23 Commits

Author SHA1 Message Date
6e1cb57e03 upgrade go+deps 2025-06-02 14:53:05 +02:00
3f2549c746 unix module disappeared 2025-06-02 14:51:26 +02:00
91eb83d6e1 bootstrap: attemps fetching for 1 minute before giving up 2024-11-06 00:42:51 +01:00
5924705b24 shrink exec 2024-11-04 22:06:48 +01:00
0f9679d91e use udev for lvm & net 2024-11-04 17:33:23 +01:00
7325ee1c0c don't write config.yaml anymore 2024-01-21 15:42:15 +01:00
4a12e1ba8f rework ssh 'init' command 2024-01-21 15:32:51 +01:00
2df68d3fca bump pkg mod to support symlink&dir in file def 2024-01-20 18:28:28 +01:00
5fd3a9d925 remove boot-v1 2024-01-20 17:31:57 +01:00
6bf1d1ccf2 move to zerolog 2024-01-20 16:41:54 +01:00
5ab8b74041 Dockerfile: bump 'from' 2024-01-08 09:50:02 +01:00
7b62140d2a bootstrap: update-ca-certificates 2024-01-08 09:47:40 +01:00
650c913930 ssh: load more host key formats than rsa 2023-12-17 17:16:53 +01:00
d69f2f27ee lz4 test (and better build) 2023-12-17 14:28:32 +01:00
12bfa6cfd6 feature: pre_lvm_crypt 2023-12-17 13:48:18 +01:00
898c43b954 push dkl init boot logic here 2023-12-04 17:47:57 +01:00
1555419549 files: default mode 2023-11-27 16:08:09 +01:00
3f2cd997a0 better build 2023-11-27 14:40:15 +01:00
86d85f014c fix write files and deprecated calls 2023-11-27 14:08:44 +01:00
69cc01db9b move to clean crypt handling 2023-02-02 00:28:36 +01:00
3c7d56ae48 bootv2: bootstrap, vpn 2022-04-04 10:29:28 +02:00
8506f8807d boot v2 progress: disks, ssh, success... 2022-03-08 11:45:56 +01:00
8e86579004 prepare boot v2 2022-02-04 21:45:18 +01:00
43 changed files with 2471 additions and 230 deletions

View File

@ -1 +1,8 @@
Dockerfile Dockerfile
tmp/**/*
dist/*
go.work
go.work.sum
modd.*conf
test-initrd*
test-initrd/**/*

6
.gitignore vendored
View File

@ -1 +1,7 @@
.*.sw[po] .*.sw[po]
/dist
/qemu.pid
/test-initrd.cpio
/tmp
/go.work
/go.work.sum

View File

@ -1,19 +1,39 @@
# ------------------------------------------------------------------------ from golang:1.23.2-alpine3.20 as build
from mcluseau/golang-builder:1.15.5 as build run apk add --no-cache gcc musl-dev linux-headers eudev-dev upx
workdir /src
copy . .
env CGO_ENABLED=1
run \
--mount=type=cache,id=gomod,target=/go/pkg/mod \
--mount=type=cache,id=gobuild,target=/root/.cache/go-build \
go test ./... \
&& go build -ldflags "-s -w" -o /go/bin/init -trimpath .
run upx /go/bin/init
# ------------------------------------------------------------------------ # ------------------------------------------------------------------------
from alpine:3.12 from alpine:3.20.3 as initrd
env busybox_v=1.28.1-defconfig-multiarch \ run apk add --no-cache xz
arch=x86_64
run apk add --update curl
workdir /layer workdir /layer
run . /etc/os-release \
&& wget -O- https://dl-cdn.alpinelinux.org/alpine/v${VERSION_ID%.*}/releases/x86_64/alpine-minirootfs-${VERSION_ID}-x86_64.tar.gz |tar zxv
add build-layer / run apk add --no-cache -p . musl lvm2 lvm2-extra lvm2-dmeventd udev cryptsetup e2fsprogs lsblk
run /build-layer run rm -rf usr/share/apk var/cache/apk
copy --from=build /go/bin/initrd /layer/init copy --from=build /go/bin/init .
entrypoint ["sh","-c","find |cpio -H newc -o |base64"] # check viability
run chroot /layer /init hello
run find |cpio -H newc -o >/initrd
# ------------------------------------------------------------------------
from alpine:3.20.3
copy --from=initrd /initrd /
entrypoint ["base64","/initrd"]

140
apply-config.go Normal file
View File

@ -0,0 +1,140 @@
package main
import (
"os"
"path/filepath"
"strconv"
"strings"
"syscall"
"time"
"github.com/rs/zerolog/log"
yaml "gopkg.in/yaml.v2"
"novit.tech/direktil/pkg/config/apply"
)
var loopOffset = 0
func applyConfig(cfgPath string, bootMounted bool) (cfg *configV1) {
cfgBytes, err := os.ReadFile(cfgPath)
if err != nil {
fatalf("failed to read %s: %v", cfgPath, err)
}
cfg = &configV1{}
if err := yaml.Unmarshal(cfgBytes, cfg); err != nil {
fatal("failed to load config: ", err)
}
// mount layers
if len(cfg.Layers) == 0 {
fatal("no layers configured!")
}
layersInMemory := paramBool("layers-in-mem", false)
log.Info().Strs("layers", cfg.Layers).Bool("in-memory", layersInMemory).Msg("mounting layers")
const layersInMemDir = "/layers-in-mem"
if layersInMemory {
mkdir(layersInMemDir, 0700)
mount("layers-mem", layersInMemDir, "tmpfs", 0, "")
}
lowers := make([]string, len(cfg.Layers))
for i, layer := range cfg.Layers {
log := log.With().Str("layer", layer).Logger()
path := layerPath(layer)
info, err := os.Stat(path)
if err != nil {
fatal(err)
}
log.Info().Int64("size", info.Size()).Msg("layer found")
if layersInMemory {
log.Info().Msg("copying to memory")
targetPath := filepath.Join(layersInMemDir, layer)
cp(path, targetPath)
path = targetPath
}
dir := "/layers/" + layer
lowers[i] = dir
mountSquahfs(path, dir)
}
// prepare system root
mount("mem", "/changes", "tmpfs", 0, "")
mkdir("/changes/workdir", 0755)
mkdir("/changes/upperdir", 0755)
mount("overlay", "/system", "overlay", rootMountFlags,
"lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir")
// make root rshared (default in systemd, required by Kubernetes 1.10+)
// equivalent to "mount --make-rshared /"
// see kernel's Documentation/sharedsubtree.txt (search rshared)
if err := syscall.Mount("", "/system", "", syscall.MS_SHARED|syscall.MS_REC, ""); err != nil {
fatalf("FATAL: mount --make-rshared / failed: %v", err)
}
if bootMounted {
if layersInMemory {
if err := syscall.Unmount("/boot", 0); err != nil {
log.Warn().Err(err).Msg("failed to unmount /boot")
time.Sleep(2 * time.Second)
}
} else {
mount("/boot", "/system/boot", "", syscall.MS_BIND, "")
}
}
// - write files
apply.Files(cfg.Files, "/system")
// - groups
for _, group := range cfg.Groups {
logEvt := log.Info().Str("group", group.Name)
opts := make([]string, 0)
opts = append(opts /* chroot */, "/system", "groupadd", "-r")
if group.Gid != 0 {
opts = append(opts, "-g", strconv.Itoa(group.Gid))
logEvt.Int("gid", group.Gid)
}
opts = append(opts, group.Name)
logEvt.Msg("creating group")
run("chroot", opts...)
}
// - user
for _, user := range cfg.Users {
logEvt := log.Info().Str("user", user.Name)
opts := make([]string, 0)
opts = append(opts /* chroot */, "/system", "useradd", "-r")
if user.Gid != 0 {
opts = append(opts, "-g", strconv.Itoa(user.Gid))
logEvt.Int("gid", user.Gid)
}
if user.Uid != 0 {
opts = append(opts, "-u", strconv.Itoa(user.Uid))
logEvt.Int("uid", user.Uid)
}
opts = append(opts, user.Name)
logEvt.Msg("creating user")
run("chroot", opts...)
}
return
}

56
ask-secret.go Normal file
View File

@ -0,0 +1,56 @@
package main
import (
"bufio"
"bytes"
"fmt"
"io"
"os"
"sync"
"sync/atomic"
)
var (
inputTTYs = new(sync.Map)
askingSecret atomic.Bool
)
func registerInput(in *tty) { inputTTYs.Store(in, in) }
func unregiterInput(in *tty) { inputTTYs.Delete(in) }
func askSecret(prompt string) (s []byte) {
err := func() (err error) {
askingSecret.Store(true)
defer askingSecret.Store(false)
inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).EchoOff(); return true })
defer inputTTYs.Range(func(k, v any) (con bool) { v.(*tty).Restore(); return true })
var (
in io.Reader = stdin
out io.Writer = stdout
)
if stdin == nil {
in = os.Stdin
out = os.Stdout
}
out.Write([]byte(prompt + ": "))
s, err = bufio.NewReader(in).ReadBytes('\n')
if err != nil {
return
}
fmt.Println()
s = bytes.TrimRight(s, "\r\n")
return
}()
if err != nil {
fatalf("failed to read from stdin: %v", err)
}
return
}

59
auth.go Normal file
View File

@ -0,0 +1,59 @@
package main
import (
"bytes"
"errors"
"github.com/rs/zerolog/log"
"golang.org/x/crypto/ssh"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
var (
auths []config.Auth
)
func localAuth() bool {
sec := askSecret("password")
for _, auth := range auths {
if auth.Password == "" {
continue
}
if config.CheckPassword(auth.Password, sec) {
log.Info().Msgf("login with auth %q", auth.Name)
return true
}
}
return false
}
func sshCheckPubkey(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
keyBytes := key.Marshal()
for _, auth := range auths {
if auth.SSHKey == "" {
continue
}
allowedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(auth.SSHKey))
if err != nil {
log.Warn().Err(err).Str("user", auth.Name).Str("key", auth.SSHKey).Msg("SSH public key is invalid")
return nil, err
}
if bytes.Equal(allowedKey.Marshal(), keyBytes) {
log.Info().Str("user", auth.Name).Msg("ssh: accepting public key")
return &ssh.Permissions{
Extensions: map[string]string{
"pubkey-fp": ssh.FingerprintSHA256(key),
},
}, nil
}
}
return nil, errors.New("no matching public key")
}

