forked from wrenn/wrenn
feat: rewrite envd guest agent in Rust (envd-rs)
Complete Rust rewrite of the Go envd guest daemon that runs as PID 1 inside Firecracker microVMs. Feature-complete across all 8 phases: - Health, metrics, and env var endpoints - Crypto (SHA-256/512, HMAC), auth (secure token, signing), init/snapshot - Connect RPC via connectrpc + buffa (process + filesystem services) - File transfer (GET/POST /files) with gzip, multipart, chown, ENOSPC - Port subsystem (/proc/net/tcp scanner, socat forwarder) - Cgroup2 manager with noop fallback - Snapshot/restore lifecycle (conntracker, port subsystem stop/restart) - SIGTERM graceful shutdown, --cmd initial process spawn - MMDS metadata polling for Firecracker mode 42 source files, ~4200 LOC, 4.1MB stripped release binary. Makefile updated: build-envd now targets Rust (musl static), build-envd-go preserved for Go builds.
This commit is contained in:
147
envd-rs/src/http/encoding.rs
Normal file
147
envd-rs/src/http/encoding.rs
Normal file
@ -0,0 +1,147 @@
|
||||
use axum::http::Request;
|
||||
|
||||
const ENCODING_GZIP: &str = "gzip";
|
||||
const ENCODING_IDENTITY: &str = "identity";
|
||||
const ENCODING_WILDCARD: &str = "*";
|
||||
|
||||
const SUPPORTED_ENCODINGS: &[&str] = &[ENCODING_GZIP];
|
||||
|
||||
struct EncodingWithQuality {
|
||||
encoding: String,
|
||||
quality: f64,
|
||||
}
|
||||
|
||||
fn parse_encoding_with_quality(value: &str) -> EncodingWithQuality {
|
||||
let value = value.trim();
|
||||
let mut quality = 1.0;
|
||||
|
||||
if let Some(idx) = value.find(';') {
|
||||
let params = &value[idx + 1..];
|
||||
let enc = value[..idx].trim();
|
||||
for param in params.split(';') {
|
||||
let param = param.trim();
|
||||
if let Some(stripped) = param.strip_prefix("q=").or_else(|| param.strip_prefix("Q=")) {
|
||||
if let Ok(q) = stripped.parse::<f64>() {
|
||||
quality = q;
|
||||
}
|
||||
}
|
||||
}
|
||||
return EncodingWithQuality {
|
||||
encoding: enc.to_ascii_lowercase(),
|
||||
quality,
|
||||
};
|
||||
}
|
||||
|
||||
EncodingWithQuality {
|
||||
encoding: value.to_ascii_lowercase(),
|
||||
quality,
|
||||
}
|
||||
}
|
||||
|
||||
fn parse_accept_encoding_header(header: &str) -> (Vec<EncodingWithQuality>, bool) {
|
||||
if header.is_empty() {
|
||||
return (Vec::new(), false);
|
||||
}
|
||||
|
||||
let encodings: Vec<EncodingWithQuality> =
|
||||
header.split(',').map(|v| parse_encoding_with_quality(v)).collect();
|
||||
|
||||
let mut identity_rejected = false;
|
||||
let mut identity_explicitly_accepted = false;
|
||||
let mut wildcard_rejected = false;
|
||||
|
||||
for eq in &encodings {
|
||||
match eq.encoding.as_str() {
|
||||
ENCODING_IDENTITY => {
|
||||
if eq.quality == 0.0 {
|
||||
identity_rejected = true;
|
||||
} else {
|
||||
identity_explicitly_accepted = true;
|
||||
}
|
||||
}
|
||||
ENCODING_WILDCARD => {
|
||||
if eq.quality == 0.0 {
|
||||
wildcard_rejected = true;
|
||||
}
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
|
||||
if wildcard_rejected && !identity_explicitly_accepted {
|
||||
identity_rejected = true;
|
||||
}
|
||||
|
||||
(encodings, identity_rejected)
|
||||
}
|
||||
|
||||
pub fn is_identity_acceptable<B>(r: &Request<B>) -> bool {
|
||||
let header = r
|
||||
.headers()
|
||||
.get("accept-encoding")
|
||||
.and_then(|v| v.to_str().ok())
|
||||
.unwrap_or("");
|
||||
let (_, rejected) = parse_accept_encoding_header(header);
|
||||
!rejected
|
||||
}
|
||||
|
||||
pub fn parse_accept_encoding<B>(r: &Request<B>) -> Result<&'static str, String> {
|
||||
let header = r
|
||||
.headers()
|
||||
.get("accept-encoding")
|
||||
.and_then(|v| v.to_str().ok())
|
||||
.unwrap_or("");
|
||||
|
||||
if header.is_empty() {
|
||||
return Ok(ENCODING_IDENTITY);
|
||||
}
|
||||
|
||||
let (mut encodings, identity_rejected) = parse_accept_encoding_header(header);
|
||||
encodings.sort_by(|a, b| b.quality.partial_cmp(&a.quality).unwrap_or(std::cmp::Ordering::Equal));
|
||||
|
||||
for eq in &encodings {
|
||||
if eq.quality == 0.0 {
|
||||
continue;
|
||||
}
|
||||
if eq.encoding == ENCODING_IDENTITY {
|
||||
return Ok(ENCODING_IDENTITY);
|
||||
}
|
||||
if eq.encoding == ENCODING_WILDCARD {
|
||||
if identity_rejected && !SUPPORTED_ENCODINGS.is_empty() {
|
||||
return Ok(SUPPORTED_ENCODINGS[0]);
|
||||
}
|
||||
return Ok(ENCODING_IDENTITY);
|
||||
}
|
||||
if eq.encoding == ENCODING_GZIP {
|
||||
return Ok(ENCODING_GZIP);
