await).await;
}
}
async fn setup_network(net: &config::Network, assigned: &mut Set<String>) -> Result<()> {
info!("setting up network {}", net.name);
let netdevs = get_interfaces()?
.filter(|dev| !assigned.contains(dev.name()))
.collect::<Vec<_>>();
for dev in &netdevs {
info!(
"- available network device: {}, aliases [{}]",
dev.name(),
dev.aliases().join(", ")
);
}
let mut cmd = Command::new("ash");
cmd.arg("-c");
cmd.arg(&net.script);
let mut selected = Vec::new();
for iface in &net.interfaces {
let var = &iface.var;
let netdevs = netdevs.iter().filter(|na| !assigned.contains(na.name()));
let if_names = select_n_by_regex(iface.n, &iface.regexps, netdevs);
if if_names.is_empty() {
return Err(format_err!("- no interface match for {var:?}"));
}
let value = if_names.join(" ");
info!("- {var}={value}");
cmd.env(var, value);
selected.extend(if_names);
}
info!("- running script");
let status = cmd.status().await?;
if !status.success() {
return Err(format_err!("setup script failed: {status}"));
}
assigned.extend(selected);
Ok(())
}
fn get_interfaces() -> Result<impl Iterator<Item = NameAliases>> {
Ok(udev::get_devices("net")?.into_iter().map(|dev| {
let mut na = NameAliases::new(dev.sysname().to_string());
for (property, value) in dev.properties() {
if [
"INTERFACE",
"ID_NET_NAME",
"ID_NET_NAME_PATH",
"ID_NET_NAME_MAC",
"ID_NET_NAME_SLOT",
]
.contains(&property)
{
na.push(value.to_string());
}
}
na
}))
}

110
src/cmd/init/sshd.rs Normal file
View File

@ -0,0 +1,110 @@
use log::{info, warn};
use std::fs;
use std::io::Write;
use std::os::unix::fs::PermissionsExt;
use std::process::Stdio;
use tokio::net;
use tokio::process::Command;
use super::retry_or_ignore;
use crate::bootstrap::config::{Config, SSHServer};
pub async fn start(cfg: &Config) {
retry_or_ignore(async || {
info!("ssh: writing authorized keys");
let ssh_dir = "/root/.ssh";
let authorized_keys = format!("{ssh_dir}/authorized_keys");
fs::create_dir_all(ssh_dir)?;
fs::set_permissions(ssh_dir, fs::Permissions::from_mode(0o700))?;
let mut ak = Vec::new();
for auth in &cfg.auths {
let Some(ref key) = auth.ssh_key else {
continue;
};
writeln!(ak, "{key} {}", auth.name)?;
}
fs::write(authorized_keys, ak)?;
Ok(())
})
.await;
let cfg = cfg.ssh.clone();
retry_or_ignore(async move || {
// don't pre-start sshd as it should rarely be useful at this stage, use inetd-style.
let listen_addr = cfg.listen.clone();
info!("ssh: starting listener on {listen_addr}");
let listener = net::TcpListener::bind(listen_addr).await?;
tokio::spawn(handle_ssh_connections(listener, cfg.clone()));
Ok(())
})
.await;
}
async fn handle_ssh_connections(listener: net::TcpListener, cfg: SSHServer) {
let mut sshd_args = Vec::new();
sshd_args.extend(["-i", "-E", "/var/log/sshd.log"]);
let mut options = Vec::new();
if let Some(ref user_ca) = cfg.user_ca {
options.push(format!("TrustedUserCAKeys={user_ca}"));
}
for opt in &options {
sshd_args.extend(["-o", &opt]);
}
let mut keygen_done = false;
loop {
let (stream, remote) = match listener.accept().await {
Ok(v) => v,
Err(e) => {
warn!("ssh: listener stopped: {e}");
return;
}
};
if !keygen_done {
// make sure we have ssh host keys even if not provided
if (Command::new("ssh-keygen").arg("-A").status().await)
.inspect_err(|e| warn!("ssh-keygen failed: {e}"))
.is_ok_and(|s| s.success())
{
keygen_done = true
}
}
use std::os::unix::io::{AsRawFd, FromRawFd};
let fd = stream.as_raw_fd();
let mut cmd = Command::new("/usr/sbin/sshd");
cmd.args(&sshd_args);
cmd.stdin(unsafe { Stdio::from_raw_fd(fd) });
cmd.stdout(unsafe { Stdio::from_raw_fd(fd) });
cmd.stderr(Stdio::null());
let Ok(mut child) =
(cmd.spawn()).inspect_err(|e| warn!("ssh: failed to start server: {e}"))
else {
continue;
};
let pid = child.id().unwrap();
info!("ssh: new connection from {remote}, sshd PID {pid}");
tokio::spawn(async move {
let _ = child.wait().await;
});
}
}

11
src/cmd/init_input.rs Normal file
View File

@ -0,0 +1,11 @@
use crate::input;
pub async fn run() {
tokio::spawn(async {
if let Err(e) = input::forward_requests_from_socket().await {
eprintln!("failed to forwards requests from socket: {e}");
std::process::exit(1);
}
});
input::answer_requests_from_stdin().await;
}

12
src/cmd/version.rs Normal file
View File

@ -0,0 +1,12 @@
pub fn run() {
println!("{}", version_string());
}
pub fn version_string() -> String {
format!(
"Direktil {} v{} (git commit {})",
env!("CARGO_PKG_NAME"),
env!("CARGO_PKG_VERSION"),
env!("GIT_COMMIT")
)
}