104
boot-v2.go Normal file
View File

@ -0,0 +1,104 @@
package main
import (
"os"
"os/exec"
"syscall"
"github.com/rs/zerolog/log"
"gopkg.in/yaml.v3"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func bootV2() {
log.Info().Msg("-- boot v2 --")
kernelVersion := unameRelease()
log.Info().Str("version", kernelVersion).Msg("Linux")
cfg := &config.Config{}
{
f, err := os.Open("/config.yaml")
if err != nil {
fatal("failed to open /config.yaml: ", err)
}
err = yaml.NewDecoder(f).Decode(cfg)
f.Close()
if err != nil {
fatal("failed to parse /config.yaml: ", err)
}
}
log.Info().Msg("config loaded")
if cfg.AntiPhishingCode != "" {
log.Info().Str("anti-phishing-code", cfg.AntiPhishingCode).Send()
}
auths = cfg.Auths
// mount kernel modules
if cfg.Modules == "" {
log.Warn().Msg("NOT mounting modules (\"modules:\" not specified)")
} else {
log.Info().Str("from", cfg.Modules).Msg("mounting modules")
mountSquahfs(cfg.Modules, "/modules")
modulesSourcePath := "/modules/lib/modules/" + kernelVersion
if _, err := os.Stat(modulesSourcePath); err != nil {
fatal("invalid modules dir: ", err)
}
os.MkdirAll("/lib/modules", 0755)
if err := os.Symlink(modulesSourcePath, "/lib/modules/"+kernelVersion); err != nil {
fatal("failed to symlink modules: ", err)
}
}
// devices init
log.Info().Msg("starting udevd")
err := exec.Command("udevd").Start()
if err != nil {
fatal("failed to start udevd: ", err)
}
log.Info().Msg("udevadm triggers")
run("udevadm", "trigger", "-c", "add", "-t", "devices")
run("udevadm", "trigger", "-c", "add", "-t", "subsystems")
log.Info().Msg("udevadm settle")
run("udevadm", "settle")
// networks
setupNetworks(cfg)
// Wireguard VPN
// TODO startVPN()
// SSH service
startSSH(cfg)
// dmcrypt blockdevs
setupCrypt(cfg.PreLVMCrypt, map[string]string{})
// LVM
setupLVM(cfg)
// bootstrap the system
bootstrap(cfg)
// finalize
finalizeBoot()
}
func finalizeBoot() {
// switch root
log.Info().Msg("switching root")
err := syscall.Exec("/sbin/switch_root", []string{"switch_root",
"-c", "/dev/console", "/system", "/sbin/init"}, os.Environ())
fatal("switch_root failed: ", err)
}

192
bootstrap.go Normal file
View File

@ -0,0 +1,192 @@
package main
import (
"bytes"
"fmt"
"io"
"net/http"
"os"
"path/filepath"
"strings"
"time"
"github.com/rs/zerolog/log"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func bootstrap(cfg *config.Config) {
if cfg.Bootstrap.Dev == "" {
fatalf("bootstrap device not defined!")
}
const bsDir = "/bootstrap"
os.MkdirAll(bsDir, 0700)
run("mount", cfg.Bootstrap.Dev, bsDir)
baseDir := filepath.Join(bsDir, bootVersion)
sysCfgPath := filepath.Join(baseDir, "config.yaml")
if _, err := os.Stat(sysCfgPath); os.IsNotExist(err) {
log.Warn().Msgf("bootstrap %q does not exist", bootVersion)
seed := cfg.Bootstrap.Seed
if seed == "" {
fatalf("boostrap seed not defined, admin required")
}
log.Info().Str("from", seed).Msgf("seeding bootstrap")
err = os.MkdirAll(baseDir, 0700)
if err != nil {
fatalf("failed to create bootstrap dir: %v", err)
}
bootstrapFile := filepath.Join(baseDir, "bootstrap.tar")
err = func() (err error) {
var resp *http.Response
start := time.Now()
for time.Since(start) <= time.Minute {
resp, err = http.Get(seed)
if err == nil {
break
}
time.Sleep(time.Second)
}
if err != nil {
return fmt.Errorf("failed to fetch bootstrap")
}
if resp.StatusCode != http.StatusOK {
err = fmt.Errorf("bad HTTP status: %s", resp.Status)
return
}
defer resp.Body.Close()
out, err := os.Create(bootstrapFile)
if err != nil {
return
}
defer out.Close()
_, err = io.Copy(out, resp.Body)
return
}()
if err != nil {
fatalf("seeding failed: %v", err)
}
log.Info().Msg("unpacking bootstrap file")
run("tar", "xvf", bootstrapFile, "-C", baseDir)
}
layersDir = baseDir
layersOverride["modules"] = "/modules.sqfs"
sysCfg := applyConfig(sysCfgPath, false)
// load requested modules
for _, mod := range sysCfg.Modules {
log.Info().Str("module", mod).Msg("loading module")
run("modprobe", mod)
}
// localy-generated assets dir
localGenDir := filepath.Join(bsDir, "local-gen")
// vpns are v2+
for _, vpn := range sysCfg.VPNs {
setupVPN(vpn, localGenDir)
}
// mounts are v2+
for _, mount := range sysCfg.Mounts {
log.Info().Str("source", mount.Dev).Str("target", mount.Path).Msg("mount")
path := filepath.Join("/system", mount.Path)
os.MkdirAll(path, 0755)
args := []string{mount.Dev, path}
if mount.Type != "" {
args = append(args, "-t", mount.Type)
}
if mount.Options != "" {
args = append(args, "-o", mount.Options)
}
run("mount", args...)
}
// setup root user
if ph := sysCfg.RootUser.PasswordHash; ph != "" {
log.Info().Msg("setting root's password")
setUserPass("root", ph)
}
if ak := sysCfg.RootUser.AuthorizedKeys; len(ak) != 0 {
log.Info().Msg("setting root's authorized keys")
setAuthorizedKeys(ak)
}
// update-ca-certificates
log.Info().Msg("updating CA certificates")
run("chroot", "/system", "update-ca-certificates")
}
func setUserPass(user, passwordHash string) {
const fpath = "/system/etc/shadow"
ba, err := os.ReadFile(fpath)
if err != nil {
fatalf("failed to read shadow: %v", err)
}
lines := bytes.Split(ba, []byte{'\n'})
buf := new(bytes.Buffer)
for _, line := range lines {
line := string(line)
p := strings.Split(line, ":")
if len(p) < 2 || p[0] != user {
buf.WriteString(line)
buf.WriteByte('\n')
continue
}
p[1] = passwordHash
line = strings.Join(p, ":")
buf.WriteString(line)
buf.WriteByte('\n')
}
err = os.WriteFile(fpath, buf.Bytes(), 0600)
if err != nil {
fatalf("failed to write shadow: %v", err)
}
}
func setAuthorizedKeys(ak []string) {
buf := new(bytes.Buffer)
for _, k := range ak {
buf.WriteString(k)
buf.WriteByte('\n')
}
const sshDir = "/system/root/.ssh"
err := os.MkdirAll(sshDir, 0700)
if err != nil {
fatalf("failed to create %s: %v", sshDir, err)
}
err = os.WriteFile(filepath.Join(sshDir, "authorized_keys"), buf.Bytes(), 0600)
if err != nil {
fatalf("failed to write authorized keys: %v", err)
}
}

View File

@ -1,14 +1,6 @@
#! /bin/sh #! /bin/sh
set -ex set -ex
mkdir dev
mknod dev/null -m 0666 c 1 3 mknod dev/null -m 0666 c 1 3
mknod dev/tty -m 0666 c 5 0 mknod dev/tty -m 0666 c 5 0
mknod dev/console -m 0600 c 5 1 mknod dev/console -m 0600 c 5 1
mkdir sys proc bin sbin usr usr/bin usr/sbin
curl -L -o bin/busybox https://busybox.net/downloads/binaries/$busybox_v/busybox-$arch
chmod +x bin/busybox
chroot . /bin/busybox --install -s

45
colorio/colorio.go Normal file
View File

@ -0,0 +1,45 @@
package colorio
import "io"
var (
Reset = []byte("\033[0m")
Bold = []byte("\033[1m")
Dim = []byte("\033[2m")
Underlined = []byte("\033[4m")
Blink = []byte("\033[5m")
Reverse = []byte("\033[7m")
Hidden = []byte("\033[8m")
)
type writer struct {
before []byte
after []byte
w io.Writer
}
func NewWriter(color []byte, w io.Writer) io.Writer {
return writer{
before: color,
after: Reset,
w: w,
}
}
func (w writer) Write(ba []byte) (n int, err error) {
b := make([]byte, len(w.before)+len(ba)+len(w.after))
copy(b, w.before)
copy(b[len(w.before):], ba)
copy(b[len(w.before)+len(ba):], w.after)
n, err = w.w.Write(b)
n -= len(w.before)
if n < 0 {
n = 0
} else if n > len(ba) {
n = len(ba)
}
return
}

21
colorio/colorio_test.go Normal file
View File

@ -0,0 +1,21 @@
package colorio
import (
"bytes"
"fmt"
"testing"
)
func TestWriter(t *testing.T) {
buf := new(bytes.Buffer)
w := NewWriter(Bold, buf)
buf.WriteByte('{')
fmt.Fprintln(w, "hello")
buf.WriteByte('}')
if s, exp := buf.String(), "{"+string(Bold)+"hello\n"+string(Reset)+"}"; s != exp {
t.Errorf("%q != %q", s, exp)
}
}

View File

@ -1,10 +1,7 @@
package main package main
import ( import (
nconfig "novit.nc/direktil/pkg/config" nconfig "novit.tech/direktil/pkg/config"
) )
type config struct { type configV1 = nconfig.Config
Layers []string `yaml:"layers"`
Files []nconfig.FileDef `yaml:"files"`
}

