Compare commits
10
Commits
62acb264b3
..
v0.4.0
| Author | SHA1 | Date | |
|---|---|---|---|
 Miles WardandClaude Opus 4.7
|
ec171ede47 | ||
|
Miles Ward
|
115ba779da | ||
|
Miles Ward
|
91848e02e3 | ||
|
Miles Ward
|
4e88305101 | ||
|
Miles Ward
|
20c585e3ed | ||
|
503432756
|
e1b7154b51 | ||
|
Miles Ward
|
40064906de | ||
|
Miles Ward
|
49d0b00a8a | ||
|
Miles Ward
|
a9c4f408a9 | ||
|
Miles Ward
|
3517c67831 |
@@ -1,16 +0,0 @@
|
||||
{
|
||||
"permissions": {
|
||||
"allow": [
|
||||
"Bash(cargo check *)",
|
||||
"Bash(cargo build *)",
|
||||
"Bash(cargo clippy *)",
|
||||
"Bash(cargo fmt *)",
|
||||
"Bash(cargo tree *)",
|
||||
"Bash(cargo doc *)",
|
||||
"Bash(cargo test --workspace --lib)",
|
||||
"Bash(cargo test --workspace)",
|
||||
"Bash(cargo --version)",
|
||||
"Bash(rustc --version)"
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -1,4 +1,5 @@
|
||||
/target
|
||||
Cargo.lock
|
||||
data/isos/*.iso
|
||||
data/isos/*.partial
|
||||
data/isos/*.meta.json
|
||||
|
||||
Generated
-4642
File diff suppressed because it is too large
Load Diff
+3
-30
@@ -12,9 +12,9 @@ members = [
|
||||
]
|
||||
|
||||
[workspace.package]
|
||||
version = "0.5.1"
|
||||
version = "0.4.0"
|
||||
edition = "2021"
|
||||
rust-version = "1.95"
|
||||
rust-version = "1.80"
|
||||
license = "MIT OR Apache-2.0"
|
||||
repository = "https://gitea.milesward.dev/mward4/OpenPXE"
|
||||
authors = ["OpenPXE contributors"]
|
||||
@@ -35,7 +35,7 @@ axum = { version = "0.7", features = ["macros", "multipart", "http2"] }
|
||||
tower = "0.5"
|
||||
tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
|
||||
hyper = "1.4"
|
||||
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
|
||||
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"] }
|
||||
mime = "0.3"
|
||||
mime_guess = "2.0"
|
||||
|
||||
@@ -58,33 +58,6 @@ once_cell = "1.19"
|
||||
parking_lot = "0.12"
|
||||
rust-embed = { version = "8.5", features = ["include-exclude"] }
|
||||
|
||||
# v0.4.67: pure-Rust NFSv3 client. Replaces the (deleted-in-v0.4.65)
|
||||
# kernel-mount NFS path with an in-process implementation that works
|
||||
# in any container — no kernel modules, no CAP_SYS_ADMIN, no
|
||||
# subprocess. Ships alongside the userspace SMB consumer; operators
|
||||
# pick whichever protocol their NAS prefers.
|
||||
nfs3_client = { version = "0.9", features = ["tokio"] }
|
||||
nfs3_types = "0.5"
|
||||
|
||||
# v0.5.0: SMTP for webhook notifications (Slack/Teams/Discord go over
|
||||
# plain HTTP via reqwest; email needs a real SMTP client). rustls TLS
|
||||
# to match reqwest and stay musl-static-friendly — no OpenSSL.
|
||||
lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
|
||||
|
||||
# v0.5.1: pure-Rust SAML 2.0 Service Provider. bergshamra does XML-DSig
|
||||
# verification + exclusive c14n with RustCrypto (no OpenSSL/xmlsec/libxml2
|
||||
# C deps), so the static musl binary stays OpenSSL-free — samael was
|
||||
# rejected precisely because it hard-requires OpenSSL. We build the thin
|
||||
# SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
|
||||
bergshamra = "0.4"
|
||||
roxmltree = "0.21"
|
||||
quick-xml = "0.40"
|
||||
x509-parser = "0.18"