61
src/dkl.rs Normal file
View File

@ -0,0 +1,61 @@
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct Config {
pub layers: Vec<String>,
pub root_user: RootUser,
#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub mounts: Vec<Mount>,
#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub files: Vec<File>,
#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub groups: Vec<Group>,
#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub users: Vec<User>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct RootUser {
#[serde(skip_serializing_if = "Option::is_none")]
pub password_hash: Option<String>,
pub authorized_keys: Vec<String>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct Mount {
pub r#type: Option<String>,
pub dev: String,
pub path: String,
pub options: Option<String>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct Group {
pub name: String,
#[serde(skip_serializing_if = "Option::is_none")]
pub gid: Option<u32>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct User {
pub name: String,
#[serde(skip_serializing_if = "Option::is_none")]
pub uid: Option<u32>,
#[serde(skip_serializing_if = "Option::is_none")]
pub gid: Option<u32>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct File {
pub path: String,
#[serde(skip_serializing_if = "Option::is_none")]
pub mode: Option<u32>,
#[serde(flatten)]
pub kind: FileKind,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
#[serde(rename_all = "snake_case")]
pub enum FileKind {
Content(String),
Symlink(String),
Dir(bool),
}

132
src/dklog.rs Normal file
View File

@ -0,0 +1,132 @@
use std::io::Write;
use std::sync::{LazyLock, Mutex};
use std::time::SystemTime;
use tokio::sync::watch;
use tokio::task::JoinSet;
pub static LOG: LazyLock<Log> = LazyLock::new(Log::new);
pub fn init() {
log::set_logger(&*LOG).expect("set_logger should not fail");
log::set_max_level(log::LevelFilter::Info);
}
pub struct Log {
start: SystemTime,
log: Mutex<Vec<u8>>,
tx: Mutex<Option<watch::Sender<usize>>>,
rx: watch::Receiver<usize>,
tasks: Mutex<Option<JoinSet<()>>>,
}
impl Log {
pub fn new() -> Self {
let (tx, rx) = watch::channel(0);
Self {
start: SystemTime::now(),
log: Mutex::new(Vec::new()),
tx: Mutex::new(Some(tx)),
rx,
tasks: Mutex::new(Some(JoinSet::new())),
}
}
pub fn spawn(&self, task: impl Future<Output = ()> + Send + 'static) {
if let Some(tasks) = self.tasks.lock().unwrap().as_mut() {
tasks.spawn(task);
}
}
pub fn subscribe(&self) -> LogWatch {
LogWatch {
log: self,
pos: 0,
rx: self.rx.clone(),
}
}
pub async fn copy_to<W: tokio::io::AsyncWrite + Unpin>(&self, mut out: W) {
let mut log = self.subscribe();
use tokio::io::AsyncWriteExt;
while let Some(chunk) = log.next().await {
let _ = out.write_all(&chunk).await;
let _ = out.flush().await;
}
}
pub async fn close(&self) {
self.tx.lock().unwrap().take();
if let Some(tasks) = self.tasks.lock().unwrap().take() {
tasks.join_all().await;
}
}
}
impl log::Log for Log {
fn enabled(&self, metadata: &log::Metadata) -> bool {
log::max_level().to_level().unwrap_or(log::Level::Info) >= metadata.level()
}
fn log(&self, record: &log::Record) {
if !self.enabled(record.metadata()) {
return;
}
let ts = self.start.elapsed().unwrap_or_default();
use log::Level::*;
let level = match record.level() {
Trace => "\x1b[2mTRC\x1b[0m",
Debug => "\x1b[34mDBG\x1b[0m",
Info => "\x1b[32mINF\x1b[0m",
Warn => "\x1b[93mWRN\x1b[0m",
Error => "\x1b[91mERR\x1b[0m",
};
let Ok(mut log) = self.log.lock() else {
return;
};
writeln!(
log,
"{:3}.{:03} {level} {}",
ts.as_secs(),
ts.subsec_millis(),
record.args()
)
.expect("write to buf should not fail");
if let Some(tx) = self.tx.lock().unwrap().as_mut() {
tx.send_replace(log.len());
}
}
fn flush(&self) {
// always flushed
}
}
pub struct LogWatch<'t> {
log: &'t Log,
pos: usize,
rx: watch::Receiver<usize>,
}
impl<'t> LogWatch<'t> {
pub async fn next(&mut self) -> Option<Vec<u8>> {
loop {
let new_pos = self.rx.borrow_and_update().clone();
if new_pos <= self.pos {
if self.rx.changed().await.is_err() {
return None; // finished
}
continue;
}
let mut chunk = Vec::new();
chunk.extend(&self.log.log.lock().unwrap()[self.pos..new_pos]);
self.pos = new_pos;
return Some(chunk);
}
}
}

43
src/fs.rs Normal file
View File

@ -0,0 +1,43 @@
use log::warn;
use std::io::Result;
use tokio::fs;
pub async fn walk_dir(dir: &str) -> Vec<String> {
let mut todo = Vec::new();
if let Ok(rd) = read_dir(dir).await {
todo.push(rd);
}
let mut results = Vec::new();
while let Some(rd) = todo.pop() {
for (path, is_dir) in rd {
if is_dir {
let Ok(child_rd) = (read_dir(&path).await)
.inspect_err(|e| warn!("reading dir {path} failed: {e}"))
else {
continue;
};
todo.push(child_rd);
} else {
results.push(path);
}
}
}
results
}
async fn read_dir(dir: &str) -> Result<Vec<(String, bool)>> {
let mut rd = fs::read_dir(dir).await?;
let mut entries = Vec::new();
while let Some(entry) = rd.next_entry().await? {
if let Some(path) = entry.path().to_str() {
entries.push((path.to_string(), entry.file_type().await?.is_dir()));
}
}
entries.sort(); // we want a deterministic & intuitive order
Ok(entries)
}

