mirror of
https://github.com/Start9Labs/start-os.git
synced 2026-04-02 05:23:14 +00:00
Gateways, domains, and new service interface (#3001)
* add support for inbound proxies * backend changes * fix file type * proxy -> tunnel, implement backend apis * wip start-tunneld * add domains and gateways, remove routers, fix docs links * dont show hidden actions * show and test dns * edit instead of chnage acme and change gateway * refactor: domains page * refactor: gateways page * domains and acme refactor * certificate authorities * refactor public/private gateways * fix fe types * domains mostly finished * refactor: add file control to form service * add ip util to sdk * domains api + migration * start service interface page, WIP * different options for clearnet domains * refactor: styles for interfaces page * minor * better placeholder for no addresses * start sorting addresses * best address logic * comments * fix unnecessary export * MVP of service interface page * domains preferred * fix: address comments * only translations left * wip: start-tunnel & fix build * forms for adding domain, rework things based on new ideas * fix: dns testing * public domain, max width, descriptions for dns * nix StartOS domains, implement public and private domains at interface scope * restart tor instead of reset * better icon for restart tor * dns * fix sort functions for public and private domains * with todos * update types * clean up tech debt, bump dependencies * revert to ts-rs v9 * fix all types * fix dns form * add missing translations * it builds * fix: comments (#3009) * fix: comments * undo default --------- Co-authored-by: Matt Hill <mattnine@protonmail.com> * fix: refactor legacy components (#3010) * fix: comments * fix: refactor legacy components * remove default again --------- Co-authored-by: Matt Hill <mattnine@protonmail.com> * more translations * wip * fix deadlock * coukd work * simple renaming * placeholder for empty service interfaces table * honor hidden form values * remove logs * reason instead of description * fix dns * misc fixes * implement toggling gateways for service interface * fix showing dns records * move status column in service list * remove unnecessary truthy check * refactor: refactor forms components and remove legacy Taiga UI package (#3012) * handle wh file uploads * wip: debugging tor * socks5 proxy working * refactor: fix multiple comments (#3013) * refactor: fix multiple comments * styling changes, add documentation to sidebar * translations for dns page * refactor: subtle colors * rearrange service page --------- Co-authored-by: Matt Hill <mattnine@protonmail.com> * fix file_stream and remove non-terminating test * clean up logs * support for sccache * fix gha sccache * more marketplace translations * install wizard clarity * stub hostnameInfo in migration * fix address info after setup, fix styling on SI page, new 040 release notes * remove tor logs from os * misc fixes * reset tor still not functioning... * update ts * minor styling and wording * chore: some fixes (#3015) * fix gateway renames * different handling for public domains * styling fixes * whole navbar should not be clickable on service show page * timeout getState request * remove links from changelog * misc fixes from pairing * use custom name for gateway in more places * fix dns parsing * closes #3003 * closes #2999 * chore: some fixes (#3017) * small copy change * revert hardcoded error for testing * dont require port forward if gateway is public * use old wan ip when not available * fix .const hanging on undefined * fix test * fix doc test * fix renames * update deps * allow specifying dependency metadata directly * temporarily make dependencies not cliackable in marketplace listings * fix socks bind * fix test --------- Co-authored-by: Aiden McClelland <me@drbonez.dev> Co-authored-by: waterplea <alexander@inkin.ru>
This commit is contained in:
Matt Hill
130
core/startos/src/tunnel/api.rs
Normal file
130
core/startos/src/tunnel/api.rs
Normal file
@@ -0,0 +1,130 @@
|
||||
use std::net::Ipv4Addr;
|
||||
|
||||
use clap::Parser;
|
||||