22
filter.go Normal file
View File

@ -0,0 +1,22 @@
package main
func filter[T any](values []T, accept func(T) bool) []T {
r := make([]T, 0, len(values))
for _, v := range values {
if accept(v) {
r = append(r, v)
}
}
return r
}
func contains[T any](values []T, accept func(T) bool) bool {
for _, v := range values {
if accept(v) {
return true
}
}
return false
}

13
filter_test.go Normal file
View File

@ -0,0 +1,13 @@
package main
import (
"fmt"
"testing"
)
func TestFilter(t*testing.T) {
a := filter([]string{"a","b","c"}, func(v string) bool { return v != "b" })
if fmt.Sprint(a) != "[a c]" {
t.Errorf("bad result: %v", a)
}
}

37
go.mod
View File

@ -1,10 +1,35 @@
module novit.nc/direktil/initrd module novit.tech/direktil/initrd
require ( require (
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 // indirect github.com/creack/pty v1.1.24
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221 github.com/freddierice/go-losetup/v2 v2.0.1
gopkg.in/yaml.v2 v2.3.0 github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b
novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2 github.com/pkg/term v1.1.0
github.com/rs/zerolog v1.34.0
golang.org/x/crypto v0.38.0
golang.org/x/sys v0.33.0
golang.org/x/term v0.32.0
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
gopkg.in/yaml.v2 v2.4.0
gopkg.in/yaml.v3 v3.0.1
novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6
) )
go 1.13 require (
github.com/cavaliergopher/cpio v1.0.1 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 // indirect
github.com/josharian/native v1.1.0 // indirect
github.com/mattn/go-colorable v0.1.14 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/mdlayher/genetlink v1.3.2 // indirect
github.com/mdlayher/netlink v1.7.2 // indirect
github.com/mdlayher/socket v0.5.1 // indirect
golang.org/x/net v0.40.0 // indirect
golang.org/x/sync v0.14.0 // indirect
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb // indirect
)
go 1.23.1
toolchain go1.24.3

121
go.sum
View File

@ -1,21 +1,104 @@
github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= github.com/cavaliergopher/cpio v1.0.1 h1:KQFSeKmZhv0cr+kawA3a0xTQCU4QxXF1vhU7P7av2KM=
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/cavaliergopher/cpio v1.0.1/go.mod h1:pBdaqQjnvXxdS/6CvNDwIANIFSP0xRKI16PX4xejRQc=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8= github.com/freddierice/go-losetup/v2 v2.0.1 h1:wPDx/Elu9nDV8y/CvIbEDz5Xi5Zo80y4h7MKbi3XaAI=
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4= github.com/freddierice/go-losetup/v2 v2.0.1/go.mod h1:TEyBrvlOelsPEhfWD5rutNXDmUszBXuFnwT1kIQF4J8=
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1 h1:smvLGU3obGU5kny71BtE/ibR0wIXRUiRFDmSn0Nxz1E=
github.com/jkeiser/iter v0.0.0-20200628201005-c8aa0ae784d1/go.mod h1:fP/NdyhRVOv09PLRbVXrSqHhrfQypdZwgE2L4h2U5C8=
github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b h1:Pzf7tldbCVqwl3NnOnTamEWdh/rL41fsoYCn2HdHgRA=
github.com/jochenvg/go-udev v0.0.0-20240801134859-b65ed646224b/go.mod h1:IBDUGq30U56w969YNPomhMbRje1GrhUsCh7tHdwgLXA=
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221 h1:/ZHdbVpdR/jk3g30/d4yUL0JU9kksj8+F/bnQUVLGDM= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU= novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6 h1:D0TN5GyZ4d88ILpgVZgcZ62027lW8/LLnQSpQyN2yOw=
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= novit.tech/direktil/pkg v0.0.0-20240415130406-0d2e181a4ed6/go.mod h1:zjezU6tELE880oYHs/WAauGBupKIEQQ7KqWTB69RW10=
novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2 h1:LN3K19gAJ1GamJXkzXAQmjbl8xCV7utqdxTTrM89MMc=
novit.nc/direktil/pkg v0.0.0-20191211161950-96b0448b84c2/go.mod h1:zwTVO6U0tXFEaga73megQIBK7yVIKZJVePaIh/UtdfU=

26
losetup.go Normal file
View File

@ -0,0 +1,26 @@
package main
import (
"syscall"
"github.com/freddierice/go-losetup/v2"
)
var loDevices = map[string]losetup.Device{}
func losetupAttach(file string) losetup.Device {
if _, ok := loDevices[file]; !ok {
dev, err := losetup.Attach(file, 0, true)
if err != nil {
fatalf("failed to attach %q to a loop device: %v", file, err)
}
loDevices[file] = dev
}
return loDevices[file]
}
func mountSquahfs(source, target string) {
dev := losetupAttach(source)
mount(dev.Path(), target, "squashfs", syscall.MS_RDONLY, "")
}

410
lvm.go Normal file
View File

@ -0,0 +1,410 @@
package main
import (
"bytes"
"io/fs"
"os"
"os/exec"
"path/filepath"
"sort"
"strconv"
"syscall"
udev "github.com/jochenvg/go-udev"
"github.com/rs/zerolog/log"
config "novit.tech/direktil/pkg/bootstrapconfig"
"novit.tech/direktil/initrd/lvm"
)
func sortedKeys[T any](m map[string]T) (keys []string) {
keys = make([]string, 0, len(m))
for k := range m {
keys = append(keys, k)
}
sort.Strings(keys)
return
}
func setupLVM(cfg *config.Config) {
if len(cfg.LVM) == 0 {
log.Info().Msg("no LVM VG configured.")
return
}
// [dev] = filesystem
// eg: [/dev/sda1] = ext4
createdDevs := map[string]string{}
run("pvscan")
run("vgscan", "--mknodes")
for _, vg := range cfg.LVM {
setupVG(vg)
}
for _, vg := range cfg.LVM {
setupLVs(vg, createdDevs)
}
run("vgchange", "--sysinit", "-a", "ly")
setupCrypt(cfg.Crypt, createdDevs)
devs := make([]string, 0, len(createdDevs))
for k := range createdDevs {
devs = append(devs, k)
}
sort.Strings(devs)
for _, dev := range devs {
setupFS(dev, createdDevs[dev])
}
}
func setupVG(vg config.LvmVG) {
pvs := lvm.PVSReport{}
err := runJSON(&pvs, "pvs", "--reportformat", "json")
if err != nil {
fatalf("failed to list LVM PVs: %v", err)
}
vgExists := false
devNeeded := vg.PVs.N
for _, pv := range pvs.PVs() {
if pv.VGName == vg.VG {
vgExists = true
devNeeded--
}
}
log := log.With().Str("vg", vg.VG).Logger()
if devNeeded <= 0 {
log.Info().Msg("LVM VG has all its devices")
return
}
if vgExists {
log.Info().Msgf("LVM VG misses %d devices", devNeeded)
} else {
log.Info().Msg("LVM VG does not exists, creating")
}
devNames := make([]NameAliases, 0)
{
devRefs := map[uint64]*NameAliases{}
enum := new(udev.Udev).NewEnumerate()
enum.AddMatchSubsystem("block")
devs, err := enum.Devices()
if err != nil {
fatal("udev enumeration failed")
}
for _, dev := range devs {
num := dev.Devnum()
n := dev.PropertyValue("DEVNAME")
idx := len(devNames)
devNames = append(devNames, nameAlias(n))
ref := uint64(num.Major())<<8 | uint64(num.Minor())
devRefs[ref] = &devNames[idx]
}
err = filepath.Walk("/dev", func(n string, fi fs.FileInfo, err error) error {
if fi.Mode().Type() == os.ModeDevice {
stat := fi.Sys().(*syscall.Stat_t)
ref := stat.Rdev
if na := devRefs[ref]; na != nil {
na.AddAlias(n)
}
}
return err
})
if err != nil {
fatalf("failed to walk /dev: %v", err)
}
}
for _, dev := range devNames {
log.Info().Str("name", dev.Name).Any("aliases", dev.Aliases).Msg("found block device")
}
m := regexpSelectN(vg.PVs.N, vg.PVs.Regexps, devNames)
if len(m) == 0 {
log.Error().Strs("regexps", vg.PVs.Regexps).Msg("no device match the regexps")
fatalf("failed to setup VG %s", vg.VG)
}
if vgExists {
log.Info().Strs("devices", m).Msg("LVM VG: extending")
run("vgextend", append([]string{vg.VG}, m...)...)
devNeeded -= len(m)
} else {
log.Info().Strs("devices", m).Msg("LVM VG: creating")
run("vgcreate", append([]string{vg.VG}, m...)...)
devNeeded -= len(m)
}
if devNeeded > 0 {
fatalf("VG %s does not have enough devices (%d missing)", vg.VG, devNeeded)
}
}
func setupLVs(vg config.LvmVG, createdDevs map[string]string) {
lvsRep := lvm.LVSReport{}
err := runJSON(&lvsRep, "lvs", "--reportformat", "json")
if err != nil {
fatalf("lvs failed: %v", err)
}
lvs := lvsRep.LVs()
defaults := vg.Defaults
for idx, lv := range vg.LVs {
log := log.With().Str("vg", vg.VG).Str("lv", lv.Name).Logger()
if contains(lvs, func(v lvm.LV) bool {
return v.VGName == vg.VG && v.Name == lv.Name
}) {
log.Info().Msg("LV exists")
continue
}
log.Info().Msg("LV does not exist")
if lv.Raid == nil {
lv.Raid = defaults.Raid
}
args := make([]string, 0)
if lv.Name == "" {
fatalf("LV[%d] has no name", idx)
}
args = append(args, vg.VG, "--name", lv.Name)
if lv.Size != "" && lv.Extents != "" {
fatalf("LV has both size and extents defined!")
} else if lv.Size == "" && lv.Extents == "" {
fatalf("LV does not have size or extents defined!")
} else if lv.Size != "" {
args = append(args, "-L", lv.Size)
} else /* if lv.Extents != "" */ {
args = append(args, "-l", lv.Extents)
}
if raid := lv.Raid; raid != nil {
if raid.Mirrors != 0 {
args = append(args, "--mirrors", strconv.Itoa(raid.Mirrors))
}
if raid.Stripes != 0 {
args = append(args, "--stripes", strconv.Itoa(raid.Stripes))
}
}
log.Info().Strs("args", args).Msg("LV: creating")
run("lvcreate", args...)
dev := "/dev/" + vg.VG + "/" + lv.Name
zeroDevStart(dev)
fs := lv.FS
if fs == "" {
fs = vg.Defaults.FS
}
createdDevs[dev] = fs
}
}
func zeroDevStart(dev string) {
f, err := os.OpenFile(dev, os.O_WRONLY, 0600)
if err != nil {
fatalf("failed to open %s: %v", dev, err)
}
defer f.Close()
_, err = f.Write(make([]byte, 8192))
if err != nil {
fatalf("failed to zero the beginning of %s: %v", dev, err)
}
}
var cryptDevs = map[string]bool{}
func setupCrypt(devSpecs []config.CryptDev, createdDevs map[string]string) {
var password []byte
passwordVerified := false
// flat, expanded devices to open
devNames := make([]config.CryptDev, 0, len(devSpecs))
for _, devSpec := range devSpecs {
if devSpec.Dev == "" && devSpec.Prefix == "" {
fatalf("crypt: name %q: no dev or match set", devSpec.Name)
}
if devSpec.Dev != "" && devSpec.Prefix != "" {
fatalf("crypt: name %q: both dev (%q) and match (%q) are set", devSpec.Name, devSpec.Dev, devSpec.Prefix)
}
if devSpec.Dev != "" {
// already flat
devNames = append(devNames, devSpec)
continue
}
matches, err := filepath.Glob(devSpec.Prefix + "*")
if err != nil {
fatalf("failed to search for device matches: %v", err)
}
for _, m := range matches {
suffix := m[len(devSpec.Prefix):]
devNames = append(devNames, config.CryptDev{Dev: m, Name: devSpec.Name + suffix})
}
}
for _, devName := range devNames {
name, dev := devName.Name, devName.Dev
if name == "" {
name = filepath.Base(dev)
}
if cryptDevs[name] {
fatalf("duplicate crypt device name: %s", name)
}
cryptDevs[name] = true
retryOpen:
if len(password) == 0 {
password = askSecret("crypt password")
if len(password) == 0 {
fatalf("empty password given")
}
}
fs := createdDevs[dev]
delete(createdDevs, dev)
tgtDev := "/dev/mapper/" + name
needFormat := !devInitialized(dev)
if needFormat {
if !passwordVerified {
retry:
p2 := askSecret("verify crypt password")
eq := bytes.Equal(password, p2)
for i := range p2 {
p2[i] = 0
}
if !eq {
log.Error().Msg("passwords don't match")
goto retry
}
}
log.Info().Str("dev", dev).Msg("formatting encrypted device")
cmd := exec.Command("cryptsetup", "luksFormat", dev, "--key-file=-")
cmd.Stdin = bytes.NewBuffer(password)
cmd.Stdout = stdout
cmd.Stderr = stderr
err := cmd.Run()
if err != nil {
fatalf("failed luksFormat: %v", err)
}
createdDevs[tgtDev] = fs
}
if len(password) == 0 {
password = askSecret("crypt password")
if len(password) == 0 {
fatalf("empty password given")
}
}
log.Info().Str("name", name).Str("dev", dev).Msg("openning encrypted device")
cmd := exec.Command("cryptsetup", "open", dev, name, "--key-file=-")
cmd.Stdin = bytes.NewBuffer(password)
cmd.Stdout = stdout
cmd.Stderr = stderr
err := cmd.Run()
if err != nil {
// maybe the password is wrong
for i := range password {
password[i] = 0
}
password = password[:0]
passwordVerified = false
goto retryOpen
}
if needFormat {
zeroDevStart(tgtDev)
}
passwordVerified = true
}
for i := range password {
password[i] = 0
}
}
func devInitialized(dev string) bool {
f, err := os.Open(dev)
if err != nil {
fatalf("failed to open %s: %v", dev, err)
}
defer f.Close()
ba := make([]byte, 8192)
_, err = f.Read(ba)
if err != nil {
fatalf("failed to read %s: %v", dev, err)
}
for _, b := range ba {
if b != 0 {
return true
}
}
return false
}
func setupFS(dev, fs string) {
if devInitialized(dev) {
log.Info().Str("dev", dev).Msg("device already formatted")
return
}
if fs == "" {
fs = "ext4"
}
log.Info().Str("dev", dev).Str("fs", fs).Msg("formatting device")
args := make([]string, 0)
switch fs {
case "btrfs":
args = append(args, "-f")
case "ext4":
args = append(args, "-F")
}
run("mkfs."+fs, append(args, dev)...)
}