343
src/input.rs Normal file
View File

@ -0,0 +1,343 @@
use log::warn;
use std::fmt::Display;
use std::sync::{Arc, LazyLock};
use tokio::io::{self, AsyncBufReadExt, AsyncWriteExt, BufReader};
use tokio::net;
use tokio::sync::{oneshot, watch, Mutex};
pub async fn read_line(prompt: impl Display) -> String {
read(prompt, false).await
}
pub async fn read_password(prompt: impl Display) -> String {
read(prompt, true).await
}
fn choice_char(s: &str) -> char {
s.chars().skip_while(|c| *c != '[').skip(1).next().unwrap()
}
#[test]
fn test_choice_char() {
assert_eq!('r', choice_char("[r]etry"));
assert_eq!('b', choice_char("re[b]boot"));
}
/// ```no_run
/// use init::input;
///
/// #[tokio::main(flavor = "current_thread")]
/// async fn main() {
/// tokio::spawn(input::answer_requests_from_stdin());
/// match input::read_choice(["[r]etry","[i]gnore","re[b]oot"]).await {
/// 'r' => todo!(),
/// 'i' => todo!(),
/// 'b' => todo!(),
/// _ => unreachable!(),
/// }
/// }
/// ```
pub async fn read_choice<const N: usize>(choices: [&str; N]) -> char {
let chars = choices.map(choice_char);
let mut prompt = String::new();
for s in choices {
if !prompt.is_empty() {
prompt.push_str(", ");
}
prompt.push_str(s);
}
prompt.push_str("? ");
loop {
let line = read_line(&prompt).await;
let Some(ch) = line.chars().nth(0) else {
continue;
};
for choice in chars {
if ch == choice {
return choice;
}
}
}
}
#[derive(Clone, serde::Deserialize, serde::Serialize)]
pub struct InputRequest {
prompt: String,
hide: bool,
}
pub type Reply = Arc<Mutex<Option<oneshot::Sender<String>>>>;
static REQ: LazyLock<Mutex<watch::Sender<Option<(InputRequest, Reply)>>>> = LazyLock::new(|| {
let (tx, _) = watch::channel(None);
Mutex::new(tx)
});
static READ_MUTEX: Mutex<()> = Mutex::const_new(());
async fn read(prompt: impl Display, hide_input: bool) -> String {
let _read_lock = READ_MUTEX.lock();
let req = InputRequest {
prompt: prompt.to_string(),
hide: hide_input,
};
let (tx, rx) = oneshot::channel();
let reply = Arc::new(Mutex::new(Some(tx)));
REQ.lock().await.send_replace(Some((req, reply)));
let input = rx.await.expect("reply sender should not be closed");
REQ.lock().await.send_replace(None);
input
}
pub async fn answer_requests_from_stdin() {
let mut stdin = BufReader::new(io::stdin()).lines();
let mut stdout = io::stdout();
let mut current_req = REQ.lock().await.subscribe();
current_req.mark_changed();
loop {
// TODO check is stdin has been closed (using C-c is enough for now)
(current_req.changed().await).expect("input request should not close");
let Some((req, reply)) = current_req.borrow_and_update().clone() else {
continue;
};
// handle hide
let mut saved_termios = None;
if req.hide {
match termios::Termios::from_fd(0) {
Ok(mut tio) => {
saved_termios = Some(tio.clone());
tio.c_lflag &= !termios::ECHO;
if let Err(e) = termios::tcsetattr(0, termios::TCSAFLUSH, &tio) {
warn!("password may be echoed! {e}");
}
}
Err(e) => {
warn!("password may be echoed! {e}");
}
}
}
// print the prompt and wait for user input
stdout.write_all(req.prompt.as_bytes()).await.unwrap();
stdout.flush().await.unwrap();
tokio::select!(
r = stdin.next_line() => {
let Ok(Some(line)) = r else {
warn!("stdin closed");
return;
};
if let Some(tx) = reply.lock().await.take() {
let _ = tx.send(line);
}
if saved_termios.is_some() {
// final '\n' is hidden too so fix it
stdout.write_all(b"\n").await.unwrap();
stdout.flush().await.unwrap();
}
}
_ = current_req.changed() => {
// reply came from somewhere else
stdout.write_all(b"<answered>\n").await.unwrap();
stdout.flush().await.unwrap();
current_req.mark_changed();
}
);
// restore term if input was hidden
if let Some(tio) = saved_termios {
if let Err(e) = termios::tcsetattr(0, termios::TCSAFLUSH, &tio) {
warn!("failed to restore pty attrs: {e}");
}
}
}
}
const SOCKET_PATH: &str = "/run/init.sock";
pub async fn answer_requests_from_socket() {
let Ok(listener) = net::UnixListener::bind(SOCKET_PATH)
.inspect_err(|e| warn!("failed start input socket listener: {e}"))
else {
return;
};
loop {
let Ok((conn, _)) = (listener.accept())
.await
.inspect_err(|e| warn!("input socket listener failed: {e}"))
else {
return;
};
tokio::spawn(handle_connection(conn));
}
}
#[derive(serde::Deserialize, serde::Serialize)]
enum Message {
#[serde(rename = "l")]
Log(Vec<u8>),
#[serde(rename = "r")]
Req(Option<InputRequest>),
}
async fn handle_connection(conn: net::UnixStream) {
use crate::dklog;
let mut log = dklog::LOG.subscribe();
let mut current_req = REQ.lock().await.subscribe();
current_req.mark_changed();
let (rd, mut wr) = io::split(conn);
let mut rd = BufReader::new(rd).lines();
macro_rules! wr {
($msg:expr) => {
let mut buf = serde_json::to_vec(&$msg).unwrap();
buf.push(b'\n');
if wr.write_all(&buf).await.is_err() {
return;
}
if wr.flush().await.is_err() {
return;
}
};
}
loop {
tokio::select!(
r = current_req.changed() => {
r.expect("input request should not close");
},
l = log.next() => {
let Some(l) = l else { return; };
wr!(Message::Log(l));
continue;
},
);
let Some((req, reply)) = current_req.borrow_and_update().clone() else {
wr!(Message::Req(None));
continue;
};
wr!(Message::Req(Some(req)));
loop {
tokio::select!(
r = rd.next_line() => {
let Ok(Some(line)) = r else {
return; // closed
};
if let Some(tx) = reply.lock().await.take() {
let _ = tx.send(line);
}
}
_ = current_req.changed() => {
// reply came from somewhere else
current_req.mark_changed();
}
l = log.next() => {
let Some(l) = l else { return; };
wr!(Message::Log(l));
continue;
},
);
break;
}
}
}
pub async fn forward_requests_from_socket() -> eyre::Result<()> {
let stream = net::UnixStream::connect(SOCKET_PATH).await?;
let (rd, mut wr) = io::split(stream);
let mut rd = BufReader::new(rd).lines();
let (tx, mut rx) = tokio::sync::mpsc::channel(1);
tokio::spawn(async move {
loop {
let Ok(line) = (rd.next_line().await).inspect_err(|e| warn!("socket read error: {e}"))
else {
return;
};
let Some(line) = line else {
// end of stream
return;
};
let Ok(msg) = serde_json::from_str::<Message>(&line)
.inspect_err(|e| warn!("invalid message received: {e}"))
else {
continue;
};
match msg {
Message::Req(req) => {
if tx.send(req).await.is_err() {
// closed
return;
}
}
Message::Log(l) => {
let mut out = io::stderr();
let _ = out.write_all(&l).await;
let _ = out.flush().await;
}
};
}
});
// the recv request if any, otherwise wait for the next
let mut recv = None;
loop {
let req = match recv.take() {
// value already available
Some(v) => v,
// no value available, wait for the next
None => match rx.recv().await {
Some(v) => v,
// end of requests
None => return Ok(()),
},
};
let Some(req) = req else {
REQ.lock().await.send_replace(None);
continue;
};
tokio::select!(
mut r = read(req.prompt, req.hide) => {
r.push('\n');
wr.write_all(r.as_bytes()).await?;
wr.flush().await?;
}
r = rx.recv() => {
recv = r
}
);
}
}