use ipnet::Ipv4Net;
|
||||
use rpc_toolkit::{Context, Empty, HandlerExt, ParentHandler, from_fn_async};
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
use crate::context::CliContext;
|
||||
use crate::prelude::*;
|
||||
use crate::tunnel::context::TunnelContext;
|
||||
use crate::tunnel::wg::WgSubnetConfig;
|
||||
|
||||
pub fn tunnel_api<C: Context>() -> ParentHandler<C> {
|
||||
ParentHandler::new()
|
||||
.subcommand(
|
||||
"db",
|
||||
super::db::db_api::<C>()
|
||||
.with_about("Commands to interact with the db i.e. dump and apply"),
|
||||
)
|
||||
.subcommand(
|
||||
"subnet",
|
||||
subnet_api::<C>().with_about("Add, remove, or modify subnets"),
|
||||
)
|
||||
// .subcommand(
|
||||
// "forward",
|
||||
// ParentHandler::<C>::new()
|
||||
// .subcommand(
|
||||
// "add",
|
||||
// from_fn_async(add_forward)
|
||||
// .with_metadata("sync_db", Value::Bool(true))
|
||||
// .no_display()
|
||||
// .with_about("Add a new port forward")
|
||||
// .with_call_remote::<CliContext>(),
|
||||
// )
|
||||
// .subcommand(
|
||||
// "remove",
|
||||
// from_fn_async(remove_forward)
|
||||
// .with_metadata("sync_db", Value::Bool(true))
|
||||
// .no_display()
|
||||
// .with_about("Remove a port forward")
|
||||
// .with_call_remote::<CliContext>(),
|
||||
// ),
|
||||
// )
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Serialize, Parser)]
|
||||
pub struct SubnetParams {
|
||||
subnet: Ipv4Net,
|
||||
}
|
||||
|
||||
pub fn subnet_api<C: Context>() -> ParentHandler<C, SubnetParams> {
|
||||
ParentHandler::new()
|
||||
.subcommand(
|
||||
"add",
|
||||
from_fn_async(add_subnet)
|
||||
.with_metadata("sync_db", Value::Bool(true))
|
||||
.with_inherited(|a, _| a)
|
||||
.no_display()
|
||||
.with_about("Add a new subnet")
|
||||
.with_call_remote::<CliContext>(),
|
||||
)
|
||||
.subcommand(
|
||||
"remove",
|
||||
from_fn_async(remove_subnet)
|
||||
.with_metadata("sync_db", Value::Bool(true))
|
||||
.with_inherited(|a, _| a)
|
||||
.no_display()
|
||||
.with_about("Remove a subnet")
|
||||
.with_call_remote::<CliContext>(),
|
||||
)
|
||||
// .subcommand(
|
||||
// "set-default-forward-target",
|
||||
// from_fn_async(set_default_forward_target)
|
||||
// .with_metadata("sync_db", Value::Bool(true))
|
||||
// .no_display()
|
||||
// .with_about("Set the default target for port forwarding")
|
||||
// .with_call_remote::<CliContext>(),
|
||||
// )
|
||||
// .subcommand(
|
||||
// "add-client",
|
||||
// from_fn_async(add_client)
|
||||
// .with_metadata("sync_db", Value::Bool(true))
|
||||
// .no_display()
|
||||
// .with_about("Add a client to a subnet")
|
||||
// .with_call_remote::<CliContext>(),
|
||||
// )
|
||||
// .subcommand(
|
||||
// "remove-client",
|
||||
// from_fn_async(remove_client)
|
||||
// .with_metadata("sync_db", Value::Bool(true))
|
||||
// .no_display()
|
||||
// .with_about("Remove a client from a subnet")
|
||||
// .with_call_remote::<CliContext>(),
|
||||
// )
|
||||
}
|
||||
|
||||
pub async fn add_subnet(
|
||||
ctx: TunnelContext,
|
||||
_: Empty,
|
||||
SubnetParams { subnet }: SubnetParams,
|
||||
) -> Result<(), Error> {
|
||||
let server = ctx
|
||||
.db
|
||||
.mutate(|db| {
|
||||
let map = db.as_wg_mut().as_subnets_mut();
|
||||
if !map.contains_key(&subnet)? {
|
||||
map.insert(&subnet, &WgSubnetConfig::new())?;
|
||||
}
|
||||
db.as_wg().de()
|
||||
})
|
||||
.await
|
||||
.result?;
|
||||
server.sync().await
|
||||
}
|
||||
|
||||
pub async fn remove_subnet(
|
||||
ctx: TunnelContext,
|
||||
_: Empty,
|
||||
SubnetParams { subnet }: SubnetParams,
|
||||
) -> Result<(), Error> {
|
||||
let server = ctx
|
||||
.db
|
||||
.mutate(|db| {
|
||||
db.as_wg_mut().as_subnets_mut().remove(&subnet)?;
|
||||
db.as_wg().de()
|
||||
})
|
||||
.await
|
||||
.result?;
|
||||
server.sync().await
|
||||
}
|
||||
10
core/startos/src/tunnel/client.conf.template
Normal file
10
core/startos/src/tunnel/client.conf.template
Normal file
@@ -0,0 +1,10 @@
|
||||
[Interface]
|
||||
Address = {addr}/24
|
||||
PrivateKey = {privkey}
|
||||
|
||||
[Peer]
|
||||
PublicKey = {server_pubkey}
|
||||
PresharedKey = {psk}
|
||||