|
||||
}
|
||||
}
|
||||
|
||||
if !identity_rejected {
|
||||
return Ok(ENCODING_IDENTITY);
|
||||
}
|
||||
|
||||
Err(format!("no acceptable encoding found, supported: {SUPPORTED_ENCODINGS:?}"))
|
||||
}
|
||||
|
||||
pub fn parse_content_encoding<B>(r: &Request<B>) -> Result<&'static str, String> {
|
||||
let header = r
|
||||
.headers()
|
||||
.get("content-encoding")
|
||||
.and_then(|v| v.to_str().ok())
|
||||
.unwrap_or("");
|
||||
|
||||
if header.is_empty() {
|
||||
return Ok(ENCODING_IDENTITY);
|
||||
}
|
||||
|
||||
let encoding = header.trim().to_ascii_lowercase();
|
||||
if encoding == ENCODING_IDENTITY {
|
||||
return Ok(ENCODING_IDENTITY);
|
||||
}
|
||||
if SUPPORTED_ENCODINGS.contains(&encoding.as_str()) {
|
||||
return Ok(ENCODING_GZIP);
|
||||
}
|
||||
|
||||
Err(format!("unsupported Content-Encoding: {header}, supported: {SUPPORTED_ENCODINGS:?}"))
|
||||
}
|
||||
25
envd-rs/src/http/envs.rs
Normal file
25
envd-rs/src/http/envs.rs
Normal file
@ -0,0 +1,25 @@
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::Json;
|
||||
use axum::extract::State;
|
||||
use axum::http::header;
|
||||
use axum::response::IntoResponse;
|
||||
|
||||
use crate::state::AppState;
|
||||
|
||||
pub async fn get_envs(State(state): State<Arc<AppState>>) -> impl IntoResponse {
|
||||
tracing::debug!("getting env vars");
|
||||
|
||||
let envs: HashMap<String, String> = state
|
||||
.defaults
|
||||
.env_vars
|
||||
.iter()
|
||||
.map(|entry| (entry.key().clone(), entry.value().clone()))
|
||||
.collect();
|
||||
|
||||
(
|
||||
[(header::CACHE_CONTROL, "no-store")],
|
||||
Json(envs),
|
||||
)
|
||||
}
|
||||
20
envd-rs/src/http/error.rs
Normal file
20
envd-rs/src/http/error.rs
Normal file
@ -0,0 +1,20 @@
|
||||
use axum::Json;
|
||||
use axum::http::StatusCode;
|
||||
use axum::response::IntoResponse;
|
||||
use serde::Serialize;
|
||||
|
||||
#[derive(Serialize)]
|
||||
struct ErrorBody {
|
||||
code: u16,
|
||||
message: String,
|
||||
}
|
||||
|
||||
pub fn json_error(status: StatusCode, message: &str) -> impl IntoResponse {
|
||||
(
|
||||
status,
|
||||
Json(ErrorBody {
|
||||
code: status.as_u16(),
|
||||
message: message.to_string(),
|
||||
}),
|
||||
)
|
||||
}
|
||||
443
envd-rs/src/http/files.rs
Normal file
443
envd-rs/src/http/files.rs
Normal file
@ -0,0 +1,443 @@
|
||||
use std::io::Write as _;
|
||||
use std::path::Path;
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::body::Body;
|
||||
use axum::extract::{FromRequest, Query, Request, State};
|
||||
use axum::http::{StatusCode, header};
|
||||
use axum::response::{IntoResponse, Response};
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
use crate::auth::signing;
|
||||
use crate::execcontext;
|
||||
use crate::http::encoding;
|
||||
use crate::permissions::path::{ensure_dirs, expand_and_resolve};
|
||||
use crate::permissions::user::lookup_user;
|
||||
use crate::state::AppState;
|
||||
|
||||
const ACCESS_TOKEN_HEADER: &str = "x-access-token";
|
||||
|
||||
#[derive(Deserialize)]
|
||||
pub struct FileParams {
|
||||
pub path: Option<String>,
|
||||
pub username: Option<String>,
|
||||
pub signature: Option<String>,
|
||||
pub signature_expiration: Option<i64>,
|
||||
}
|
||||
|
||||
#[derive(Serialize)]
|
||||
struct EntryInfo {
|
||||
path: String,
|
||||
name: String,
|
||||
r#type: &'static str,
|
||||
}
|
||||
|
||||
fn json_error(status: StatusCode, msg: &str) -> Response {
|
||||
let body = serde_json::json!({ "code": status.as_u16(), "message": msg });
|
||||
(status, axum::Json(body)).into_response()
|
||||
}
|
||||
|
||||
fn extract_header_token(req: &Request) -> Option<&str> {
|
||||
req.headers()
|
||||
.get(ACCESS_TOKEN_HEADER)
|
||||
.and_then(|v| v.to_str().ok())
|
||||
}
|
||||
|
||||
fn validate_file_signing(
|
||||
state: &AppState,
|
||||
header_token: Option<&str>,
|
||||
params: &FileParams,
|
||||
path: &str,
|
||||
operation: &str,
|
||||
username: &str,
|
||||
) -> Result<(), String> {
|
||||
signing::validate_signing(
|
||||
&state.access_token,
|
||||
header_token,
|
||||
params.signature.as_deref(),
|
||||
params.signature_expiration,
|
||||
username,
|
||||
path,
|
||||
operation,
|
||||
)
|
||||
}
|
||||
|
||||
/// GET /files — download a file
|
||||
pub async fn get_files(
|
||||
State(state): State<Arc<AppState>>,
|
||||
Query(params): Query<FileParams>,
|
||||
req: Request,
|
||||
) -> Response {
|
||||