11
src/lib.rs Normal file
View File

@ -0,0 +1,11 @@
pub mod bootstrap;
pub mod cmd;
pub mod lsblk;
pub mod lvm;
pub mod udev;
pub mod utils;
pub mod input;
pub mod blockdev;
pub mod fs;
pub mod dkl;
pub mod dklog;

27
src/lsblk.rs Normal file
View File

@ -0,0 +1,27 @@
use std::io;
use std::process::Command;
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct Report {
pub blockdevices: Vec<BlockDev>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
pub struct BlockDev {
pub name: String,
#[serde(rename = "maj:min")]
pub maj_min: String,
pub rm: bool,
pub size: String,
pub ro: bool,
#[serde(rename = "type")]
pub dev_type: String,
pub mountpoints: Vec<Option<String>>,
#[serde(default)]
pub children: Vec<BlockDev>,
}
pub fn report() -> io::Result<Report> {
let output = Command::new("lsblk").arg("--json").output()?;
Ok(serde_json::from_slice(output.stdout.as_slice()).unwrap())
}

102
src/lvm.rs Normal file
View File

@ -0,0 +1,102 @@
use eyre::{format_err, Result};
use tokio::process::Command;
#[derive(Debug, serde::Deserialize, serde::Serialize)]
struct Report {
report: Vec<ReportObj>,
}
#[derive(Debug, serde::Deserialize, serde::Serialize)]
enum ReportObj {
#[serde(rename = "pv")]
PV(Vec<PV>),
#[serde(rename = "vg")]
VG(Vec<VG>),
#[serde(rename = "lv")]
LV(Vec<LV>),
}
#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
pub struct PV {
pub pv_name: String,
pub vg_name: String,
pub pv_fmt: String,
pub pv_attr: String,
pub pv_size: String,
pub pv_free: String,
}
#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
pub struct VG {
pub vg_name: String,
pub pv_count: String,
pub lv_count: String,
pub snap_count: String,
pub vg_attr: String,
pub vg_size: String,
pub vg_free: String,
}
#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
pub struct LV {
pub lv_name: String,
pub vg_name: String,
pub lv_attr: String,
pub lv_size: String,
pub pool_lv: String,
pub origin: String,
pub data_percent: String,
pub metadata_percent: String,
pub move_pv: String,
pub mirror_log: String,
pub copy_percent: String,
pub convert_lv: String,
}
impl LV {
pub fn equal_name(&self, vg_name: &str, lv_name: &str) -> bool {
vg_name == &self.vg_name && lv_name == &self.lv_name
}
}
pub async fn pvs() -> Result<Vec<PV>> {
report_cmd("pvs", |o| match o {
ReportObj::PV(pv) => Some(pv),
_ => None,
})
.await
}
pub async fn vgs() -> Result<Vec<VG>> {
report_cmd("vgs", |o| match o {
ReportObj::VG(vg) => Some(vg),
_ => None,
})
.await
}
pub async fn lvs() -> Result<Vec<LV>> {
report_cmd("lvs", |o| match o {
ReportObj::LV(lv) => Some(lv),
_ => None,
})
.await
}
async fn report_cmd<T>(cmd: &str, find: fn(ReportObj) -> Option<Vec<T>>) -> Result<Vec<T>> {
let output = Command::new(cmd)
.arg("--reportformat=json")
.output()
.await?;
if !output.status.success() {
let stderr = String::from_utf8_lossy(&output.stderr.trim_ascii());
return Err(format_err!("{cmd} failed: {}", stderr));
}
let report: Report = serde_json::from_slice(&output.stdout).unwrap();
Ok((report.report.into_iter())
.filter_map(find)
.flatten()
.collect())
}

40
src/main.rs Normal file
View File

@ -0,0 +1,40 @@
use eyre::Result;
use std::env;
use std::process::exit;
use init::cmd;
use init::dklog;
#[tokio::main(flavor = "current_thread")]
async fn main() -> Result<()> {
dklog::LOG.spawn(dklog::LOG.copy_to(tokio::io::stderr()));
dklog::init();
let call_name = env::args().next().unwrap_or("init".into());
let call_name = (call_name.rsplit_once('/').map(|(_, n)| n)).unwrap_or(call_name.as_str());
let result = match call_name {
"init" => {
cmd::init::run().await;
Ok(())
}
"init-version" => {
cmd::version::run();
Ok(())
}
"init-connect" => {
cmd::init_input::run().await;
Ok(())
}
"bootstrap" => cmd::bootstrap::run().await,
_ => {
eprintln!("invalid call name: {call_name:?}");
exit(1);
}
};
dklog::LOG.close().await;
result
}