AllowedIPs = 0.0.0.0/0, ::/0
|
||||
Endpoint = {server_addr}
|
||||
PersistentKeepalive = 25
|
||||
224
core/startos/src/tunnel/context.rs
Normal file
224
core/startos/src/tunnel/context.rs
Normal file
@@ -0,0 +1,224 @@
|
||||
use std::collections::BTreeSet;
|
||||
use std::net::{IpAddr, Ipv6Addr, SocketAddr};
|
||||
use std::ops::Deref;
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::sync::Arc;
|
||||
|
||||
use clap::Parser;
|
||||
use imbl::OrdMap;
|
||||
use imbl_value::InternedString;
|
||||
use patch_db::PatchDb;
|
||||
use rpc_toolkit::yajrc::RpcError;
|
||||
use rpc_toolkit::{CallRemote, Context, Empty};
|
||||
use serde::{Deserialize, Serialize};
|
||||
use tokio::sync::broadcast::Sender;
|
||||
use tracing::instrument;
|
||||
|
||||
use crate::auth::{Sessions, check_password};
|
||||
use crate::context::CliContext;
|
||||
use crate::context::config::ContextConfig;
|
||||
use crate::middleware::auth::AuthContext;
|
||||
use crate::middleware::signature::SignatureAuthContext;
|
||||
use crate::net::forward::PortForwardController;
|
||||
use crate::net::gateway::NetworkInterfaceWatcher;
|
||||
use crate::prelude::*;
|
||||
use crate::rpc_continuations::{OpenAuthedContinuations, RpcContinuations};
|
||||
use crate::tunnel::TUNNEL_DEFAULT_PORT;
|
||||
use crate::tunnel::db::TunnelDatabase;
|
||||
use crate::util::sync::SyncMutex;
|
||||
|
||||
#[derive(Debug, Clone, Default, Deserialize, Serialize, Parser)]
|
||||
#[serde(rename_all = "kebab-case")]
|
||||
#[command(rename_all = "kebab-case")]
|
||||
pub struct TunnelConfig {
|
||||
#[arg(short = 'c', long = "config")]
|
||||
pub config: Option<PathBuf>,
|
||||
#[arg(short = 'l', long = "listen")]
|
||||
pub tunnel_listen: Option<SocketAddr>,
|
||||
#[arg(short = 'd', long = "datadir")]
|
||||
pub datadir: Option<PathBuf>,
|
||||
}
|
||||
impl ContextConfig for TunnelConfig {
|
||||
fn next(&mut self) -> Option<PathBuf> {
|
||||
self.config.take()
|
||||
}
|
||||
fn merge_with(&mut self, other: Self) {
|
||||
self.tunnel_listen = self.tunnel_listen.take().or(other.tunnel_listen);
|
||||
self.datadir = self.datadir.take().or(other.datadir);
|
||||
}
|
||||
}
|
||||
|
||||
impl TunnelConfig {
|
||||
pub fn load(mut self) -> Result<Self, Error> {
|
||||
let path = self.next();
|
||||
self.load_path_rec(path)?;
|
||||
self.load_path_rec(Some("/etc/start-tunneld"))?;
|
||||
Ok(self)
|
||||
}
|
||||
}
|
||||
|
||||
pub struct TunnelContextSeed {
|
||||
pub listen: SocketAddr,
|
||||
pub addrs: BTreeSet<IpAddr>,
|
||||
pub db: TypedPatchDb<TunnelDatabase>,
|
||||
pub datadir: PathBuf,
|
||||
pub rpc_continuations: RpcContinuations,
|
||||
pub open_authed_continuations: OpenAuthedContinuations<Option<InternedString>>,
|
||||
pub ephemeral_sessions: SyncMutex<Sessions>,
|
||||
pub net_iface: NetworkInterfaceWatcher,
|
||||
pub forward: PortForwardController,
|
||||
pub shutdown: Sender<()>,
|
||||
}
|
||||
|
||||
#[derive(Clone)]
|
||||
pub struct TunnelContext(Arc<TunnelContextSeed>);
|
||||
impl TunnelContext {
|
||||
#[instrument(skip_all)]
|
||||
pub async fn init(config: &TunnelConfig) -> Result<Self, Error> {
|
||||
let (shutdown, _) = tokio::sync::broadcast::channel(1);
|
||||
let datadir = config
|
||||
.datadir
|
||||
.as_deref()
|
||||
.unwrap_or_else(|| Path::new("/var/lib/start-tunnel"))
|
||||
.to_owned();
|
||||
if tokio::fs::metadata(&datadir).await.is_err() {
|
||||
tokio::fs::create_dir_all(&datadir).await?;
|
||||
}
|
||||
let db_path = datadir.join("tunnel.db");
|
||||
let db = TypedPatchDb::<TunnelDatabase>::load_or_init(
|
||||
PatchDb::open(&db_path).await?,
|
||||
|| async { Ok(Default::default()) },
|
||||
)
|
||||
.await?;
|
||||
let listen = config.tunnel_listen.unwrap_or(SocketAddr::new(
|
||||
Ipv6Addr::UNSPECIFIED.into(),
|
||||
TUNNEL_DEFAULT_PORT,
|
||||
));
|
||||
let net_iface = NetworkInterfaceWatcher::new(async { OrdMap::new() }, []);
|
||||
let forward = PortForwardController::new(net_iface.subscribe());
|
||||
Ok(Self(Arc::new(TunnelContextSeed {
|
||||
listen,
|
||||
addrs: crate::net::utils::all_socket_addrs_for(listen.port())
|
||||
.await?