let path_str = params.path.as_deref().unwrap_or("");
|
||||
let header_token = extract_header_token(&req);
|
||||
|
||||
let username = match execcontext::resolve_default_username(
|
||||
params.username.as_deref(),
|
||||
&state.defaults.user,
|
||||
) {
|
||||
Ok(u) => u.to_string(),
|
||||
Err(e) => return json_error(StatusCode::BAD_REQUEST, e),
|
||||
};
|
||||
|
||||
if let Err(e) = validate_file_signing(
|
||||
&state,
|
||||
header_token,
|
||||
¶ms,
|
||||
path_str,
|
||||
signing::READ_OPERATION,
|
||||
&username,
|
||||
) {
|
||||
return json_error(StatusCode::UNAUTHORIZED, &e);
|
||||
}
|
||||
|
||||
let user = match lookup_user(&username) {
|
||||
Ok(u) => u,
|
||||
Err(e) => return json_error(StatusCode::UNAUTHORIZED, &e),
|
||||
};
|
||||
|
||||
let home_dir = format!("/home/{}", user.name);
|
||||
let resolved = match expand_and_resolve(path_str, &home_dir, state.defaults.workdir.as_deref())
|
||||
{
|
||||
Ok(p) => p,
|
||||
Err(e) => return json_error(StatusCode::BAD_REQUEST, &e),
|
||||
};
|
||||
|
||||
let meta = match std::fs::metadata(&resolved) {
|
||||
Ok(m) => m,
|
||||
Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
|
||||
return json_error(
|
||||
StatusCode::NOT_FOUND,
|
||||
&format!("path '{}' does not exist", resolved),
|
||||
);
|
||||
}
|
||||
Err(e) => {
|
||||
return json_error(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
&format!("error checking path: {e}"),
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
if meta.is_dir() {
|
||||
return json_error(
|
||||
StatusCode::BAD_REQUEST,
|
||||
&format!("path '{}' is a directory", resolved),
|
||||
);
|
||||
}
|
||||
|
||||
if !meta.file_type().is_file() {
|
||||
return json_error(
|
||||
StatusCode::BAD_REQUEST,
|
||||
&format!("path '{}' is not a regular file", resolved),
|
||||
);
|
||||
}
|
||||
|
||||
let accept_enc = match encoding::parse_accept_encoding(&req) {
|
||||
Ok(e) => e,
|
||||
Err(e) => return json_error(StatusCode::NOT_ACCEPTABLE, &e),
|
||||
};
|
||||
|
||||
let has_range_or_conditional = req.headers().get("range").is_some()
|
||||
|| req.headers().get("if-modified-since").is_some()
|
||||
|| req.headers().get("if-none-match").is_some()
|
||||
|| req.headers().get("if-range").is_some();
|
||||
|
||||
let use_encoding = if has_range_or_conditional {
|
||||
if !encoding::is_identity_acceptable(&req) {
|
||||
return json_error(
|
||||
StatusCode::NOT_ACCEPTABLE,
|
||||
"identity encoding not acceptable for Range or conditional request",
|
||||
);
|
||||
}
|
||||
"identity"
|
||||
} else {
|
||||
accept_enc
|
||||
};
|
||||
|
||||
let file_data = match std::fs::read(&resolved) {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
return json_error(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
&format!("error reading file: {e}"),
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
let filename = Path::new(&resolved)
|
||||
.file_name()
|
||||
.map(|n| n.to_string_lossy().to_string())
|
||||
.unwrap_or_default();
|
||||
|
||||
let content_disposition = format!("inline; filename=\"{}\"", filename);
|
||||
let content_type = mime_guess::from_path(&resolved)
|
||||
.first_raw()
|
||||
.unwrap_or("application/octet-stream");
|
||||
|
||||
if use_encoding == "gzip" {
|
||||
let mut encoder =
|
||||
flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
|
||||
if let Err(e) = encoder.write_all(&file_data) {
|
||||
return json_error(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
&format!("gzip encoding error: {e}"),
|
||||
);
|
||||
}
|
||||
let compressed = match encoder.finish() {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
return json_error(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
&format!("gzip finish error: {e}"),
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
return Response::builder()
|
||||
.status(StatusCode::OK)
|
||||
.header(header::CONTENT_TYPE, content_type)
|
||||
.header(header::CONTENT_ENCODING, "gzip")
|
||||
.header(header::CONTENT_DISPOSITION, content_disposition)
|
||||
.header(header::VARY, "Accept-Encoding")
|
||||
.body(Body::from(compressed))
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
Response::builder()
|
||||
.status(StatusCode::OK)
|
||||
.header(header::CONTENT_TYPE, content_type)
|
||||
.header(header::CONTENT_DISPOSITION, content_disposition)
|
||||
.header(header::VARY, "Accept-Encoding")
|
||||
.header(header::CONTENT_LENGTH, file_data.len())
|
||||