19
lvm/lv.go Normal file
View File

@ -0,0 +1,19 @@
package lvm
type LVSReport struct {
Report []struct {
LV []LV `json:"lv"`
} `json:"report"`
}
type LV struct {
Name string `json:"lv_name"`
VGName string `json:"vg_name"`
}
func (r LVSReport) LVs() (ret []LV) {
for _, rep := range r.Report {
ret = append(ret, rep.LV...)
}
return
}

19
lvm/pv.go Normal file
View File

@ -0,0 +1,19 @@
package lvm
type PVSReport struct {
Report []struct {
PV []PV `json:"pv"`
} `json:"report"`
}
type PV struct {
Name string `json:"pv_name"`
VGName string `json:"vg_name"`
}
func (r PVSReport) PVs() (ret []PV) {
for _, rep := range r.Report {
ret = append(ret, rep.PV...)
}
return
}

276
main.go
View File

@ -3,24 +3,25 @@ package main
import ( import (
"fmt" "fmt"
"io" "io"
"io/ioutil"
"log"
"os" "os"
"os/exec" "os/exec"
"path/filepath" "path/filepath"
"runtime" "runtime"
"strings"
"syscall" "syscall"
"time" "time"
"github.com/pkg/term/termios"
"github.com/rs/zerolog"
"github.com/rs/zerolog/log"
"golang.org/x/term" "golang.org/x/term"
yaml "gopkg.in/yaml.v2"
"novit.nc/direktil/pkg/sysfs" "novit.tech/direktil/initrd/colorio"
"novit.tech/direktil/initrd/shio"
) )
const ( const (
// VERSION is the current version of init // VERSION is the current version of init
VERSION = "Direktil init v1.0" VERSION = "Direktil init v2.0"
rootMountFlags = 0 rootMountFlags = 0
bootMountFlags = syscall.MS_NOEXEC | syscall.MS_NODEV | syscall.MS_NOSUID | syscall.MS_RDONLY bootMountFlags = syscall.MS_NOEXEC | syscall.MS_NODEV | syscall.MS_NOSUID | syscall.MS_RDONLY
@ -29,197 +30,170 @@ const (
var ( var (
bootVersion string bootVersion string
stdin,
stdinPipe = newPipe()
stdout = shio.New()
stderr = colorio.NewWriter(colorio.Bold, stdout)
) )
func newPipe() (io.ReadCloser, io.WriteCloser) {
return io.Pipe()
}
func main() { func main() {
log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
registerInput(newTTY(os.Stdin.Fd()))
switch baseName := filepath.Base(os.Args[0]); baseName {
case "init":
runInit()
default:
log.Fatal().Msgf("unknown sub-command: %q", baseName)
}
}
func runInit() {
if len(os.Args) > 1 && os.Args[1] == "hello" {
fmt.Println("hello world!")
os.Exit(0)
}
runtime.LockOSThread() runtime.LockOSThread()
log.Print("Welcome to ", VERSION) // move log to shio
go io.Copy(os.Stdout, stdout.NewReader())
log.Logger = log.Output(zerolog.ConsoleWriter{Out: stderr})
// check the PID is 1
if pid := os.Getpid(); pid != 1 {
log.Fatal().Int("pid", pid).Msg("init must be PID 1")
}
// copy os.Stdin to my stdin pipe
go io.Copy(stdinPipe, os.Stdin)
log.Info().Msg("Welcome to " + VERSION)
// essential mounts // essential mounts
mount("none", "/proc", "proc", 0, "") mount("none", "/proc", "proc", 0, "")
mount("none", "/sys", "sysfs", 0, "") mount("none", "/sys", "sysfs", 0, "")
mount("none", "/dev", "devtmpfs", 0, "") mount("none", "/dev", "devtmpfs", 0, "")
mount("none", "/dev/pts", "devpts", 0, "gid=5,mode=620")
// get the "boot version" // get the "boot version"
bootVersion = param("version", "current") bootVersion = param("version", "current")
log.Printf("booting system %q", bootVersion) log.Info().Msgf("booting system %q", bootVersion)
// find and mount /boot os.Setenv("PATH", "/usr/bin:/bin:/usr/sbin:/sbin")
bootMatch := param("boot", "")
bootMounted := false
if bootMatch != "" {
bootFS := param("boot.fs", "vfat")
for i := 0; ; i++ {
devNames := sysfs.DeviceByProperty("block", bootMatch)
if len(devNames) == 0 { _, err := os.Stat("/config.yaml")
if i > 30 {
fatal("boot partition not found after 30s")
}
log.Print("boot partition not found, retrying")
time.Sleep(1 * time.Second)
continue
}
devFile := filepath.Join("/dev", devNames[0])
log.Print("boot partition found: ", devFile)
mount(devFile, "/boot", bootFS, bootMountFlags, "")
bootMounted = true
break
}
} else {
log.Print("Assuming /boot is already populated.")
}
// load config
cfgPath := param("config", "/boot/config.yaml")
cfgBytes, err := ioutil.ReadFile(cfgPath)
if err != nil { if err != nil {
fatalf("failed to read %s: %v", cfgPath, err) log.Error().Err(err).Msg("config not found")
fatal()
} }
cfg := &config{} bootV2()
if err := yaml.Unmarshal(cfgBytes, cfg); err != nil {
fatal("failed to load config: ", err)
}
// mount layers
if len(cfg.Layers) == 0 {
fatal("no layers configured!")
}
log.Printf("wanted layers: %q", cfg.Layers)
layersInMemory := paramBool("layers-in-mem", false)
const layersInMemDir = "/layers-in-mem"
if layersInMemory {
mkdir(layersInMemDir, 0700)
mount("layers-mem", layersInMemDir, "tmpfs", 0, "")
}
lowers := make([]string, len(cfg.Layers))
for i, layer := range cfg.Layers {
path := layerPath(layer)
info, err := os.Stat(path)
if err != nil {
fatal(err)
}
log.Printf("layer %s found (%d bytes)", layer, info.Size())
if layersInMemory {
log.Print(" copying to memory...")
targetPath := filepath.Join(layersInMemDir, layer)
cp(path, targetPath)
path = targetPath
}
dir := "/layers/" + layer
lowers[i] = dir
loopDev := fmt.Sprintf("/dev/loop%d", i)
losetup(loopDev, path)
mount(loopDev, dir, "squashfs", layerMountFlags, "")
}
// prepare system root
mount("mem", "/changes", "tmpfs", 0, "")
mkdir("/changes/workdir", 0755)
mkdir("/changes/upperdir", 0755)
mount("overlay", "/system", "overlay", rootMountFlags,
"lowerdir="+strings.Join(lowers, ":")+",upperdir=/changes/upperdir,workdir=/changes/workdir")
if bootMounted {
if layersInMemory {
if err := syscall.Unmount("/boot", 0); err != nil {
log.Print("WARNING: failed to unmount /boot: ", err)
time.Sleep(2 * time.Second)
}
} else {
mount("/boot", "/system/boot", "", syscall.MS_BIND, "")
}
}
// - write configuration
log.Print("writing /config.yaml")
if err := ioutil.WriteFile("/system/config.yaml", cfgBytes, 0600); err != nil {
fatal("failed: ", err)
}
// - write files
for _, fileDef := range cfg.Files {
log.Print("writing ", fileDef.Path)
filePath := filepath.Join("/system", fileDef.Path)
ioutil.WriteFile(filePath, []byte(fileDef.Content), fileDef.Mode)
}
// clean zombies
cleanZombies()
// switch root
log.Print("switching root")
err = syscall.Exec("/sbin/switch_root", []string{"switch_root",
"-c", "/dev/console", "/system", "/sbin/init"}, os.Environ())
fatal("switch_root failed: ", err)
} }
var (
layersDir = "/boot/current/layers/"
layersOverride = map[string]string{}
)
func layerPath(name string) string { func layerPath(name string) string {