|
||||
.into_iter()
|
||||
.map(|(_, a)| a.ip())
|
||||
.collect(),
|
||||
db,
|
||||
datadir,
|
||||
rpc_continuations: RpcContinuations::new(),
|
||||
open_authed_continuations: OpenAuthedContinuations::new(),
|
||||
ephemeral_sessions: SyncMutex::new(Sessions::new()),
|
||||
net_iface,
|
||||
forward,
|
||||
shutdown,
|
||||
})))
|
||||
}
|
||||
}
|
||||
impl AsRef<RpcContinuations> for TunnelContext {
|
||||
fn as_ref(&self) -> &RpcContinuations {
|
||||
&self.rpc_continuations
|
||||
}
|
||||
}
|
||||
|
||||
impl Context for TunnelContext {}
|
||||
impl Deref for TunnelContext {
|
||||
type Target = TunnelContextSeed;
|
||||
fn deref(&self) -> &Self::Target {
|
||||
&*self.0
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Deserialize, Serialize, Parser)]
|
||||
pub struct TunnelAddrParams {
|
||||
pub tunnel: IpAddr,
|
||||
}
|
||||
|
||||
impl SignatureAuthContext for TunnelContext {
|
||||
type Database = TunnelDatabase;
|
||||
type AdditionalMetadata = ();
|
||||
type CheckPubkeyRes = ();
|
||||
fn db(&self) -> &TypedPatchDb<Self::Database> {
|
||||
&self.db
|
||||
}
|
||||
async fn sig_context(
|
||||
&self,
|
||||
) -> impl IntoIterator<Item = Result<impl AsRef<str> + Send, Error>> + Send {
|
||||
self.addrs
|
||||
.iter()
|
||||
.filter(|a| !match a {
|
||||
IpAddr::V4(a) => a.is_loopback() || a.is_unspecified(),
|
||||
IpAddr::V6(a) => a.is_loopback() || a.is_unspecified(),
|
||||
})
|
||||
.map(|a| InternedString::from_display(&a))
|
||||
.map(Ok)
|
||||
}
|
||||
fn check_pubkey(
|
||||
db: &Model<Self::Database>,
|
||||
pubkey: Option<&crate::sign::AnyVerifyingKey>,
|
||||
_: Self::AdditionalMetadata,
|
||||
) -> Result<Self::CheckPubkeyRes, Error> {
|
||||
if let Some(pubkey) = pubkey {
|
||||
if db.as_auth_pubkeys().de()?.contains(pubkey) {
|
||||
return Ok(());
|
||||
}
|
||||
}
|
||||
|
||||
Err(Error::new(
|
||||
eyre!("Developer Key is not authorized"),
|
||||
ErrorKind::IncorrectPassword,
|
||||
))
|
||||
}
|
||||
async fn post_auth_hook(
|
||||
&self,
|
||||
_: Self::CheckPubkeyRes,
|
||||
_: &rpc_toolkit::RpcRequest,
|
||||
) -> Result<(), Error> {
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
impl AuthContext for TunnelContext {
|
||||
const LOCAL_AUTH_COOKIE_PATH: &str = "/run/start-tunnel/rpc.authcookie";
|
||||
const LOCAL_AUTH_COOKIE_OWNERSHIP: &str = "root:root";
|
||||
fn access_sessions(db: &mut Model<Self::Database>) -> &mut Model<crate::auth::Sessions> {
|
||||
db.as_sessions_mut()
|
||||
}
|
||||
fn ephemeral_sessions(&self) -> &SyncMutex<Sessions> {
|
||||
&self.ephemeral_sessions
|
||||
}
|
||||
fn open_authed_continuations(&self) -> &OpenAuthedContinuations<Option<InternedString>> {
|
||||
&self.open_authed_continuations
|
||||
}
|
||||
fn check_password(db: &Model<Self::Database>, password: &str) -> Result<(), Error> {
|
||||
check_password(&db.as_password().de()?, password)
|
||||
}
|
||||
}
|
||||
|
||||
impl CallRemote<TunnelContext> for CliContext {
|
||||
async fn call_remote(
|
||||
&self,
|
||||
mut method: &str,
|
||||
params: Value,
|
||||
_: Empty,
|
||||
) -> Result<Value, RpcError> {
|
||||
let tunnel_addr = if let Some(addr) = self.tunnel_addr {
|
||||
addr
|
||||
} else if let Some(addr) = self.tunnel_listen {
|
||||
addr
|
||||
} else {
|
||||
return Err(Error::new(eyre!("`--tunnel` required"), ErrorKind::InvalidRequest).into());
|
||||
};
|
||||
let sig_addr = self.tunnel_listen.unwrap_or(tunnel_addr);
|
||||
let url = format!("https://{tunnel_addr}").parse()?;
|
||||
|
||||
method = method.strip_prefix("tunnel.").unwrap_or(method);
|
||||
|
||||
crate::middleware::signature::call_remote(
|
||||
self,
|
||||
url,
|
||||
&InternedString::from_display(&sig_addr.ip()),
|
||||
method,
|
||||
params,
|
||||
)
|
||||
.await
|
||||
}
|
||||
}
|
||||
197
core/startos/src/tunnel/db.rs
Normal file
197
core/startos/src/tunnel/db.rs
Normal file
@@ -0,0 +1,197 @@
|
||||