65
src/udev.rs Normal file
View File

@ -0,0 +1,65 @@
use eyre::Result;
use log::warn;
pub struct Device {
sysname: String,
output: String,
}
impl Device {
pub fn sysname(&self) -> &str {
self.sysname.as_str()
}
pub fn properties(&self) -> impl Iterator<Item = (&str, &str)> {
self.output
.lines()
.filter_map(|line| line.strip_prefix("E: ")?.split_once('='))
}
}
pub fn get_devices(class: &str) -> Result<Vec<Device>> {
let mut devices = Vec::new();
// none of libudev and udev crates were able to list network devices.
// falling back to manual sysfs scanning :(
//
// Even when given a syspath,
// - udev crate failed to see all properties;
// - libudev crate segfaulted on the second property (SYSNUM ok, then segfault).
// falling back to parsing udevadm output :(
//
// The best fix would be to check what's wrong with udev crate.
let entries = std::fs::read_dir(format!("/sys/class/{class}"))?;
for entry in entries {
let Ok(entry) = entry else {
continue;
};
let path = entry.path();
let path = path.to_string_lossy();
let output = std::process::Command::new("udevadm")
.args(&["info", &format!("--path={path}")])
.stderr(std::process::Stdio::piped())
.output()?;
if !output.status.success() {
warn!("udevadm failed for {path}: {}", output.status);
continue;
}
let output = String::from_utf8_lossy(&output.stdout);
let name = entry.file_name();
let dev = Device {
sysname: name.to_string_lossy().to_string(),
output: output.into_owned(),
};
devices.push(dev);
}
Ok(devices)
}

92
src/utils.rs Normal file
View File

@ -0,0 +1,92 @@
use log::error;
use std::collections::BTreeSet as Set;
use std::sync::LazyLock;
static CMDLINE: LazyLock<String> = LazyLock::new(|| {
std::fs::read("/proc/cmdline")
.inspect_err(|e| error!("failed to read kernel cmdline: {e}"))
.map(|c| String::from_utf8_lossy(&c).to_string())
.unwrap_or_default()
});
fn cmdline() -> impl Iterator<Item = &'static str> {
CMDLINE.split_ascii_whitespace()
}
pub fn bool_param(name: &str) -> bool {
let name1 = &format!("dkl.{name}");
let name2 = &format!("direktil.{name}");
cmdline().any(|part| part == name1 || part == name2)
}
pub fn param<'t>(name: &'t str, default: &'t str) -> &'t str {
let prefix1 = &format!("dkl.{name}=");
let prefix2 = &format!("direktil.{name}=");
cmdline()
.find_map(|part| {
part.strip_prefix(prefix1)
.or_else(|| part.strip_prefix(prefix2))
})
.unwrap_or(default)
}
pub struct NameAliases {
name: String,
aliases: Set<String>,
}
impl NameAliases {
pub fn new(name: String) -> Self {
Self {
name,
aliases: Set::new(),
}
}
pub fn name(&self) -> &str {
self.name.as_str()
}
pub fn aliases(&self) -> impl Iterator<Item = &str> {
self.aliases.iter().map(|s| s.as_str())
}
pub fn iter(&self) -> impl Iterator<Item = &str> {
std::iter::once(self.name()).chain(self.aliases())
}
pub fn push(&mut self, alias: String) {
if self.name == alias {
return;
}
self.aliases.insert(alias);
}
}
pub fn select_n_by_regex<'t>(
n: i16,
regexs: &Vec<String>,
nas: impl Iterator<Item = &'t NameAliases>,
) -> Vec<String> {
// compile regexs
let regexs: Vec<_> = (regexs.iter())
.filter_map(|re| {
regex::Regex::new(re)
.inspect_err(|e| error!("invalid regex ignored: {re:?}: {e}"))
.ok()
})
.collect();
let matching = |name| regexs.iter().any(|re| re.is_match(name));
let nas = nas
.filter(|na| na.iter().any(matching))
.map(|na| na.name().to_string());
if n == -1 {
nas.collect()
} else {
nas.take(n as usize).collect()
}
}