.body(Body::from(file_data))
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
/// POST /files — upload file(s) via multipart
|
||||
pub async fn post_files(
|
||||
State(state): State<Arc<AppState>>,
|
||||
Query(params): Query<FileParams>,
|
||||
req: Request,
|
||||
) -> Response {
|
||||
let path_str = params.path.as_deref().unwrap_or("");
|
||||
let header_token = extract_header_token(&req);
|
||||
|
||||
let username = match execcontext::resolve_default_username(
|
||||
params.username.as_deref(),
|
||||
&state.defaults.user,
|
||||
) {
|
||||
Ok(u) => u.to_string(),
|
||||
Err(e) => return json_error(StatusCode::BAD_REQUEST, e),
|
||||
};
|
||||
|
||||
if let Err(e) = validate_file_signing(
|
||||
&state,
|
||||
header_token,
|
||||
¶ms,
|
||||
path_str,
|
||||
signing::WRITE_OPERATION,
|
||||
&username,
|
||||
) {
|
||||
return json_error(StatusCode::UNAUTHORIZED, &e);
|
||||
}
|
||||
|
||||
let user = match lookup_user(&username) {
|
||||
Ok(u) => u,
|
||||
Err(e) => return json_error(StatusCode::UNAUTHORIZED, &e),
|
||||
};
|
||||
|
||||
let home_dir = format!("/home/{}", user.name);
|
||||
let uid = user.uid;
|
||||
let gid = user.gid;
|
||||
|
||||
let content_enc = match encoding::parse_content_encoding(&req) {
|
||||
Ok(e) => e,
|
||||
Err(e) => return json_error(StatusCode::BAD_REQUEST, &e),
|
||||
};
|
||||
|
||||
let mut multipart = match axum::extract::Multipart::from_request(req, &()).await {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
return json_error(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
&format!("error parsing multipart: {e}"),
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
let mut uploaded: Vec<EntryInfo> = Vec::new();
|
||||
|
||||
while let Ok(Some(field)) = multipart.next_field().await {
|
||||
let field_name = field.name().unwrap_or("").to_string();
|
||||
if field_name != "file" {
|
||||
continue;
|
||||
}
|
||||
|
||||
let file_path = if !path_str.is_empty() {
|
||||
match expand_and_resolve(path_str, &home_dir, state.defaults.workdir.as_deref()) {
|
||||
Ok(p) => p,
|
||||
Err(e) => return json_error(StatusCode::BAD_REQUEST, &e),
|
||||
}
|
||||
} else {
|
||||
let fname = field
|
||||
.file_name()
|
||||
.unwrap_or("upload")
|
||||
.to_string();
|
||||
match expand_and_resolve(&fname, &home_dir, state.defaults.workdir.as_deref()) {
|
||||
Ok(p) => p,
|
||||
Err(e) => return json_error(StatusCode::BAD_REQUEST, &e),
|
||||
}
|
||||
};
|
||||
|
||||
if uploaded.iter().any(|e| e.path == file_path) {
|
||||
return json_error(
|
||||
StatusCode::BAD_REQUEST,
|
||||
&format!("cannot upload multiple files to same path '{}'", file_path),
|
||||
);
|
||||
}
|
||||
|
||||
let raw_bytes = match field.bytes().await {
|
||||
Ok(b) => b,
|
||||
Err(e) => {
|
||||
return json_error(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
&format!("error reading field: {e}"),
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
let data = if content_enc == "gzip" {
|
||||
use std::io::Read;
|
||||
let mut decoder = flate2::read::GzDecoder::new(&raw_bytes[..]);
|
||||
let mut buf = Vec::new();
|
||||
match decoder.read_to_end(&mut buf) {
|
||||
Ok(_) => buf,
|
||||
Err(e) => {
|
||||
return json_error(
|
||||
StatusCode::BAD_REQUEST,
|
||||
&format!("gzip decompression failed: {e}"),
|
||||
);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
raw_bytes.to_vec()
|
||||
};
|
||||
|
||||
if let Err(e) = process_file(&file_path, &data, uid, gid) {
|
||||
let (status, msg) = e;
|
||||
return json_error(status, &msg);
|
||||
}
|
||||
|
||||
let name = Path::new(&file_path)
|
||||
.file_name()
|
||||
.map(|n| n.to_string_lossy().to_string())
|
||||
.unwrap_or_default();
|
||||
|
||||
uploaded.push(EntryInfo {
|
||||
path: file_path,
|
||||
name,
|
||||
r#type: "file",
|
||||
});
|
||||
}
|
||||
|
||||
axum::Json(uploaded).into_response()
|
||||
}
|
||||
|
||||
fn process_file(
|
||||
path: &str,
|
||||
data: &[u8],
|
||||
uid: nix::unistd::Uid,
|
||||
gid: nix::unistd::Gid,
|
||||
) -> Result<(), (StatusCode, String)> {
|
||||
let dir = Path::new(path)
|
||||
.parent()
|
||||
.map(|p| p.to_string_lossy().to_string())
|
||||
.unwrap_or_default();
|
||||
|
||||
if !dir.is_empty() {
|
||||
ensure_dirs(&dir, uid, gid).map_err(|e| {
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
format!("error ensuring directories: {e}"),
|
||||
)
|
||||
})?;
|
||||
}
|
||||
|
||||
let can_pre_chown = match std::fs::metadata(path) {