use std::collections::{BTreeMap, HashSet};
|
||||
use std::net::{Ipv4Addr, SocketAddrV4};
|
||||
use std::path::PathBuf;
|
||||
|
||||
use clap::Parser;
|
||||
use imbl_value::InternedString;
|
||||
use ipnet::Ipv4Net;
|
||||
use itertools::Itertools;
|
||||
use patch_db::Dump;
|
||||
use patch_db::json_ptr::{JsonPointer, ROOT};
|
||||
use rpc_toolkit::yajrc::RpcError;
|
||||
use rpc_toolkit::{Context, HandlerArgs, HandlerExt, ParentHandler, from_fn_async};
|
||||
use serde::{Deserialize, Serialize};
|
||||
use tracing::instrument;
|
||||
use ts_rs::TS;
|
||||
|
||||
use crate::auth::Sessions;
|
||||
use crate::context::CliContext;
|
||||
use crate::prelude::*;
|
||||
use crate::sign::AnyVerifyingKey;
|
||||
use crate::tunnel::context::TunnelContext;
|
||||
use crate::tunnel::wg::WgServer;
|
||||
use crate::util::serde::{HandlerExtSerde, apply_expr};
|
||||
|
||||
#[derive(Default, Deserialize, Serialize, HasModel)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
#[model = "Model<Self>"]
|
||||
pub struct TunnelDatabase {
|
||||
pub sessions: Sessions,
|
||||
pub password: String,
|
||||
pub auth_pubkeys: HashSet<AnyVerifyingKey>,
|
||||
pub wg: WgServer,
|
||||
pub port_forwards: BTreeMap<SocketAddrV4, SocketAddrV4>,
|
||||
}
|
||||
|
||||
pub fn db_api<C: Context>() -> ParentHandler<C> {
|
||||
ParentHandler::new()
|
||||
.subcommand(
|
||||
"dump",
|
||||
from_fn_async(cli_dump)
|
||||
.with_display_serializable()
|
||||
.with_about("Filter/query db to display tables and records"),
|
||||
)
|
||||
.subcommand(
|
||||
"dump",
|
||||
from_fn_async(dump)
|
||||
.with_metadata("admin", Value::Bool(true))
|
||||
.no_cli(),
|
||||
)
|
||||
.subcommand(
|
||||
"apply",
|
||||
from_fn_async(cli_apply)
|
||||
.no_display()
|
||||
.with_about("Update a db record"),
|
||||
)
|
||||
.subcommand(
|
||||
"apply",
|
||||
from_fn_async(apply)
|
||||
.with_metadata("admin", Value::Bool(true))
|
||||
.no_cli(),
|
||||
)
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Serialize, Parser)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
#[command(rename_all = "kebab-case")]
|
||||
pub struct CliDumpParams {
|
||||
#[arg(long = "pointer", short = 'p')]
|
||||
pointer: Option<JsonPointer>,
|
||||
path: Option<PathBuf>,
|
||||
}
|
||||
|
||||
#[instrument(skip_all)]
|
||||
async fn cli_dump(
|
||||
HandlerArgs {
|
||||
context,
|
||||
parent_method,
|
||||
method,
|
||||
params: CliDumpParams { pointer, path },
|
||||
..
|
||||
}: HandlerArgs<CliContext, CliDumpParams>,
|
||||
) -> Result<Dump, RpcError> {
|
||||
let dump = if let Some(path) = path {
|
||||
PatchDb::open(path).await?.dump(&ROOT).await
|
||||
} else {
|
||||
let method = parent_method.into_iter().chain(method).join(".");
|
||||
from_value::<Dump>(
|
||||
context
|
||||
.call_remote::<TunnelContext>(&method, imbl_value::json!({ "pointer": pointer }))
|
||||
.await?,
|
||||
)?
|
||||
};
|
||||
|
||||
Ok(dump)
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Serialize, Parser, TS)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
#[command(rename_all = "kebab-case")]
|
||||
pub struct DumpParams {
|
||||
#[arg(long = "pointer", short = 'p')]
|
||||
#[ts(type = "string | null")]
|
||||
pointer: Option<JsonPointer>,
|
||||
}
|
||||
|
||||
pub async fn dump(ctx: TunnelContext, DumpParams { pointer }: DumpParams) -> Result<Dump, Error> {
|
||||
Ok(ctx
|
||||
.db
|
||||
.dump(&pointer.as_ref().map_or(ROOT, |p| p.borrowed()))
|
||||
.await)
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Serialize, Parser)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
#[command(rename_all = "kebab-case")]
|
||||
pub struct CliApplyParams {
|
||||
expr: String,
|
||||
path: Option<PathBuf>,
|
||||
}
|
||||
|
||||
#[instrument(skip_all)]
|
||||
async fn cli_apply(
|
||||
HandlerArgs {
|
||||
context,
|
||||
parent_method,
|
||||
method,
|
||||
params: CliApplyParams { expr, path },
|
||||
..