281
ssh.go
View File

@ -1,281 +0,0 @@
package main
import (
"encoding/binary"
"fmt"
"io"
"net"
"os"
"os/exec"
"sync"
"syscall"
"time"
"unsafe"
"github.com/creack/pty"
"github.com/rs/zerolog/log"
"golang.org/x/crypto/ssh"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func startSSH(cfg *config.Config) {
sshConfig := &ssh.ServerConfig{
PublicKeyCallback: sshCheckPubkey,
}
hostKeyLoaded := false
for _, format := range []string{"rsa", "dsa", "ecdsa", "ed25519"} {
log := log.With().Str("format", format).Logger()
pkBytes, err := os.ReadFile("/id_" + format)
if err != nil {
log.Error().Err(err).Msg("ssh: failed to load host key")
continue
}
pk, err := ssh.ParsePrivateKey(pkBytes)
if err != nil {
log.Error().Err(err).Msg("ssh: failed to parse host key")
continue
}
sshConfig.AddHostKey(pk)
hostKeyLoaded = true
log.Info().Msg("ssh: loaded host key")
}
if !hostKeyLoaded {
fatalf("ssh: failed to load any host key")
}
sshBind := ":22" // TODO configurable
listener, err := net.Listen("tcp", sshBind)
if err != nil {
fatalf("ssh: failed to listen on %s: %v", sshBind, err)
}
log.Info().Str("bind-address", sshBind).Msg("SSH server listening")
go func() {
for {
conn, err := listener.Accept()
if err != nil {
log.Info().Err(err).Msg("ssh: accept conn failed")
continue
}
go sshHandleConn(conn, sshConfig)
}
}()
}
func sshHandleConn(conn net.Conn, sshConfig *ssh.ServerConfig) {
sshConn, chans, reqs, err := ssh.NewServerConn(conn, sshConfig)
if err != nil {
log.Error().Err(err).Msg("ssh: handshake failed")
return
}
remoteAddr := sshConn.User() + "@" + sshConn.RemoteAddr().String()
log.Info().Str("remote", remoteAddr).Msg("ssh: new connection")
go sshHandleReqs(reqs)
go sshHandleChannels(remoteAddr, chans)
}
func sshHandleReqs(reqs <-chan *ssh.Request) {
for req := range reqs {
switch req.Type {
case "keepalive@openssh.com":
req.Reply(true, nil)
default:
log.Info().Str("type", req.Type).Msg("ssh: discarding request")
req.Reply(false, nil)
}
}
}
func sshHandleChannels(remoteAddr string, chans <-chan ssh.NewChannel) {
for newChannel := range chans {
if t := newChannel.ChannelType(); t != "session" {
newChannel.Reject(ssh.UnknownChannelType, fmt.Sprintf("unknown channel type: %s", t))
continue
}
channel, requests, err := newChannel.Accept()
if err != nil {
log.Error().Err(err).Msg("ssh: failed to accept channel")
continue
}
go sshHandleChannel(remoteAddr, channel, requests)
}
}
func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *ssh.Request) {
var (
ptyF, ttyF *os.File
termEnv string
)
defer func() {
if ptyF != nil {
ptyF.Close()
}
if ttyF != nil {
ttyF.Close()
}
}()
var once sync.Once
closeCh := func() {
channel.Close()
}
for req := range requests {
switch req.Type {
case "exec":
command := string(req.Payload[4 : req.Payload[3]+4])
switch command {
case "init":
if ptyF == nil {
go func() {
channel.Stderr().Write([]byte("\033[5m\033[31;1m\n\nWARNING: no TTY requested, passwords will be echoed!\n\n\033[0m"))
time.Sleep(3 * time.Second)
io.Copy(channel, stdout.NewReader())
once.Do(closeCh)
}()
go func() {
io.Copy(stdinPipe, channel)
once.Do(closeCh)
}()
} else {
stdinTTY := newTTY(ptyF.Fd())
if askingSecret.Load() {
stdinTTY.EchoOff()
}
registerInput(stdinTTY)
defer unregiterInput(stdinTTY)
go func() {
io.Copy(ttyF, stdout.NewReader())
once.Do(closeCh)
}()
go func() {
io.Copy(stdinPipe, ttyF)
once.Do(closeCh)
}()
}
req.Reply(true, nil)
case "bootstrap":
// extract a new bootstrap package
os.MkdirAll("/bootstrap/current", 0750)
cmd := exec.Command("/bin/tar", "xv", "-C", "/bootstrap/current")
cmd.Stdin = channel
cmd.Stdout = channel
cmd.Stderr = channel.Stderr()
go func() {
cmd.Run()
closeCh()
}()
req.Reply(true, nil)
default:
req.Reply(false, nil)
}
case "shell":
cmd := exec.Command("/bin/ash")
cmd.Env = []string{"TERM=" + termEnv}
cmd.Stdin = ttyF
cmd.Stdout = ttyF
cmd.Stderr = ttyF
cmd.SysProcAttr = &syscall.SysProcAttr{
Setctty: true,
Setsid: true,
Pdeathsig: syscall.SIGKILL,
}
cmd.Start()
go func() {
cmd.Wait()
ptyF.Close()
ptyF = nil
ttyF.Close()
ttyF = nil
}()
req.Reply(true, nil)
case "pty-req":
if ptyF != nil || ttyF != nil {
req.Reply(false, nil)
continue
}
var err error
ptyF, ttyF, err = pty.Open()
if err != nil {
log.Error().Err(err).Msg("ssh: PTY open failed")
req.Reply(false, nil)
continue
}
termLen := req.Payload[3]
termEnv = string(req.Payload[4 : termLen+4])
w, h := sshParseDims(req.Payload[termLen+4:])
sshSetWinsize(ptyF.Fd(), w, h)
req.Reply(true, nil)
go func() {
io.Copy(channel, ptyF)
once.Do(closeCh)
}()
go func() {
io.Copy(ptyF, channel)
once.Do(closeCh)
}()
case "window-change":
w, h := sshParseDims(req.Payload)
sshSetWinsize(ptyF.Fd(), w, h)
// no response
default:
req.Reply(false, nil)
}
}
}
func sshParseDims(b []byte) (uint32, uint32) {
w := binary.BigEndian.Uint32(b)
h := binary.BigEndian.Uint32(b[4:])
return w, h
}
// SetWinsize sets the size of the given pty.
func sshSetWinsize(fd uintptr, w, h uint32) {
// Winsize stores the Height and Width of a terminal.
type Winsize struct {
Height uint16
Width uint16
x uint16 // unused
y uint16 // unused
}
ws := &Winsize{Width: uint16(w), Height: uint16(h)}
syscall.Syscall(syscall.SYS_IOCTL, fd, uintptr(syscall.TIOCSWINSZ), uintptr(unsafe.Pointer(ws)))
}

5
test-assets/ssh_config Normal file
View File

@ -0,0 +1,5 @@
Host *
IdentityAgent none
IdentityFile test_id
CertificateFile test_id-cert.pub
User root

7
test-assets/test_id Normal file
View File

@ -0,0 +1,7 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACClOpU1FskeB8oNHPnAvyCaudlIDmLsb3gnFt8p11oAMgAAAJCAu9HUgLvR
1AAAAAtzc2gtZWQyNTUxOQAAACClOpU1FskeB8oNHPnAvyCaudlIDmLsb3gnFt8p11oAMg
AAAEDjqHWRXJeKTPUhA3g9zFzTpsWe6RvttYyvAFiqC1v7dqU6lTUWyR4Hyg0c+cC/IJq5
2UgOYuxveCcW3ynXWgAyAAAACW53cmtAbndyawECAwQ=
-----END OPENSSH PRIVATE KEY-----

1
test-assets/test_id-cert.pub Normal file
View File

@ -0,0 +1 @@
ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIGj53WgsixokqK4XnHJayyxYHw1M2tx7An6K84um8bufAAAAIKU6lTUWyR4Hyg0c+cC/IJq52UgOYuxveCcW3ynXWgAyAAAAAAAAAAEAAAABAAAABW5vdml0AAAACAAAAARyb290AAAAAAAAAAD//////////wAAAAAAAACCAAAAFXBlcm1pdC1YMTEtZm9yd2FyZGluZwAAAAAAAAAXcGVybWl0LWFnZW50LWZvcndhcmRpbmcAAAAAAAAAFnBlcm1pdC1wb3J0LWZvcndhcmRpbmcAAAAAAAAACnBlcm1pdC1wdHkAAAAAAAAADnBlcm1pdC11c2VyLXJjAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIP3Y4b+hlVyPiOHXF6/ziasWijAjsLXyD8UaNiW/oXtFAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEDsYGIHMYvZg+7SvFngClKIe2yaPRKO3uS+4Mm4aVyTN2XzFtb98YxW5tYA/2fh7YEwquYZHrMr3EPskaw2Gb4N nwrk@nwrk