return fmt.Sprintf("/boot/%s/layers/%s.fs", bootVersion, name) if override, ok := layersOverride[name]; ok {
return override
}
return filepath.Join(layersDir, name+".fs")
} }
func fatal(v ...interface{}) { func fatal(v ...interface{}) {
log.Print("*** FATAL ***") log.Error().Msg("*** FATAL ***")
log.Print(v...) log.Error().Msg(fmt.Sprint(v...))
die() die()
} }
func fatalf(pattern string, v ...interface{}) { func fatalf(pattern string, v ...interface{}) {
log.Print("*** FATAL ***") log.Error().Msg("*** FATAL ***")
log.Printf(pattern, v...) log.Error().Msgf(pattern, v...)
die() die()
} }
func die() { func die() {
fmt.Println("\nwill reboot in 1 minute; press r to reboot now, o to power off") log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
deadline := time.Now().Add(time.Minute) stdout.Close()
stdin.Close()
stdinPipe.Close()
term.MakeRaw(int(os.Stdin.Fd())) // disable line buffering stdin = nil
os.Stdin.SetReadDeadline(deadline)
b := []byte{0} mainLoop:
for { for {
termios.Tcdrain(os.Stdin.Fd())
termios.Tcdrain(os.Stdout.Fd())
termios.Tcdrain(os.Stderr.Fd())
fmt.Print("\nr to reboot, o to power off, s to get a shell: ")
// TODO flush stdin (first char lost here?)
deadline := time.Now().Add(time.Minute)
os.Stdin.SetReadDeadline(deadline)
term.MakeRaw(int(os.Stdin.Fd()))
termios.Tcflush(os.Stdin.Fd(), termios.TCIFLUSH)
b := make([]byte, 1)
_, err := os.Stdin.Read(b) _, err := os.Stdin.Read(b)
if err != nil { if err != nil {
break log.Error().Err(err).Msg("failed to read from stdin")
time.Sleep(5 * time.Second)
syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
} }
fmt.Println()
switch b[0] { switch b[0] {
case 'o': case 'o':
run("sync")
syscall.Reboot(syscall.LINUX_REBOOT_CMD_POWER_OFF) syscall.Reboot(syscall.LINUX_REBOOT_CMD_POWER_OFF)
case 'r': case 'r':
run("sync")
syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART) syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
case 's':
for _, sh := range []string{"bash", "ash", "sh", "busybox"} {
fullPath, err := exec.LookPath(sh)
if err != nil {
continue
}
args := make([]string, 0)
if sh == "busybox" {
args = append(args, "sh")
}
if !localAuth() {
continue mainLoop
}
cmd := exec.Command(fullPath, args...)
cmd.Env = os.Environ()
cmd.Stdin = os.Stdin
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
err = cmd.Run()
if err != nil {
fmt.Println("shell failed:", err)
}
continue mainLoop
}
log.Error().Msg("failed to find a shell!")
default:
log.Error().Msgf("unknown choice: %q", string(b))
} }
} }
syscall.Reboot(syscall.LINUX_REBOOT_CMD_RESTART)
}
func losetup(dev, file string) {
run("/sbin/losetup", dev, file)
} }
func run(cmd string, args ...string) { func run(cmd string, args ...string) {
@ -242,7 +216,7 @@ func mount(source, target, fstype string, flags uintptr, data string) {
if err := syscall.Mount(source, target, fstype, flags, data); err != nil { if err := syscall.Mount(source, target, fstype, flags, data); err != nil {
fatalf("mount %q %q -t %q -o %q failed: %v", source, target, fstype, data, err) fatalf("mount %q %q -t %q -o %q failed: %v", source, target, fstype, data, err)
} }
log.Printf("mounted %q", target) log.Info().Str("target", target).Msg("mounted")
} }
func cp(srcPath, dstPath string) { func cp(srcPath, dstPath string) {

View File

@ -1,6 +1,14 @@
go.??? *.go { modd.conf {}
go.??? **/*.go {
prep: go test ./... prep: go test ./...
prep: dockb -t dkl-initrd . prep: mkdir -p dist
prep: docker run dkl-initrd | docker exec -i dls sh -c "base64 -d >/var/lib/direktil/dist/initrd/1.0.7 && rm -rfv /var/lib/direktil/cache/*" prep: go build -o dist/init .
prep: curl -H'Autorization: Bearer adm1n' localhost:7606/hosts/m1/boot.iso >/tmp/m1-boot.iso prep: go build -o dist/ ./tools/...
}
dist/init Dockerfile {
prep: docker build -t novit-initrd-gen .
prep: docker run novit-initrd-gen |base64 -d >dist/initrd.new
prep: mv dist/initrd.new dist/initrd
} }

10
modd.test.conf Normal file
View File

@ -0,0 +1,10 @@
modd.test.conf {}
dist/initrd dist/cpiocat dist/testconf test-initrd/**/* {
prep: dist/testconf test-initrd/config.yaml
prep: cp -f dist/initrd test-initrd.cpio
prep: cd test-initrd && cat ../dist/initrd | ../dist/cpiocat * |lz4 -l9v >../test-initrd.cpio.new
prep: mv test-initrd.cpio.new test-initrd.cpio
prep: if lz4cat test-initrd.cpio | cpio -t 2>&1 |grep bytes.of.junk; then echo "bad cpio archive"; exit 1; fi
prep: kill $(<qemu.pid)
}

87
network.go Normal file
View File

@ -0,0 +1,87 @@
package main
import (
"os/exec"
"strings"
udev "github.com/jochenvg/go-udev"
"github.com/rs/zerolog/log"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func setupNetworks(cfg *config.Config) {
if len(cfg.Networks) == 0 {
log.Info().Msg("no networks configured.")
return
}
type Iface struct {
Name string
AliasOf string
}
ifaces := make([]NameAliases, 0)
{
enum := new(udev.Udev).NewEnumerate()
enum.AddMatchSubsystem("net")
devs, err := enum.Devices()
if err != nil {
fatal("udev enumeration failed")
}
for _, dev := range devs {
iface := nameAliases(dev.Sysname(),
dev.PropertyValue("INTERFACE"),
dev.PropertyValue("ID_NET_NAME"),
dev.PropertyValue("ID_NET_NAME_PATH"),
dev.PropertyValue("ID_NET_NAME_MAC"),
dev.PropertyValue("ID_NET_NAME_SLOT"),
)
log.Info().Str("name", iface.Name).Any("aliases", iface.Aliases).Msg("found network device")
ifaces = append(ifaces, iface)
}
}
assigned := map[string]bool{}
for _, network := range cfg.Networks {
log := log.With().Str("network", network.Name).Logger()
log.Info().Msg("setting up network")
unassigned := filter(ifaces, func(iface NameAliases) bool {
return !assigned[iface.Name]
})
// assign envvars
envvars := make([]string, 0, 1+len(network.Interfaces))
envvars = append(envvars, "PATH=/bin:/sbin:/usr/bin:/usr/sbin")
for _, match := range network.Interfaces {
envvar := new(strings.Builder)
envvar.WriteString(match.Var)
envvar.WriteByte('=')
for i, m := range regexpSelectN(match.N, match.Regexps, unassigned) {
assigned[m] = true
if i != 0 {
envvar.WriteByte(' ')
}
envvar.WriteString(m)
}
envvars = append(envvars, envvar.String())
}
log.Info().Strs("env", envvars).Msg("running script")
cmd := exec.Command("/bin/sh", "-c", network.Script)
cmd.Env = envvars
cmd.Stdout = stdout
cmd.Stderr = stderr
if err := cmd.Run(); err != nil {
fatal("failed to setup network: ", err)
}
}
}