|
||||
Ok(meta) => {
|
||||
if meta.is_dir() {
|
||||
return Err((
|
||||
StatusCode::BAD_REQUEST,
|
||||
format!("path is a directory: {path}"),
|
||||
));
|
||||
}
|
||||
true
|
||||
}
|
||||
Err(e) if e.kind() == std::io::ErrorKind::NotFound => false,
|
||||
Err(e) => {
|
||||
return Err((
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
format!("error getting file info: {e}"),
|
||||
))
|
||||
}
|
||||
};
|
||||
|
||||
let mut chowned = false;
|
||||
if can_pre_chown {
|
||||
match std::os::unix::fs::chown(path, Some(uid.as_raw()), Some(gid.as_raw())) {
|
||||
Ok(()) => chowned = true,
|
||||
Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
|
||||
Err(e) => {
|
||||
return Err((
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
format!("error changing ownership: {e}"),
|
||||
))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
let mut file = std::fs::OpenOptions::new()
|
||||
.write(true)
|
||||
.create(true)
|
||||
.truncate(true)
|
||||
.mode(0o666)
|
||||
.open(path)
|
||||
.map_err(|e| {
|
||||
if e.raw_os_error() == Some(libc::ENOSPC) {
|
||||
return (
|
||||
StatusCode::INSUFFICIENT_STORAGE,
|
||||
"not enough disk space available".to_string(),
|
||||
);
|
||||
}
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
format!("error opening file: {e}"),
|
||||
)
|
||||
})?;
|
||||
|
||||
if !chowned {
|
||||
std::os::unix::fs::chown(path, Some(uid.as_raw()), Some(gid.as_raw())).map_err(|e| {
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
format!("error changing ownership: {e}"),
|
||||
)
|
||||
})?;
|
||||
}
|
||||
|
||||
file.write_all(data).map_err(|e| {
|
||||
if e.raw_os_error() == Some(libc::ENOSPC) {
|
||||
return (
|
||||
StatusCode::INSUFFICIENT_STORAGE,
|
||||
"not enough disk space available".to_string(),
|
||||
);
|
||||
}
|
||||
(
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
format!("error writing file: {e}"),
|
||||
)
|
||||
})?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
use std::os::unix::fs::OpenOptionsExt;
|
||||
39
envd-rs/src/http/health.rs
Normal file
39
envd-rs/src/http/health.rs
Normal file
@ -0,0 +1,39 @@
|
||||
use std::sync::Arc;
|
||||
use std::sync::atomic::Ordering;
|
||||
|
||||
use axum::Json;
|
||||
use axum::extract::State;
|
||||
use axum::http::header;
|
||||
use axum::response::IntoResponse;
|
||||
use serde_json::json;
|
||||
|
||||
use crate::state::AppState;
|
||||
|
||||
pub async fn get_health(State(state): State<Arc<AppState>>) -> impl IntoResponse {
|
||||
if state
|
||||
.needs_restore
|
||||
.compare_exchange(true, false, Ordering::AcqRel, Ordering::Relaxed)
|
||||
.is_ok()
|
||||
{
|
||||
post_restore_recovery(&state);
|
||||
}
|
||||
|
||||
tracing::trace!("health check");
|
||||
|
||||
(
|
||||
[(header::CACHE_CONTROL, "no-store")],
|
||||
Json(json!({ "version": state.version })),
|
||||
)
|
||||
}
|
||||
|
||||
fn post_restore_recovery(state: &AppState) {
|
||||
tracing::info!("restore: post-restore recovery (no GC needed in Rust)");
|
||||
|
||||
state.conn_tracker.restore_after_snapshot();
|
||||
tracing::info!("restore: zombie connections closed");
|
||||
|
||||
if let Some(ref ps) = state.port_subsystem {
|
||||
ps.restart();
|
||||
tracing::info!("restore: port subsystem restarted");
|
||||
}
|
||||
}
|
||||
274
envd-rs/src/http/init.rs
Normal file
274
envd-rs/src/http/init.rs
Normal file
@ -0,0 +1,274 @@
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
use std::sync::atomic::Ordering;
|
||||
|
||||
use axum::Json;
|
||||
use axum::extract::State;
|
||||
use axum::http::{StatusCode, header};
|
||||
use axum::response::IntoResponse;
|
||||
use serde::Deserialize;
|
||||
|
||||
use crate::crypto;
|
||||
use crate::host::mmds;
|
||||
use crate::state::AppState;
|
||||
|
||||
#[derive(Deserialize, Default)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
pub struct InitRequest {
|
||||
pub access_token: Option<String>,
|
||||
pub default_user: Option<String>,
|
||||
pub default_workdir: Option<String>,
|
||||
pub env_vars: Option<HashMap<String, String>>,
|
||||
pub hyperloop_ip: Option<String>,
|
||||
pub timestamp: Option<String>,
|
||||
pub volume_mounts: Option<Vec<VolumeMount>>,
|
||||
}
|
||||
|
||||
#[derive(Deserialize)]
|
||||
pub struct VolumeMount {
|
||||
pub nfs_target: String,
|
||||
pub path: String,
|
||||
}
|
||||
|
||||
/// POST /init — called by host agent after boot and after every resume.