|
||||
}: HandlerArgs<CliContext, CliApplyParams>,
|
||||
) -> Result<(), RpcError> {
|
||||
if let Some(path) = path {
|
||||
PatchDb::open(path)
|
||||
.await?
|
||||
.apply_function(|db| {
|
||||
let res = apply_expr(
|
||||
serde_json::to_value(patch_db::Value::from(db))
|
||||
.with_kind(ErrorKind::Deserialization)?
|
||||
.into(),
|
||||
&expr,
|
||||
)?;
|
||||
|
||||
Ok::<_, Error>((
|
||||
to_value(
|
||||
&serde_json::from_value::<TunnelDatabase>(res.clone().into()).with_ctx(
|
||||
|_| {
|
||||
(
|
||||
crate::ErrorKind::Deserialization,
|
||||
"result does not match database model",
|
||||
)
|
||||
},
|
||||
)?,
|
||||
)?,
|
||||
(),
|
||||
))
|
||||
})
|
||||
.await
|
||||
.result?;
|
||||
} else {
|
||||
let method = parent_method.into_iter().chain(method).join(".");
|
||||
context
|
||||
.call_remote::<TunnelContext>(&method, imbl_value::json!({ "expr": expr }))
|
||||
.await?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Serialize, Parser, TS)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
#[command(rename_all = "kebab-case")]
|
||||
pub struct ApplyParams {
|
||||
expr: String,
|
||||
path: Option<PathBuf>,
|
||||
}
|
||||
|
||||
pub async fn apply(ctx: TunnelContext, ApplyParams { expr, .. }: ApplyParams) -> Result<(), Error> {
|
||||
ctx.db
|
||||
.mutate(|db| {
|
||||
let res = apply_expr(
|
||||
serde_json::to_value(patch_db::Value::from(db.clone()))
|
||||
.with_kind(ErrorKind::Deserialization)?
|
||||
.into(),
|
||||
&expr,
|
||||
)?;
|
||||
|
||||
db.ser(
|
||||
&serde_json::from_value::<TunnelDatabase>(res.clone().into()).with_ctx(|_| {
|
||||
(
|
||||
crate::ErrorKind::Deserialization,
|
||||
"result does not match database model",
|
||||
)
|
||||
})?,
|
||||
)
|
||||
})
|
||||
.await
|
||||
.result
|
||||
}
|
||||
1
core/startos/src/tunnel/forward.rs
Normal file
1
core/startos/src/tunnel/forward.rs
Normal file
@@ -0,0 +1 @@
|
||||
use crate::prelude::*;
|
||||
82
core/startos/src/tunnel/mod.rs
Normal file
82
core/startos/src/tunnel/mod.rs
Normal file
@@ -0,0 +1,82 @@
|
||||
use axum::Router;
|
||||
use futures::future::ready;
|
||||
use rpc_toolkit::{Context, HandlerExt, ParentHandler, Server, from_fn_async};
|
||||
|
||||
use crate::context::CliContext;
|
||||
use crate::middleware::auth::Auth;
|
||||
use crate::middleware::cors::Cors;
|
||||
use crate::net::static_server::{bad_request, not_found, server_error};
|
||||
use crate::net::web_server::{Accept, WebServer};
|
||||
use crate::prelude::*;
|
||||
use crate::rpc_continuations::Guid;
|
||||
use crate::tunnel::context::TunnelContext;
|
||||
|
||||
pub mod api;
|
||||
pub mod context;
|
||||
pub mod db;
|
||||
pub mod forward;
|
||||
pub mod wg;
|
||||
|
||||
pub const TUNNEL_DEFAULT_PORT: u16 = 5960;
|
||||
|
||||
pub fn tunnel_router(ctx: TunnelContext) -> Router {
|
||||
use axum::extract as x;
|
||||
use axum::routing::{any, get};
|
||||
Router::new()
|
||||
.route("/rpc/{*path}", {
|
||||
let ctx = ctx.clone();
|
||||
any(
|
||||
Server::new(move || ready(Ok(ctx.clone())), api::tunnel_api())
|
||||
.middleware(Cors::new())
|
||||
.middleware(Auth::new())
|
||||
)
|
||||
})
|
||||
.route(
|
||||
"/ws/rpc/{*path}",
|
||||
get({
|
||||
let ctx = ctx.clone();
|
||||
move |x::Path(path): x::Path<String>,
|
||||
ws: axum::extract::ws::WebSocketUpgrade| async move {
|
||||
match Guid::from(&path) {
|
||||
None => {
|
||||
tracing::debug!("No Guid Path");
|
||||
bad_request()
|
||||
}
|
||||
Some(guid) => match ctx.rpc_continuations.get_ws_handler(&guid).await {
|
||||
Some(cont) => ws.on_upgrade(cont),
|
||||
_ => not_found(),
|
||||
},
|
||||
}
|
||||
}
|
||||
}),
|
||||
)
|
||||
.route(
|
||||
"/rest/rpc/{*path}",
|
||||
any({
|
||||
let ctx = ctx.clone();
|
||||
move |request: x::Request| async move {
|
||||
let path = request
|
||||
.uri()
|
||||
.path()
|
||||
.strip_prefix("/rest/rpc/")
|
||||
.unwrap_or_default();
|
||||
match Guid::from(&path) {
|
||||
None => {
|
||||
tracing::debug!("No Guid Path");
|
||||
bad_request()
|
||||
}
|
||||
Some(guid) => match ctx.rpc_continuations.get_rest_handler(&guid).await {
|
||||
None => not_found(),
|
||||
Some(cont) => cont(request).await.unwrap_or_else(server_error),
|
||||
},
|
||||
}
|
||||
}
|
||||
}),
|
||||
)
|
||||
}
|
||||
|
||||
impl<A: Accept + Send + Sync + 'static> WebServer<A> {
|
||||