View File

@ -1,12 +1,12 @@
package main package main
import ( import (
"io/ioutil" "os"
"strings" "strings"
) )
func param(name, defaultValue string) (value string) { func param(name, defaultValue string) (value string) {
ba, err := ioutil.ReadFile("/proc/cmdline") ba, err := os.ReadFile("/proc/cmdline")
if err != nil { if err != nil {
fatal("could not read /proc/cmdline: ", err) fatal("could not read /proc/cmdline: ", err)
} }

65
regexp.go Normal file
View File

@ -0,0 +1,65 @@
package main
import (
"regexp"
"github.com/rs/zerolog/log"
)
type NameAliases struct {
Name string
Aliases []string
}
func nameAlias(name string) NameAliases {
return NameAliases{Name: name, Aliases: []string{name}}
}
func nameAliases(name string, aliases ...string) NameAliases {
na := NameAliases{Name: name, Aliases: make([]string, 0, len(aliases)+1)}
na.Aliases = append(na.Aliases, name)
for _, alias := range aliases {
na.AddAlias(alias)
}
return na
}
func (na *NameAliases) AddAlias(alias string) {
if alias == "" {
return
}
if contains(na.Aliases, func(s string) bool { return s == alias }) {
return
}
na.Aliases = append(na.Aliases, alias)
}
func regexpSelectN(n int, regexps []string, nameAliases []NameAliases) (matches []string) {
matches = make([]string, 0)
res := make([]*regexp.Regexp, 0, len(regexps))
for _, reStr := range regexps {
re, err := regexp.Compile(reStr)
if err != nil {
log.Warn().Err(err).Str("regexp", reStr).Msg("invalid regexp, ignored")
continue
}
res = append(res, re)
}
nameAliasesLoop:
for _, item := range nameAliases {
if len(matches) == n {
break
}
for _, re := range res {
for _, alias := range item.Aliases {
if re.MatchString(alias) {
matches = append(matches, item.Name)
continue nameAliasesLoop
}
}
}
}
return
}

19
run-test.sh Executable file
View File

@ -0,0 +1,19 @@
#! /bin/sh
disk1=tmp/test-vda.qcow2
disk2=tmp/test-vdb.qcow2
if ! [ -e $disk1 ]; then
qemu-img create -f qcow2 $disk1 10G
fi
if ! [ -e $disk2 ]; then
qemu-img create -f qcow2 $disk2 10G
fi
exec qemu-system-x86_64 -pidfile qemu.pid -kernel test-kernel -initrd test-initrd.cpio \
-smp 2 -m 2048 \
-netdev bridge,br=novit,id=eth0 -device virtio-net-pci,netdev=eth0 \
-drive file=$disk1,if=virtio \
-drive file=$disk2,if=virtio \
-nographic -serial mon:stdio -append 'console=ttyS0'
# -display curses

18
run.go Normal file
View File

@ -0,0 +1,18 @@
package main
import (
"encoding/json"
"os/exec"
)
func runJSON(v interface{}, cmd string, args ...string) (err error) {
c := exec.Command(cmd, args...)
c.Stderr = stderr
ba, err := c.Output()
if err != nil {
return
}
err = json.Unmarshal(ba, v)
return
}

118
shio/shio.go Normal file
View File

@ -0,0 +1,118 @@
// Shared IO
package shio
import (
"io"
"sync"
"novit.tech/direktil/initrd/colorio"
)
type ShIO struct {
buf []byte
closed bool
cond *sync.Cond
hideInput bool
}
func New() *ShIO {
return NewWithCap(1024)
}
func NewWithCap(capacity int) *ShIO {
return NewWithBytes(make([]byte, 0, capacity))
}
func NewWithBytes(content []byte) *ShIO {
return &ShIO{
buf: content,
cond: sync.NewCond(&sync.Mutex{}),
}
}
var (
_ io.WriteCloser = New()
)
func (s *ShIO) Write(data []byte) (n int, err error) {
s.cond.L.Lock()
defer s.cond.L.Unlock()
if s.closed {
err = io.EOF
return
}
if s.hideInput {
s.buf = append(s.buf, colorio.Reset...)
}
s.buf = append(s.buf, data...)
n = len(data)
if s.hideInput {
s.buf = append(s.buf, colorio.Hidden...)
}
s.cond.Broadcast()
return
}
func (s *ShIO) HideInput() {
s.cond.L.Lock()
defer s.cond.L.Unlock()
if s.closed {
return
}
s.buf = append(s.buf, colorio.Hidden...)
s.hideInput = true
}
func (s *ShIO) ShowInput() {
s.cond.L.Lock()
defer s.cond.L.Unlock()
if s.closed {
return
}
s.buf = append(s.buf, colorio.Reset...)
s.hideInput = false
}
func (s *ShIO) Close() (err error) {
s.cond.L.Lock()
defer s.cond.L.Unlock()
s.closed = true
s.cond.Broadcast()
return
}
func (s *ShIO) NewReader() io.Reader {
return &shioReader{s, 0}
}
type shioReader struct {
in *ShIO
pos int
}
func (r *shioReader) Read(ba []byte) (n int, err error) {
r.in.cond.L.Lock()
defer r.in.cond.L.Unlock()
for r.pos == len(r.in.buf) && !r.in.closed {
r.in.cond.Wait()
}
if r.pos == len(r.in.buf) && r.in.closed {
err = io.EOF
return
}
n = copy(ba, r.in.buf[r.pos:])
r.pos += n
return
}

52
shio/shio_test.go Normal file
View File

@ -0,0 +1,52 @@
package shio
import (
"fmt"
"io"
"os"
"sync"
"time"
)
func Example_output() {
done := false
defer func() { done = true }()
go func() {
time.Sleep(time.Second)
if !done {
panic("timeout")
}
}()
shio := NewWithCap(3)
r1 := shio.NewReader()
// read as you write
wg := new(sync.WaitGroup)
wg.Add(1)
go func() {
defer wg.Done()
io.Copy(os.Stdout, r1)
fmt.Println("-- r1 done --")
}()
fmt.Fprintln(shio, "hello1")
fmt.Fprintln(shio, "hello2")
shio.Close()
wg.Wait()
// read after close
r2 := shio.NewReader()
io.Copy(os.Stdout, r2)
fmt.Println("-- r2 done --")
// Output:
// hello1
// hello2
// -- r1 done --
// hello1
// hello2
// -- r2 done --
}

281
ssh.go Normal file
View File

@ -0,0 +1,281 @@
package main
import (
"encoding/binary"
"fmt"
"io"
"net"
"os"
"os/exec"
"sync"
"syscall"
"time"
"unsafe"
"github.com/creack/pty"
"github.com/rs/zerolog/log"
"golang.org/x/crypto/ssh"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func startSSH(cfg *config.Config) {
sshConfig := &ssh.ServerConfig{
PublicKeyCallback: sshCheckPubkey,
}
hostKeyLoaded := false
for _, format := range []string{"rsa", "dsa", "ecdsa", "ed25519"} {
log := log.With().Str("format", format).Logger()
pkBytes, err := os.ReadFile("/id_" + format)
if err != nil {
log.Error().Err(err).Msg("ssh: failed to load host key")
continue
}
pk, err := ssh.ParsePrivateKey(pkBytes)
if err != nil {
log.Error().Err(err).Msg("ssh: failed to parse host key")
continue
}
sshConfig.AddHostKey(pk)
hostKeyLoaded = true
log.Info().Msg("ssh: loaded host key")
}
if !hostKeyLoaded {
fatalf("ssh: failed to load any host key")
}
sshBind := ":22" // TODO configurable
listener, err := net.Listen("tcp", sshBind)
if err != nil {
fatalf("ssh: failed to listen on %s: %v", sshBind, err)
}
log.Info().Str("bind-address", sshBind).Msg("SSH server listening")
go func() {
for {
conn, err := listener.Accept()
if err != nil {
log.Info().Err(err).Msg("ssh: accept conn failed")
continue
}
go sshHandleConn(conn, sshConfig)
}
}()
}
func sshHandleConn(conn net.Conn, sshConfig *ssh.ServerConfig) {
sshConn, chans, reqs, err := ssh.NewServerConn(conn, sshConfig)
if err != nil {
log.Error().Err(err).Msg("ssh: handshake failed")
return
}
remoteAddr := sshConn.User() + "@" + sshConn.RemoteAddr().String()
log.Info().Str("remote", remoteAddr).Msg("ssh: new connection")
go sshHandleReqs(reqs)
go sshHandleChannels(remoteAddr, chans)
}
func sshHandleReqs(reqs <-chan *ssh.Request) {
for req := range reqs {
switch req.Type {
case "keepalive@openssh.com":
req.Reply(true, nil)
default:
log.Info().Str("type", req.Type).Msg("ssh: discarding request")
req.Reply(false, nil)
}
}
}
func sshHandleChannels(remoteAddr string, chans <-chan ssh.NewChannel) {
for newChannel := range chans {
if t := newChannel.ChannelType(); t != "session" {
newChannel.Reject(ssh.UnknownChannelType, fmt.Sprintf("unknown channel type: %s", t))
continue
}
channel, requests, err := newChannel.Accept()
if err != nil {
log.Error().Err(err).Msg("ssh: failed to accept channel")
continue
}
go sshHandleChannel(remoteAddr, channel, requests)
}
}
func sshHandleChannel(remoteAddr string, channel ssh.Channel, requests <-chan *ssh.Request) {
var (
ptyF, ttyF *os.File
termEnv string
)
defer func() {
if ptyF != nil {
ptyF.Close()
}
if ttyF != nil {
ttyF.Close()
}
}()
var once sync.Once
closeCh := func() {
channel.Close()
}
for req := range requests {
switch req.Type {
case "exec":
command := string(req.Payload[4 : req.Payload[3]+4])
switch command {
case "init":
if ptyF == nil {
go func() {
channel.Stderr().Write([]byte("\033[5m\033[31;1m\n\nWARNING: no TTY requested, passwords will be echoed!\n\n\033[0m"))
time.Sleep(3 * time.Second)
io.Copy(channel, stdout.NewReader())
once.Do(closeCh)
}()
go func() {
io.Copy(stdinPipe, channel)
once.Do(closeCh)
}()
} else {
stdinTTY := newTTY(ptyF.Fd())
if askingSecret.Load() {
stdinTTY.EchoOff()
}
registerInput(stdinTTY)
defer unregiterInput(stdinTTY)
go func() {
io.Copy(ttyF, stdout.NewReader())
once.Do(closeCh)
}()
go func() {
io.Copy(stdinPipe, ttyF)
once.Do(closeCh)
}()
}
req.Reply(true, nil)
case "bootstrap":
// extract a new bootstrap package
os.MkdirAll("/bootstrap/current", 0750)
cmd := exec.Command("/bin/tar", "xv", "-C", "/bootstrap/current")
cmd.Stdin = channel
cmd.Stdout = channel
cmd.Stderr = channel.Stderr()
go func() {
cmd.Run()
closeCh()
}()
req.Reply(true, nil)
default:
req.Reply(false, nil)
}
case "shell":
cmd := exec.Command("/bin/ash")
cmd.Env = []string{"TERM=" + termEnv}
cmd.Stdin = ttyF
cmd.Stdout = ttyF
cmd.Stderr = ttyF
cmd.SysProcAttr = &syscall.SysProcAttr{
Setctty: true,
Setsid: true,
Pdeathsig: syscall.SIGKILL,
}
cmd.Start()
go func() {
cmd.Wait()
ptyF.Close()
ptyF = nil
ttyF.Close()
ttyF = nil
}()
req.Reply(true, nil)
case "pty-req":
if ptyF != nil || ttyF != nil {
req.Reply(false, nil)
continue
}
var err error
ptyF, ttyF, err = pty.Open()
if err != nil {
log.Error().Err(err).Msg("ssh: PTY open failed")
req.Reply(false, nil)
continue
}
termLen := req.Payload[3]
termEnv = string(req.Payload[4 : termLen+4])
w, h := sshParseDims(req.Payload[termLen+4:])
sshSetWinsize(ptyF.Fd(), w, h)
req.Reply(true, nil)
go func() {
io.Copy(channel, ptyF)
once.Do(closeCh)
}()
go func() {
io.Copy(ptyF, channel)
once.Do(closeCh)
}()
case "window-change":
w, h := sshParseDims(req.Payload)
sshSetWinsize(ptyF.Fd(), w, h)
// no response
default:
req.Reply(false, nil)
}
}
}
func sshParseDims(b []byte) (uint32, uint32) {
w := binary.BigEndian.Uint32(b)
h := binary.BigEndian.Uint32(b[4:])
return w, h
}
// SetWinsize sets the size of the given pty.
func sshSetWinsize(fd uintptr, w, h uint32) {
// Winsize stores the Height and Width of a terminal.
type Winsize struct {
Height uint16
Width uint16
x uint16 // unused
y uint16 // unused
}
ws := &Winsize{Width: uint16(w), Height: uint16(h)}
syscall.Syscall(syscall.SYS_IOCTL, fd, uintptr(syscall.TIOCSWINSZ), uintptr(unsafe.Pointer(ws)))
}