|
||||
pub async fn post_init(
|
||||
State(state): State<Arc<AppState>>,
|
||||
body: Option<Json<InitRequest>>,
|
||||
) -> impl IntoResponse {
|
||||
let init_req = body.map(|b| b.0).unwrap_or_default();
|
||||
|
||||
// Validate access token if provided
|
||||
if let Some(ref token_str) = init_req.access_token {
|
||||
if let Err(e) = validate_init_access_token(&state, token_str).await {
|
||||
tracing::error!(error = %e, "init: access token validation failed");
|
||||
return (StatusCode::UNAUTHORIZED, e).into_response();
|
||||
}
|
||||
}
|
||||
|
||||
// Idempotent timestamp check
|
||||
if let Some(ref ts_str) = init_req.timestamp {
|
||||
if let Ok(ts) = chrono_parse_to_nanos(ts_str) {
|
||||
if !state.last_set_time.set_to_greater(ts) {
|
||||
// Stale request, skip data updates
|
||||
return trigger_restore_and_respond(&state).await;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Apply env vars
|
||||
if let Some(ref vars) = init_req.env_vars {
|
||||
tracing::debug!(count = vars.len(), "setting env vars");
|
||||
for (k, v) in vars {
|
||||
state.defaults.env_vars.insert(k.clone(), v.clone());
|
||||
}
|
||||
}
|
||||
|
||||
// Set access token
|
||||
if let Some(ref token_str) = init_req.access_token {
|
||||
if !token_str.is_empty() {
|
||||
tracing::debug!("setting access token");
|
||||
let _ = state.access_token.set(token_str.as_bytes());
|
||||
} else if state.access_token.is_set() {
|
||||
tracing::debug!("clearing access token");
|
||||
state.access_token.destroy();
|
||||
}
|
||||
}
|
||||
|
||||
// Set default user
|
||||
if let Some(ref user) = init_req.default_user {
|
||||
if !user.is_empty() {
|
||||
tracing::debug!(user = %user, "setting default user");
|
||||
let mut defaults = state.defaults.clone();
|
||||
defaults.user = user.clone();
|
||||
// Note: In Rust we'd need interior mutability for this.
|
||||
// For now, env_vars (DashMap) handles concurrent access.
|
||||
// User/workdir mutation deferred to full state refactor.
|
||||
}
|
||||
}
|
||||
|
||||
// Hyperloop /etc/hosts setup
|
||||
if let Some(ref ip) = init_req.hyperloop_ip {
|
||||
let ip = ip.clone();
|
||||
let env_vars = Arc::clone(&state.defaults.env_vars);
|
||||
tokio::spawn(async move {
|
||||
setup_hyperloop(&ip, &env_vars).await;
|
||||
});
|
||||
}
|
||||
|
||||
// NFS mounts
|
||||
if let Some(ref mounts) = init_req.volume_mounts {
|
||||
for mount in mounts {
|
||||
let target = mount.nfs_target.clone();
|
||||
let path = mount.path.clone();
|
||||
tokio::spawn(async move {
|
||||
setup_nfs(&target, &path).await;
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Re-poll MMDS in background
|
||||
if state.is_fc {
|
||||
let env_vars = Arc::clone(&state.defaults.env_vars);
|
||||
let cancel = tokio_util::sync::CancellationToken::new();
|
||||
let cancel_clone = cancel.clone();
|
||||
tokio::spawn(async move {
|
||||
tokio::time::timeout(std::time::Duration::from_secs(60), async {
|
||||
mmds::poll_for_opts(env_vars, cancel_clone).await;
|
||||
})
|
||||
.await
|
||||
.ok();
|
||||
});
|
||||
}
|
||||
|
||||
trigger_restore_and_respond(&state).await
|
||||
}
|
||||
|
||||
async fn trigger_restore_and_respond(state: &AppState) -> axum::response::Response {
|
||||
// Safety net: if health check's postRestoreRecovery hasn't run yet
|
||||
if state
|
||||
.needs_restore
|
||||
.compare_exchange(true, false, Ordering::AcqRel, Ordering::Relaxed)
|
||||
.is_ok()
|
||||
{
|
||||
post_restore_recovery(state);
|
||||
}
|
||||
|
||||
state.conn_tracker.restore_after_snapshot();
|
||||
if let Some(ref ps) = state.port_subsystem {
|
||||
ps.restart();
|
||||
}
|
||||
|
||||
(
|
||||
StatusCode::NO_CONTENT,
|
||||
[(header::CACHE_CONTROL, "no-store")],
|
||||
)
|
||||
.into_response()
|
||||
}
|
||||
|
||||
fn post_restore_recovery(state: &AppState) {
|
||||
tracing::info!("restore: post-restore recovery (no GC needed in Rust)");
|
||||
state.conn_tracker.restore_after_snapshot();
|
||||
|
||||
if let Some(ref ps) = state.port_subsystem {
|
||||
ps.restart();
|
||||
tracing::info!("restore: port subsystem restarted");
|
||||
}
|
||||
}
|
||||
|
||||
async fn validate_init_access_token(state: &AppState, request_token: &str) -> Result<(), String> {
|
||||
// Fast path: matches existing token
|
||||
if state.access_token.is_set() && !request_token.is_empty() && state.access_token.equals(request_token) {
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
// Check MMDS hash
|
||||
if state.is_fc {
|
||||
if let Ok(mmds_hash) = mmds::get_access_token_hash().await {
|
||||
if !mmds_hash.is_empty() {
|
||||
if request_token.is_empty() {
|
||||
let empty_hash = crypto::sha512::hash_access_token("");