pub fn serve_tunnel(&mut self, ctx: TunnelContext) {
|
||||
self.serve_router(tunnel_router(ctx))
|
||||
}
|
||||
}
|
||||
4
core/startos/src/tunnel/server-peer.conf.template
Normal file
4
core/startos/src/tunnel/server-peer.conf.template
Normal file
@@ -0,0 +1,4 @@
|
||||
[Peer]
|
||||
PublicKey = {pubkey}
|
||||
PresharedKey = {psk}
|
||||
AllowedIPs = {addr}/32
|
||||
5
core/startos/src/tunnel/server.conf.template
Normal file
5
core/startos/src/tunnel/server.conf.template
Normal file
@@ -0,0 +1,5 @@
|
||||
[Interface]
|
||||
Address = {subnets}
|
||||
PrivateKey = {server_privkey}
|
||||
ListenPort = {server_port}
|
||||
|
||||
220
core/startos/src/tunnel/wg.rs
Normal file
220
core/startos/src/tunnel/wg.rs
Normal file
@@ -0,0 +1,220 @@
|
||||
use std::collections::BTreeMap;
|
||||
use std::net::{Ipv4Addr, SocketAddrV4};
|
||||
|
||||
use ed25519_dalek::{SigningKey, VerifyingKey};
|
||||
use imbl_value::InternedString;
|
||||
use ipnet::Ipv4Net;
|
||||
use itertools::Itertools;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use tokio::process::Command;
|
||||
|
||||
use crate::prelude::*;
|
||||
use crate::util::Invoke;
|
||||
use crate::util::io::write_file_atomic;
|
||||
use crate::util::serde::Base64;
|
||||
|
||||
#[derive(Deserialize, Serialize, HasModel)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
#[model = "Model<Self>"]
|
||||
pub struct WgServer {
|
||||
pub port: u16,
|
||||
pub key: Base64<WgKey>,
|
||||
pub subnets: WgSubnetMap,
|
||||
}
|
||||
impl Default for WgServer {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
port: 51820,
|
||||
key: Base64(WgKey::generate()),
|
||||
subnets: WgSubnetMap::default(),
|
||||
}
|
||||
}
|
||||
}
|
||||
impl WgServer {
|
||||
pub fn server_config<'a>(&'a self) -> ServerConfig<'a> {
|
||||
ServerConfig(self)
|
||||
}
|
||||
pub async fn sync(&self) -> Result<(), Error> {
|
||||
Command::new("wg-quick")
|
||||
.arg("down")
|
||||
.arg("wg0")
|
||||
.invoke(ErrorKind::Network)
|
||||
.await
|
||||
.or_else(|e| {
|
||||
let msg = e.source.to_string();
|
||||
if msg.contains("does not exist") || msg.contains("is not a WireGuard interface") {
|
||||
Ok(Vec::new())
|
||||
} else {
|
||||
Err(e)
|
||||
}
|
||||
})?;
|
||||
write_file_atomic(
|
||||
"/etc/wireguard/wg0.conf",
|
||||
self.server_config().to_string().as_bytes(),
|
||||
)
|
||||
.await?;
|
||||
Command::new("wg-quick")
|
||||
.arg("up")
|
||||
.arg("wg0")
|
||||
.invoke(ErrorKind::Network)
|
||||
.await?;
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Default, Deserialize, Serialize)]
|
||||
pub struct WgSubnetMap(pub BTreeMap<Ipv4Net, WgSubnetConfig>);
|
||||
impl Map for WgSubnetMap {
|
||||
type Key = Ipv4Net;
|
||||
type Value = WgSubnetConfig;
|
||||
fn key_str(key: &Self::Key) -> Result<impl AsRef<str>, Error> {
|
||||
Self::key_string(key)
|
||||
}
|
||||
fn key_string(key: &Self::Key) -> Result<InternedString, Error> {
|
||||
Ok(InternedString::from_display(key))
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Default, Deserialize, Serialize, HasModel)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
#[model = "Model<Self>"]
|
||||
pub struct WgSubnetConfig {
|
||||
pub default_forward_target: Option<Ipv4Addr>,
|
||||
pub clients: BTreeMap<Ipv4Addr, WgConfig>,
|
||||
}
|
||||
impl WgSubnetConfig {
|
||||
pub fn new() -> Self {
|
||||
Self::default()
|
||||
}
|
||||
pub fn add_client<'a>(
|
||||
&'a mut self,
|
||||
subnet: Ipv4Net,
|
||||
) -> Result<(Ipv4Addr, &'a WgConfig), Error> {
|
||||
let addr = subnet
|
||||
.hosts()
|
||||
.find(|a| !self.clients.contains_key(a))
|
||||
.ok_or_else(|| Error::new(eyre!("subnet exhausted"), ErrorKind::Network))?;
|
||||
let config = self.clients.entry(addr).or_insert(WgConfig::generate());
|
||||
Ok((addr, config))
|
||||
}
|
||||
}
|
||||
|
||||
pub struct WgKey(SigningKey);
|
||||
impl WgKey {
|
||||
pub fn generate() -> Self {
|
||||
Self(SigningKey::generate(
|
||||
&mut ssh_key::rand_core::OsRng::default(),
|
||||
))
|
||||
}
|
||||
}
|
||||
impl AsRef<[u8]> for WgKey {
|
||||
fn as_ref(&self) -> &[u8] {
|
||||
self.0.as_bytes()
|
||||
}
|
||||
}
|
||||
impl TryFrom<Vec<u8>> for WgKey {
|
||||
type Error = ed25519_dalek::SignatureError;
|
||||
fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> {
|
||||
Ok(Self(value.as_slice().try_into()?))