88
test-initrd/config.yaml Normal file
View File

@ -0,0 +1,88 @@
---
# early system configuration
anti_phishing_code: "direktil<3"
modules: /modules.sqfs
auths:
- name: novit
sshKey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkpbU6sf4t0f6XAv9DuW3XH5iLM0AI5rc8PT2jwea1N
password: bXlzZWVk:HMSxrg1cYphaPuUYUbtbl/htep/tVYYIQAuvkNMVpw0 # mypass
networks:
- name: loopback
interfaces: [ { var: iface, n: 1, regexps: [ "^lo$" ] } ]
script: |
ip a add 127.0.0.1/8 dev lo
ip a add ::1/128 dev lo
ip li set lo up
- name: main
interfaces:
- var: iface
n: 1
regexps:
- eth.*
- veth.*
- eno.*
- enp.*
script: |
ip li set $iface up
udhcpc -i $iface -b -t1 -T1 -A5 ||
ip a add 2001:41d0:306:168f::1337:2eed/64 dev $iface
pre_lvm_crypt:
- dev: /dev/vda
name: sys0
- dev: /dev/vdb
name: sys1
lvm:
- vg: storage
pvs:
n: 2
regexps:
- /dev/mapper/sys[01]
# to match full disks
#- /dev/nvme[0-9]+n[0-9]+
#- /dev/vd[a-z]+
#- /dev/sd[a-z]+
#- /dev/hd[a-z]+
# to match partitions:
#- /dev/nvme[0-9]+n[0-9]+p[0-9]+
#- /dev/vd[a-z]+[0-9]+
#- /dev/sd[a-z]+[0-9]+
#- /dev/hd[a-z]+[0-9]+
defaults:
fs: ext4
raid:
mirrors: 1
lvs:
- name: bootstrap
size: 2g
- name: varlog
extents: 10%FREE
# size: 10g
- name: podman
extents: 10%FREE
# size: 10g
- name: dls
extents: 100%FREE
# size: 10g
#crypt:
#- dev: /dev/storage/bootstrap
#- dev: /dev/storage/dls
bootstrap:
#dev: /dev/mapper/bootstrap
dev: /dev/storage/bootstrap
# TODO seed: https://direktil.novit.io/bootstraps/dls-crypt
seed: http://192.168.10.254:7606/hosts/m1/bootstrap.tar
# TODO seed_sign_key: "..."
# TODO load_and_close: true

2
test-initrd/env Normal file
View File

@ -0,0 +1,2 @@
gateway=192.168.1.1/24
address=192.168.1.27/24

38
test-initrd/id_rsa Normal file
View File

@ -0,0 +1,38 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAy6Ppr/tBiVYsBYiteGwMPI+B2BSBn+CP36ZiKsx6IX+9E0/nGKgC
khwWFfrmIzS2EIm+iIv7YT3sXsqcO96au2ewh77m5xUFIrqie5c13leNeOn+Xhy++v0705
irYUuBVRbWukpQjhOrp0eqvBzOdlUoo2r7aF95rrMboAsIWh5gTTnVCXDSEQiHsvEGjs7T
ytOXQ6zmYTECYEkk/wUWja7WNP8UZiaPuU20Hso8g7kHSthKEudUDFs7E/yx+na0AYCnfE
UR6oxIbHH2ldgpnX7lTv5YhHVvNnqTIBQhmLTHrT/67N2z5AvdFC8T2UsrWs+3ebsdXb0o
Kzx81+N9OpPxj93ehLznncuCCgAedye5Xm760SOaU1T2b3f0bEhhsVCMI39mPExeZ2wtnd
g+Tmrqn3r59vb3iEYfJqvgLCTJ5L1BcFUTfulg7GfhfNvgBmgiiRTUC2G0SrV1tM84vsE7
JyyTcJaXr0X+tUgsXoUqnlX53OEw7ABskWvZ0m0fAAAFiBu7krYbu5K2AAAAB3NzaC1yc2
EAAAGBAMuj6a/7QYlWLAWIrXhsDDyPgdgUgZ/gj9+mYirMeiF/vRNP5xioApIcFhX65iM0
thCJvoiL+2E97F7KnDvemrtnsIe+5ucVBSK6onuXNd5XjXjp/l4cvvr9O9OYq2FLgVUW1r
pKUI4Tq6dHqrwcznZVKKNq+2hfea6zG6ALCFoeYE051Qlw0hEIh7LxBo7O08rTl0Os5mEx
AmBJJP8FFo2u1jT/FGYmj7lNtB7KPIO5B0rYShLnVAxbOxP8sfp2tAGAp3xFEeqMSGxx9p
XYKZ1+5U7+WIR1bzZ6kyAUIZi0x60/+uzds+QL3RQvE9lLK1rPt3m7HV29KCs8fNfjfTqT
8Y/d3oS8553LggoAHncnuV5u+tEjmlNU9m939GxIYbFQjCN/ZjxMXmdsLZ3YPk5q6p96+f
b294hGHyar4CwkyeS9QXBVE37pYOxn4Xzb4AZoIokU1AthtEq1dbTPOL7BOycsk3CWl69F
/rVILF6FKp5V+dzhMOwAbJFr2dJtHwAAAAMBAAEAAAGBAJ0rDBBjtkgd9unqfCAmHCedht
RTt1vCgKhXjQqFOHmkUjSWhcD04s8L2EvskjR32VDYTvKqP0Dk/wqGC6D1hKzBMXEDeMi+
43DTZNZIdS3+mtTInCbcvtWOHt+HxDXahZ47e0zaUGPncKMx3+dBwGN6BFxkFFeQ4KRh3h
9ehHqxWRghW3fm2GqHD9yew7XykWnIdsWnq0M2BSR1L5WXwrllSDQs7vyMJH8bJrpg0eXE
J4mvdzQx0B+dRfJ+JIsvkwvieAPb6sPmSgY47moP0xhbvs7/1UxPEY0Q2FpjQALQ0CnIC2
LRHvGb7NJEX/ASDy/s1CNlk5ro/iht28wh0Iq8iqqpRkgKyhYsr8+QChs6oxcbx2xPRVy4
NOBMLW6ppjIQO3rE79zPrp9tTmew5iQ4V58+DqhAZxeI4A6YZE98rAvRREqnT6HVmqtfHl
gPMlrSDw1I8ZN8QT1dD1sMbi4Ud0eHdg1xLUpJ3dStgN45yhBiWuR2x4Jbn8ayeZwJmQAA
AMA971gUyqrb7D6oFerzx3prijJoZOLE1Zluo3Q9Ise4KgDZ66QDE7mQRzSEniZcy77mSt
VOhjVmI5CXREbpdGU6LxJujIAm4pKwyVEV8XVAzII6s4He5QUBxiLYWHDro3bOSmOZ50tk
WBTO7llCR5FGbi7iJ1CP0C+CXRSaH8ug8Xqd0HBzTB2nXTGJNyx9lBwLY837VcdUIRrr+7
QzVD/BQ/v+Ch21Ck0kMtLCv+lrXAeowsK89ExDp4HqMnOHnT0AAADBAObxbkJeoXfkmV7e
0nAyQ/IDTs3Zlm3517mTzvc7j2o0qJQty+9pLD60S5s0VUpQpgeT3LzXRZ2eZlq3FcWsRa
HyiovF6L5OUik1gVc/QiP+x6QSLdFi/ROHRT7DZFQ+1/bquGgVsoEVZJPDz7NJvBPLYwmj
EGRZeKWVjIcDLSGq6fek9aTFUe7bcDCHx+QuovxeFWncmTNYC7jaYMff6DtHjokLgsyOzF
FjYEC9wFVrEz+9oegDxatiJpWJN1zTWwAAAMEA4bwhyUDs0oyQ+16xpdd4f8PYfQ0HoLow
ckvWCNS2Xmpnbe+dYqqRw7mchnYj4uXvhi391LwWTea5bQ78Hj+DnMugOLmmcHuFAbkxeL
9x97iCIUrli5wawGfJgwPiGJlATUVz9Y3BOcg+uBmQ9qGR6wdI6N+zuu/54gGzW2gVanYs
Gs0JH+C+afZ2yitUuGXDIVlYdgjESIszdK0wNGzZ4HDleFVhK3jFiK1CHHBb89Tbmd6fMZ
NWpcpue2AYSUyNAAAADXRlc3RAbm92aXQuaW8BAgMEBQ==
-----END OPENSSH PRIVATE KEY-----