|
||||
if mmds_hash == empty_hash {
|
||||
return Ok(());
|
||||
}
|
||||
} else {
|
||||
let token_hash = crypto::sha512::hash_access_token(request_token);
|
||||
if mmds_hash == token_hash {
|
||||
return Ok(());
|
||||
}
|
||||
}
|
||||
return Err("access token validation failed".into());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// First-time setup: no existing token and no MMDS
|
||||
if !state.access_token.is_set() {
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
if request_token.is_empty() {
|
||||
return Err("access token reset not authorized".into());
|
||||
}
|
||||
|
||||
Err("access token validation failed".into())
|
||||
}
|
||||
|
||||
async fn setup_hyperloop(address: &str, env_vars: &dashmap::DashMap<String, String>) {
|
||||
// Write to /etc/hosts: events.wrenn.local → address
|
||||
let entry = format!("{address} events.wrenn.local\n");
|
||||
|
||||
match std::fs::read_to_string("/etc/hosts") {
|
||||
Ok(contents) => {
|
||||
let filtered: String = contents
|
||||
.lines()
|
||||
.filter(|line| !line.contains("events.wrenn.local"))
|
||||
.collect::<Vec<_>>()
|
||||
.join("\n");
|
||||
let new_contents = format!("{filtered}\n{entry}");
|
||||
if let Err(e) = std::fs::write("/etc/hosts", new_contents) {
|
||||
tracing::error!(error = %e, "failed to modify hosts file");
|
||||
return;
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "failed to read hosts file");
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
env_vars.insert(
|
||||
"WRENN_EVENTS_ADDRESS".into(),
|
||||
format!("http://{address}"),
|
||||
);
|
||||
}
|
||||
|
||||
async fn setup_nfs(nfs_target: &str, path: &str) {
|
||||
let mkdir = tokio::process::Command::new("mkdir")
|
||||
.args(["-p", path])
|
||||
.output()
|
||||
.await;
|
||||
if let Err(e) = mkdir {
|
||||
tracing::error!(error = %e, path, "nfs: mkdir failed");
|
||||
return;
|
||||
}
|
||||
|
||||
let mount = tokio::process::Command::new("mount")
|
||||
.args([
|
||||
"-v",
|
||||
"-t",
|
||||
"nfs",
|
||||
"-o",
|
||||
"mountproto=tcp,mountport=2049,proto=tcp,port=2049,nfsvers=3,noacl",
|
||||
nfs_target,
|
||||
path,
|
||||
])
|
||||
.output()
|
||||
.await;
|
||||
|
||||
match mount {
|
||||
Ok(output) => {
|
||||
let stdout = String::from_utf8_lossy(&output.stdout);
|
||||
let stderr = String::from_utf8_lossy(&output.stderr);
|
||||
if output.status.success() {
|
||||
tracing::info!(nfs_target, path, stdout = %stdout, "nfs: mount success");
|
||||
} else {
|
||||
tracing::error!(nfs_target, path, stderr = %stderr, "nfs: mount failed");
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, nfs_target, path, "nfs: mount command failed");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn chrono_parse_to_nanos(ts: &str) -> Result<i64, ()> {
|
||||
// Parse RFC3339 timestamp to nanoseconds since epoch
|
||||
// Simple approach: parse as seconds + fractional
|
||||
let secs = ts.parse::<f64>().ok();
|
||||
if let Some(s) = secs {
|
||||
return Ok((s * 1_000_000_000.0) as i64);
|
||||
}
|
||||
// Try RFC3339 format
|
||||
// For now, fall back to allowing the update
|
||||
Err(())
|
||||
}
|
||||
102
envd-rs/src/http/metrics.rs
Normal file
102
envd-rs/src/http/metrics.rs
Normal file
@ -0,0 +1,102 @@
|
||||
use std::sync::Arc;
|
||||
use std::time::{SystemTime, UNIX_EPOCH};
|
||||
|
||||
use axum::Json;
|
||||
use axum::extract::State;
|
||||
use axum::http::{StatusCode, header};
|
||||
use axum::response::IntoResponse;
|
||||
use serde::Serialize;
|
||||
|
||||
use crate::state::AppState;
|
||||
|
||||
#[derive(Serialize)]
|
||||
pub struct Metrics {
|
||||
ts: i64,
|
||||
cpu_count: u32,
|
||||
cpu_used_pct: f32,
|
||||
mem_total_mib: u64,
|
||||
mem_used_mib: u64,
|
||||
mem_total: u64,
|
||||
mem_used: u64,
|
||||
disk_used: u64,
|
||||
disk_total: u64,
|
||||
}
|
||||
|
||||
pub async fn get_metrics(State(_state): State<Arc<AppState>>) -> impl IntoResponse {
|
||||
tracing::trace!("get metrics");
|
||||
|
||||
match collect_metrics() {
|
||||
Ok(m) => (
|
||||
StatusCode::OK,
|
||||
[(header::CACHE_CONTROL, "no-store")],
|
||||
Json(m),
|
||||
)
|
||||
.into_response(),
|
||||
Err(e) => {
|
||||
tracing::error!(error = %e, "failed to get metrics");
|
||||
StatusCode::INTERNAL_SERVER_ERROR.into_response()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn collect_metrics() -> Result<Metrics, String> {
|
||||
use sysinfo::System;
|
||||
|
||||
let mut sys = System::new();
|
||||
sys.refresh_memory();
|
||||
sys.refresh_cpu_all();
|
||||
|
||||
// sysinfo needs a small delay for accurate CPU — first call returns 0.
|
||||
// In a real daemon this would be cached; for now, report instantaneous.