1
test-assets/test_id.pub Normal file
View File

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKU6lTUWyR4Hyg0c+cC/IJq52UgOYuxveCcW3ynXWgAy nwrk@nwrk

7
test-assets/user_ca Normal file
View File

@ -0,0 +1,7 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACD92OG/oZVcj4jh1xev84mrFoowI7C18g/FGjYlv6F7RQAAAJDBjLd2wYy3
dgAAAAtzc2gtZWQyNTUxOQAAACD92OG/oZVcj4jh1xev84mrFoowI7C18g/FGjYlv6F7RQ
AAAEBLInqhwgD5sym/LhJcHQM0BmW7n8hNSQoi+SWUHnTL/v3Y4b+hlVyPiOHXF6/ziasW
ijAjsLXyD8UaNiW/oXtFAAAADFRlc3QgdXNlciBDQQE=
-----END OPENSSH PRIVATE KEY-----

16
test-initrd/config.yaml
View File

@ -4,11 +4,27 @@ anti_phishing_code: "direktil<3"
modules: /modules.sqfs
vpns:
wgprov: |-
[Interface]
PrivateKey = GGM/MwPYrN9HZHsWrEv0RtX/aHXcXzkrZnZWiMgNrEg=
ListenPort = 54321
Address = 10.9.8.7/24
[Peer] # admin1
PresharedKey = oH1OhMWGPg+Qvq3w5mmp6paIi/1bMKl48r0Su2P1F3g=
PublicKey = /j/uawB3nM+36fOxWgI/kK412TvHlYU3T8qxr38hpAs=
AllowedIPs = 10.9.8.1/24
auths:
- name: novit
sshKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkpbU6sf4t0f6XAv9DuW3XH5iLM0AI5rc8PT2jwea1N
password: bXlzZWVk:HMSxrg1cYphaPuUYUbtbl/htep/tVYYIQAuvkNMVpw0 # mypass
ssh:
listen: "[::]:22"
user_ca: /user_ca.pub
networks:
- name: loopback
interfaces: [ { var: iface, n: 1, regexps: [ "^lo$" ] } ]

9
test-initrd/etc/ssh/ssh_host_ecdsa_key Normal file
View File

@ -0,0 +1,9 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSlevO48OA0/yB8zTP1naijVU3wsB0c
4s6Jc/8y7YwNq51/SlieeGeRFcCSke5Z67rNX2JFiv+tsGQB6TczZm/6AAAAqDU5b2c1OW
9nAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKV687jw4DT/IHzN
M/WdqKNVTfCwHRzizolz/zLtjA2rnX9KWJ54Z5EVwJKR7lnrus1fYkWK/62wZAHpNzNmb/
oAAAAhANenGXlP1ZPgcyb/+O57MbpGDOZS4e7UNiyvkD8I3hNnAAAACW53cmtAbndyawEC
AwQFBg==
-----END OPENSSH PRIVATE KEY-----

7
test-initrd/etc/ssh/ssh_host_ed25519_key Normal file
View File

@ -0,0 +1,7 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACCCMX0zm3Fi7vXWevHuJvzU30l5F06NAC2qloUewVSoDQAAAJDnq/y456v8
uAAAAAtzc2gtZWQyNTUxOQAAACCCMX0zm3Fi7vXWevHuJvzU30l5F06NAC2qloUewVSoDQ
AAAEDXYq507MsjSN34Qw87guf3d5D4Dt2IrF788CeBcYSNe4IxfTObcWLu9dZ68e4m/NTf
SXkXTo0ALaqWhR7BVKgNAAAACW53cmtAbndyawECAwQ=
-----END OPENSSH PRIVATE KEY-----

0
test-initrd/id_rsa → test-initrd/etc/ssh/ssh_host_rsa_key
View File

1
test-initrd/id_rsa.pub
View File

@ -1 +0,0 @@
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLo+mv+0GJViwFiK14bAw8j4HYFIGf4I/fpmIqzHohf70TT+cYqAKSHBYV+uYjNLYQib6Ii/thPexeypw73pq7Z7CHvubnFQUiuqJ7lzXeV4146f5eHL76/TvTmKthS4FVFta6SlCOE6unR6q8HM52VSijavtoX3musxugCwhaHmBNOdUJcNIRCIey8QaOztPK05dDrOZhMQJgSST/BRaNrtY0/xRmJo+5TbQeyjyDuQdK2EoS51QMWzsT/LH6drQBgKd8RRHqjEhscfaV2CmdfuVO/liEdW82epMgFCGYtMetP/rs3bPkC90ULxPZSytaz7d5ux1dvSgrPHzX4306k/GP3d6EvOedy4IKAB53J7lebvrRI5pTVPZvd/RsSGGxUIwjf2Y8TF5nbC2d2D5Oauqfevn29veIRh8mq+AsJMnkvUFwVRN+6WDsZ+F82+AGaCKJFNQLYbRKtXW0zzi+wTsnLJNwlpevRf61SCxehSqeVfnc4TDsAGyRa9nSbR8= test@novit.io

BIN
test-initrd/modules.sqfs
View File

Binary file not shown.

1
test-initrd/user_ca.pub Normal file
View File

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP3Y4b+hlVyPiOHXF6/ziasWijAjsLXyD8UaNiW/oXtF Test user CA

BIN
test-kernel
View File

Binary file not shown.