1
test-initrd/id_rsa.pub Normal file
View File

@ -0,0 +1 @@
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDLo+mv+0GJViwFiK14bAw8j4HYFIGf4I/fpmIqzHohf70TT+cYqAKSHBYV+uYjNLYQib6Ii/thPexeypw73pq7Z7CHvubnFQUiuqJ7lzXeV4146f5eHL76/TvTmKthS4FVFta6SlCOE6unR6q8HM52VSijavtoX3musxugCwhaHmBNOdUJcNIRCIey8QaOztPK05dDrOZhMQJgSST/BRaNrtY0/xRmJo+5TbQeyjyDuQdK2EoS51QMWzsT/LH6drQBgKd8RRHqjEhscfaV2CmdfuVO/liEdW82epMgFCGYtMetP/rs3bPkC90ULxPZSytaz7d5ux1dvSgrPHzX4306k/GP3d6EvOedy4IKAB53J7lebvrRI5pTVPZvd/RsSGGxUIwjf2Y8TF5nbC2d2D5Oauqfevn29veIRh8mq+AsJMnkvUFwVRN+6WDsZ+F82+AGaCKJFNQLYbRKtXW0zzi+wTsnLJNwlpevRf61SCxehSqeVfnc4TDsAGyRa9nSbR8= test@novit.io

BIN
test-initrd/modules.sqfs Normal file

Binary file not shown.

BIN
test-kernel Normal file

Binary file not shown.

19
tools/cpiocat/main.go Normal file
View File

@ -0,0 +1,19 @@
package main
import (
"flag"
"fmt"
"os"
"novit.tech/direktil/pkg/cpiocat"
)
func main() {
flag.Parse()
err := cpiocat.Append(os.Stdout, os.Stdin, flag.Args())
if err != nil {
fmt.Fprintln(os.Stderr, err.Error())
os.Exit(1)
}
}

37
tools/testconf/main.go Normal file
View File

@ -0,0 +1,37 @@
package main
import (
"bytes"
"flag"
"fmt"
"os"
"gopkg.in/yaml.v3"
config "novit.tech/direktil/pkg/bootstrapconfig"
)
func main() {
flag.Parse()
for _, arg := range flag.Args() {
fmt.Println("testing", arg)
cfgBytes, err := os.ReadFile(arg)
fail(err)
cfg := config.Config{}
dec := yaml.NewDecoder(bytes.NewBuffer(cfgBytes))
dec.KnownFields(true)
err = dec.Decode(&cfg)
fail(err)
}
}
func fail(err error) {
if err != nil {
fmt.Fprintln(os.Stderr, err.Error())
os.Exit(1)
}
}

35
tty.go Normal file
View File

@ -0,0 +1,35 @@
package main
import (
"golang.org/x/sys/unix"
)
type tty struct {
fd int
termios *unix.Termios
}
func newTTY(fd uintptr) *tty {
termios, _ := unix.IoctlGetTermios(int(fd), unix.TCGETS)
return &tty{int(fd), termios}
}
func (t *tty) EchoOff() {
if t.termios == nil {
return
}
newState := *t.termios
newState.Lflag &^= unix.ECHO
newState.Lflag |= unix.ICANON | unix.ISIG
newState.Iflag |= unix.ICRNL
unix.IoctlSetTermios(t.fd, unix.TCSETS, &newState)
}
func (t *tty) Restore() {
if t.termios == nil {
return
}
unix.IoctlSetTermios(t.fd, unix.TCSETS, t.termios)
}

20
uname.go Normal file
View File

@ -0,0 +1,20 @@
package main
import "syscall"
func unameRelease() string {
uname := &syscall.Utsname{}
if err := syscall.Uname(uname); err != nil {
fatalf("failed to get kernel version: %v", err)
}
ba := make([]byte, 0, len(uname.Release))
for _, c := range uname.Release {
if c == 0 {
break
}
ba = append(ba, byte(c))
}
return string(ba)
}

137
vpn.go Normal file
View File

@ -0,0 +1,137 @@
package main
import (
"net"
"os"
"path/filepath"
"github.com/rs/zerolog/log"
"golang.zx2c4.com/wireguard/wgctrl"
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
"novit.tech/direktil/pkg/config"
)
func setupVPN(vpn config.VPNDef, localGenDir string) {
log := log.With().Str("vpn", vpn.Name).Logger()
log.Info().Msg("VPN: setting up")
vpnDir := filepath.Join(localGenDir, vpn.Name)
os.MkdirAll(vpnDir, 0750)
logMsg := log.Info()
if vpn.ListenPort != nil {
logMsg.Int("ListenPort", *vpn.ListenPort)
}
// public/private key
keyFile := filepath.Join(vpnDir, "key")
keyBytes, err := os.ReadFile(keyFile)
if os.IsNotExist(err) {
key, err := wgtypes.GeneratePrivateKey()
if err != nil {
fatalf("failed to generate VPN key: %v", err)
}
keyBytes = []byte(key.String())
os.WriteFile(keyFile, keyBytes, 0600)
} else if err != nil {
fatalf("failed to read VPN key: %v", err)
}
key, err := wgtypes.ParseKey(string(keyBytes))
if err != nil {
fatalf("bad VPN key: %v", err)
}
logMsg.Stringer("PublicKey", key.PublicKey())
// pre-shared key
pskeyFile := filepath.Join(vpnDir, "pskey")
pskeyBytes, err := os.ReadFile(pskeyFile)
if os.IsNotExist(err) {
key, err := wgtypes.GenerateKey()
if err != nil {
fatalf("failed to generate VPN pre-shared key: %v", err)
}
pskeyBytes = []byte(key.String())
os.WriteFile(pskeyFile, pskeyBytes, 0600)
} else if err != nil {
fatalf("failed to read VPN pre-shared key: %v", err)
}
pskey, err := wgtypes.ParseKey(string(pskeyBytes))
if err != nil {
fatalf("bad VPN pre-shared key: %v", err)
}
{
keyStr := key.String()
logMsg.Str("PresharedKey", keyStr[0:4]+"..."+keyStr[len(keyStr)-4:])
}
// setup interface
cfg := wgtypes.Config{
PrivateKey: &key,
ListenPort: vpn.ListenPort,
Peers: make([]wgtypes.PeerConfig, 0, len(vpn.Peers)),
}
for idx, vpnPeer := range vpn.Peers {
vpnPeer := vpnPeer
wgPeer := wgtypes.PeerConfig{
Endpoint: vpnPeer.Endpoint,
AllowedIPs: make([]net.IPNet, 0, len(vpnPeer.AllowedIPs)),
PersistentKeepaliveInterval: &vpnPeer.KeepAlive,
}
if vpnPeer.WithPreSharedKey {
wgPeer.PresharedKey = &pskey
}
pubkey, err := wgtypes.ParseKey(vpnPeer.PublicKey)
if err != nil {
fatalf("bad VPN peer[%d] public key: %v", idx, err)
}
wgPeer.PublicKey = pubkey
for _, ipnetStr := range vpnPeer.AllowedIPs {
_, ipnet, err := net.ParseCIDR(ipnetStr)
if err != nil {
fatalf("bad IP/net: %q: %v", ipnetStr, err)
}
wgPeer.AllowedIPs = append(wgPeer.AllowedIPs, *ipnet)
}
cfg.Peers = append(cfg.Peers, wgPeer)
}
wg, err := wgctrl.New()
if err != nil {
fatalf("failed to setup WireGuard client: %v", err)
}
defer wg.Close()
log.Info().Strs("ips", vpn.IPs).Msg("VPN: creating interface")
run("ip", "link", "add", vpn.Name, "type", "wireguard")
for _, ip := range vpn.IPs {
run("ip", "addr", "add", ip, "dev", vpn.Name)
}
logMsg.Msg("VPN: configuring interface")
err = wg.ConfigureDevice(vpn.Name, cfg)
if err != nil {
fatalf("failed to setup VPN %s: %v", vpn.Name, err)
}
run("ip", "link", "set", vpn.Name, "up")
}

View File

@ -1,24 +0,0 @@
package main
import (
"log"
"syscall"
)
func cleanZombies() {
var wstatus syscall.WaitStatus
for {
pid, err := syscall.Wait4(-1, &wstatus, 0, nil)
switch err {
case nil:
log.Printf("collected PID %v", pid)
case syscall.ECHILD:
return
default:
log.Printf("unknown error: %v", err)
}
}
}