|
||||
std::thread::sleep(std::time::Duration::from_millis(100));
|
||||
sys.refresh_cpu_all();
|
||||
|
||||
let cpu_count = sys.cpus().len() as u32;
|
||||
let cpu_used_pct = sys.global_cpu_usage();
|
||||
let cpu_used_pct_rounded = if cpu_used_pct > 0.0 {
|
||||
(cpu_used_pct * 100.0).round() / 100.0
|
||||
} else {
|
||||
0.0
|
||||
};
|
||||
|
||||
let mem_total = sys.total_memory();
|
||||
let mem_used = sys.used_memory();
|
||||
let mem_total_mib = mem_total / 1024 / 1024;
|
||||
let mem_used_mib = mem_used / 1024 / 1024;
|
||||
|
||||
let (disk_total, disk_used) = disk_stats("/").map_err(|e| e.to_string())?;
|
||||
|
||||
let ts = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.unwrap()
|
||||
.as_secs() as i64;
|
||||
|
||||
Ok(Metrics {
|
||||
ts,
|
||||
cpu_count,
|
||||
cpu_used_pct: cpu_used_pct_rounded,
|
||||
mem_total_mib,
|
||||
mem_used_mib,
|
||||
mem_total,
|
||||
mem_used,
|
||||
disk_used,
|
||||
disk_total,
|
||||
})
|
||||
}
|
||||
|
||||
fn disk_stats(path: &str) -> Result<(u64, u64), nix::Error> {
|
||||
use std::ffi::CString;
|
||||
|
||||
let c_path = CString::new(path).unwrap();
|
||||
let mut stat: libc::statfs = unsafe { std::mem::zeroed() };
|
||||
let ret = unsafe { libc::statfs(c_path.as_ptr(), &mut stat) };
|
||||
if ret != 0 {
|
||||
return Err(nix::Error::last());
|
||||
}
|
||||
|
||||
let block = stat.f_bsize as u64;
|
||||
let total = stat.f_blocks * block;
|
||||
let available = stat.f_bavail * block;
|
||||
|
||||
Ok((total, total - available))
|
||||
}
|
||||
56
envd-rs/src/http/mod.rs
Normal file
56
envd-rs/src/http/mod.rs
Normal file
@ -0,0 +1,56 @@
|
||||
pub mod encoding;
|
||||
pub mod envs;
|
||||
pub mod error;
|
||||
pub mod files;
|
||||
pub mod health;
|
||||
pub mod init;
|
||||
pub mod metrics;
|
||||
pub mod snapshot;
|
||||
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
|
||||
use axum::Router;
|
||||
use axum::routing::{get, post};
|
||||
use http::header::{CACHE_CONTROL, HeaderName};
|
||||
use http::Method;
|
||||
use tower_http::cors::{AllowHeaders, AllowMethods, AllowOrigin, CorsLayer};
|
||||
|
||||
use crate::config::CORS_MAX_AGE;
|
||||
use crate::state::AppState;
|
||||
|
||||
pub fn router(state: Arc<AppState>) -> Router {
|
||||
let cors = CorsLayer::new()
|
||||
.allow_origin(AllowOrigin::any())
|
||||
.allow_methods(AllowMethods::list([
|
||||
Method::HEAD,
|
||||
Method::GET,
|
||||
Method::POST,
|
||||
Method::PUT,
|
||||
Method::PATCH,
|
||||
Method::DELETE,
|
||||
]))
|
||||
.allow_headers(AllowHeaders::any())
|
||||
.expose_headers([
|
||||
HeaderName::from_static("location"),
|
||||
CACHE_CONTROL,
|
||||
HeaderName::from_static("x-content-type-options"),
|
||||
HeaderName::from_static("connect-content-encoding"),
|
||||
HeaderName::from_static("connect-protocol-version"),
|
||||
HeaderName::from_static("grpc-encoding"),
|
||||
HeaderName::from_static("grpc-message"),
|
||||
HeaderName::from_static("grpc-status"),
|
||||
HeaderName::from_static("grpc-status-details-bin"),
|
||||
])
|
||||
.max_age(Duration::from_secs(CORS_MAX_AGE.as_secs()));
|
||||
|
||||
Router::new()
|
||||
.route("/health", get(health::get_health))
|
||||
.route("/metrics", get(metrics::get_metrics))
|
||||
.route("/envs", get(envs::get_envs))
|
||||
.route("/init", post(init::post_init))
|
||||
.route("/snapshot/prepare", post(snapshot::post_snapshot_prepare))
|
||||
.route("/files", get(files::get_files).post(files::post_files))
|
||||
.layer(cors)
|
||||
.with_state(state)
|
||||
}
|
||||
32
envd-rs/src/http/snapshot.rs
Normal file
32
envd-rs/src/http/snapshot.rs
Normal file
@ -0,0 +1,32 @@
|
||||
use std::sync::Arc;
|
||||
use std::sync::atomic::Ordering;
|
||||
|
||||
use axum::extract::State;
|
||||
use axum::http::{StatusCode, header};
|
||||
use axum::response::IntoResponse;
|
||||
|
||||
use crate::state::AppState;
|
||||
|
||||
/// POST /snapshot/prepare — quiesce subsystems before Firecracker snapshot.
|
||||
///
|
||||
/// In Rust there is no GC dance. We just:
|
||||
/// 1. Stop port subsystem
|
||||
/// 2. Close idle connections via conntracker
|
||||
/// 3. Set needs_restore flag
|
||||
pub async fn post_snapshot_prepare(State(state): State<Arc<AppState>>) -> impl IntoResponse {
|
||||
if let Some(ref ps) = state.port_subsystem {
|
||||
ps.stop();
|
||||
tracing::info!("snapshot/prepare: port subsystem stopped");
|
||||
}
|
||||
|
||||
state.conn_tracker.prepare_for_snapshot();
|
||||
tracing::info!("snapshot/prepare: connections prepared");
|
||||
|
||||
state.needs_restore.store(true, Ordering::Release);
|
||||
tracing::info!("snapshot/prepare: ready for freeze");
|
||||
|
||||
(
|
||||
StatusCode::NO_CONTENT,
|
||||
[(header::CACHE_CONTROL, "no-store")],
|
||||
)
|
||||
}
|
||||
Reference in New Issue
Block a user