19
tools/cpiocat/main.go
View File

@ -1,19 +0,0 @@
package main
import (
"flag"
"fmt"
"os"
"novit.tech/direktil/pkg/cpiocat"
)
func main() {
flag.Parse()
err := cpiocat.Append(os.Stdout, os.Stdin, flag.Args())
if err != nil {
fmt.Fprintln(os.Stderr, err.Error())
os.Exit(1)
}
}

37
tools/testconf/main.go
View File

@ -1,37 +0,0 @@
package main
import (
"bytes"
"flag"
"fmt"
"os"
"gopkg.in/yaml.v3"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func main() {
flag.Parse()
for _, arg := range flag.Args() {
fmt.Println("testing", arg)
cfgBytes, err := os.ReadFile(arg)
fail(err)
cfg := config.Config{}
dec := yaml.NewDecoder(bytes.NewBuffer(cfgBytes))
dec.KnownFields(true)
err = dec.Decode(&cfg)
fail(err)
}
}
func fail(err error) {
if err != nil {
fmt.Fprintln(os.Stderr, err.Error())
os.Exit(1)
}
}

35
tty.go
View File

@ -1,35 +0,0 @@
package main
import (
"golang.org/x/sys/unix"
)
type tty struct {
fd int
termios *unix.Termios
}
func newTTY(fd uintptr) *tty {
termios, _ := unix.IoctlGetTermios(int(fd), unix.TCGETS)
return &tty{int(fd), termios}
}
func (t *tty) EchoOff() {
if t.termios == nil {
return
}
newState := *t.termios
newState.Lflag &^= unix.ECHO
newState.Lflag |= unix.ICANON | unix.ISIG
newState.Iflag |= unix.ICRNL
unix.IoctlSetTermios(t.fd, unix.TCSETS, &newState)
}
func (t *tty) Restore() {
if t.termios == nil {
return
}
unix.IoctlSetTermios(t.fd, unix.TCSETS, t.termios)
}

20
uname.go
View File

@ -1,20 +0,0 @@
package main
import "syscall"
func unameRelease() string {
uname := &syscall.Utsname{}
if err := syscall.Uname(uname); err != nil {
fatalf("failed to get kernel version: %v", err)
}
ba := make([]byte, 0, len(uname.Release))
for _, c := range uname.Release {
if c == 0 {
break
}
ba = append(ba, byte(c))
}
return string(ba)
}

137
vpn.go
View File

@ -1,137 +0,0 @@
package main
import (
"net"
"os"
"path/filepath"
"github.com/rs/zerolog/log"
"golang.zx2c4.com/wireguard/wgctrl"
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
"novit.tech/direktil/pkg/config"
)
func setupVPN(vpn config.VPNDef, localGenDir string) {
log := log.With().Str("vpn", vpn.Name).Logger()
log.Info().Msg("VPN: setting up")
vpnDir := filepath.Join(localGenDir, vpn.Name)
os.MkdirAll(vpnDir, 0750)
logMsg := log.Info()
if vpn.ListenPort != nil {
logMsg.Int("ListenPort", *vpn.ListenPort)
}
// public/private key
keyFile := filepath.Join(vpnDir, "key")
keyBytes, err := os.ReadFile(keyFile)
if os.IsNotExist(err) {
key, err := wgtypes.GeneratePrivateKey()
if err != nil {
fatalf("failed to generate VPN key: %v", err)
}
keyBytes = []byte(key.String())
os.WriteFile(keyFile, keyBytes, 0600)
} else if err != nil {
fatalf("failed to read VPN key: %v", err)
}
key, err := wgtypes.ParseKey(string(keyBytes))
if err != nil {
fatalf("bad VPN key: %v", err)
}
logMsg.Stringer("PublicKey", key.PublicKey())
// pre-shared key
pskeyFile := filepath.Join(vpnDir, "pskey")
pskeyBytes, err := os.ReadFile(pskeyFile)
if os.IsNotExist(err) {
key, err := wgtypes.GenerateKey()
if err != nil {
fatalf("failed to generate VPN pre-shared key: %v", err)
}
pskeyBytes = []byte(key.String())
os.WriteFile(pskeyFile, pskeyBytes, 0600)
} else if err != nil {
fatalf("failed to read VPN pre-shared key: %v", err)
}
pskey, err := wgtypes.ParseKey(string(pskeyBytes))
if err != nil {
fatalf("bad VPN pre-shared key: %v", err)
}
{
keyStr := key.String()
logMsg.Str("PresharedKey", keyStr[0:4]+"..."+keyStr[len(keyStr)-4:])
}
// setup interface
cfg := wgtypes.Config{
PrivateKey: &key,
ListenPort: vpn.ListenPort,
Peers: make([]wgtypes.PeerConfig, 0, len(vpn.Peers)),
}
for idx, vpnPeer := range vpn.Peers {
vpnPeer := vpnPeer
wgPeer := wgtypes.PeerConfig{
Endpoint: vpnPeer.Endpoint,
AllowedIPs: make([]net.IPNet, 0, len(vpnPeer.AllowedIPs)),
PersistentKeepaliveInterval: &vpnPeer.KeepAlive,
}
if vpnPeer.WithPreSharedKey {
wgPeer.PresharedKey = &pskey
}
pubkey, err := wgtypes.ParseKey(vpnPeer.PublicKey)
if err != nil {
fatalf("bad VPN peer[%d] public key: %v", idx, err)
}
wgPeer.PublicKey = pubkey
for _, ipnetStr := range vpnPeer.AllowedIPs {
_, ipnet, err := net.ParseCIDR(ipnetStr)
if err != nil {
fatalf("bad IP/net: %q: %v", ipnetStr, err)
}
wgPeer.AllowedIPs = append(wgPeer.AllowedIPs, *ipnet)
}
cfg.Peers = append(cfg.Peers, wgPeer)
}
wg, err := wgctrl.New()
if err != nil {
fatalf("failed to setup WireGuard client: %v", err)
}
defer wg.Close()
log.Info().Strs("ips", vpn.IPs).Msg("VPN: creating interface")
run("ip", "link", "add", vpn.Name, "type", "wireguard")
for _, ip := range vpn.IPs {
run("ip", "addr", "add", ip, "dev", vpn.Name)
}
logMsg.Msg("VPN: configuring interface")
err = wg.ConfigureDevice(vpn.Name, cfg)
if err != nil {
fatalf("failed to setup VPN %s: %v", vpn.Name, err)
}
run("ip", "link", "set", vpn.Name, "up")
}