|
||||
}
|
||||
}
|
||||
impl std::ops::Deref for WgKey {
|
||||
type Target = SigningKey;
|
||||
fn deref(&self) -> &Self::Target {
|
||||
&self.0
|
||||
}
|
||||
}
|
||||
impl Base64<WgKey> {
|
||||
pub fn verifying_key(&self) -> Base64<VerifyingKey> {
|
||||
Base64(self.0.verifying_key())
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Serialize, HasModel)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
#[model = "Model<Self>"]
|
||||
pub struct WgConfig {
|
||||
pub key: Base64<WgKey>,
|
||||
pub psk: Base64<[u8; 32]>,
|
||||
}
|
||||
impl WgConfig {
|
||||
pub fn generate() -> Self {
|
||||
Self {
|
||||
key: Base64(WgKey::generate()),
|
||||
psk: Base64(rand::random()),
|
||||
}
|
||||
}
|
||||
pub fn server_peer_config<'a>(&'a self, addr: Ipv4Addr) -> ServerPeerConfig<'a> {
|
||||
ServerPeerConfig {
|
||||
client_config: self,
|
||||
client_addr: addr,
|
||||
}
|
||||
}
|
||||
pub fn client_config<'a>(
|
||||
&'a self,
|
||||
addr: Ipv4Addr,
|
||||
server_pubkey: Base64<VerifyingKey>,
|
||||
server_addr: SocketAddrV4,
|
||||
) -> ClientConfig<'a> {
|
||||
ClientConfig {
|
||||
client_config: self,
|
||||
client_addr: addr,
|
||||
server_pubkey,
|
||||
server_addr,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub struct ServerPeerConfig<'a> {
|
||||
client_config: &'a WgConfig,
|
||||
client_addr: Ipv4Addr,
|
||||
}
|
||||
impl<'a> std::fmt::Display for ServerPeerConfig<'a> {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
||||
write!(
|
||||
f,
|
||||
include_str!("./server-peer.conf.template"),
|
||||
pubkey = self.client_config.key.verifying_key().to_padded_string(),
|
||||
psk = self.client_config.psk.to_padded_string(),
|
||||
addr = self.client_addr,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
pub struct ClientConfig<'a> {
|
||||
client_config: &'a WgConfig,
|
||||
client_addr: Ipv4Addr,
|
||||
server_pubkey: Base64<VerifyingKey>,
|
||||
server_addr: SocketAddrV4,
|
||||
}
|
||||
impl<'a> std::fmt::Display for ClientConfig<'a> {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
||||
write!(
|
||||
f,
|
||||
include_str!("./client.conf.template"),
|
||||
privkey = self.client_config.key.to_padded_string(),
|
||||
psk = self.client_config.psk,
|
||||
addr = self.client_addr,
|
||||
server_pubkey = self.server_pubkey.to_padded_string(),
|
||||
server_addr = self.server_addr,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
pub struct ServerConfig<'a>(&'a WgServer);
|
||||
impl<'a> std::fmt::Display for ServerConfig<'a> {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
||||
let Self(server) = *self;
|
||||
write!(
|
||||
f,
|
||||
include_str!("./server.conf.template"),
|
||||
subnets = server.subnets.0.keys().join(", "),
|
||||
server_port = server.port,
|
||||
server_privkey = server.key.to_padded_string(),
|
||||
)?;
|
||||
for (addr, peer) in server.subnets.0.values().flat_map(|s| &s.clients) {
|
||||
write!(f, "{}", peer.server_peer_config(*addr))?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user