|
||||
# flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
|
||||
# zlib/zlib-ng C backends, which would break the musl-static build.
|
||||
flate2 = "1.1"
|
||||
base64 = "0.22"
|
||||
|
||||
openpxe-core = { path = "crates/core" }
|
||||
openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
|
||||
openpxe-tftp = { path = "crates/tftp" }
|
||||
|
||||
@@ -5,11 +5,11 @@ Container-native PXE boot server. A Rust reimplementation of
|
||||
for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
|
||||
clients PXE-boot them.
|
||||
|
||||
> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
|
||||
> **Status:** v0.3.2 / pre-beta. Phases 1–5 complete: full PXE stack,
|
||||
> Queued Deployment queue, NFS-share ISO sources, live tracing log + an
|
||||
> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
|
||||
> light/dark theme toggle, animated OpenPXE imaging-progress widget,
|
||||
> chunked ISO uploads, and per-ISO boot passwords. The test suite and
|
||||
> operator terminal, per-MAC host bindings (Tinkerbell-style),
|
||||
> Prometheus `/metrics`, light/dark theme toggle, animated OpenPXE
|
||||
> imaging-progress widget, and per-ISO boot passwords. The test suite and
|
||||
> clippy are part of the release checklist. Ready for real-hardware validation.
|
||||
|
||||
## Design non-negotiables
|
||||
@@ -51,7 +51,8 @@ clients PXE-boot them.
|
||||
widget when devices are imaging. All assets served from the binary —
|
||||
no external requests.
|
||||
8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
|
||||
skips the menu, chains straight through.
|
||||
skips the menu, chains straight through. Inspired by Tinkerbell's
|
||||
`smee` MAC-prepended URL pattern.
|
||||
9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
|
||||
transfer counts and bytes, HTTP request counts by route, queue /
|
||||
imaging gauges, uptime, build info. Plain text exposition format,
|
||||
@@ -80,7 +81,7 @@ skip TFTP and respond with an HTTP URL.
|
||||
./scripts/fetch-ipxe.sh
|
||||
|
||||
# 2. Build the container image (~3 min first time).
|
||||
docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .
|
||||
docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.3.2 --load .
|
||||
|
||||
# 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
|
||||
# this host's LAN address so advertised iPXE URLs are reachable.
|
||||
@@ -90,7 +91,7 @@ docker run -d --name openpxe \
|
||||
-e OPENPXE_DHCP_MODE=proxy \
|
||||
-v $PWD/data/isos:/var/lib/openpxe/isos \
|
||||
-v $PWD/data/work:/var/lib/openpxe/work \
|
||||
openpxe:0.4.1
|
||||
openpxe:0.3.2
|
||||
|
||||
# 4. Open the UI and drop an ISO in.
|
||||
open http://10.0.0.5
|
||||
@@ -121,7 +122,7 @@ docker buildx create --name openpxe-multi --driver docker-container --use
|
||||
# Build + push both linux/amd64 and linux/arm64 under one tag.
|
||||
docker buildx build --builder openpxe-multi \
|
||||
--platform linux/amd64,linux/arm64 \
|
||||
-t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
|
||||
-t ghcr.io/YOUR-ORG/openpxe:0.3.2 \
|
||||
--push \
|
||||
-f deploy/docker/Dockerfile .
|
||||
```
|
||||
@@ -154,10 +155,10 @@ docker run --rm \
|
||||
-v /my/iso-library:/seed:ro \
|
||||
-v openpxe-data:/var/lib/openpxe/isos \
|
||||
-e OPENPXE_PUBLIC_IP=10.0.0.5 \
|
||||
openpxe:0.4.1 seed --from /seed
|
||||
openpxe:0.3.2 seed --from /seed
|
||||
|
||||
# Dry run first to see what would be imported:
|
||||
docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
|
||||
docker run --rm -v /my/iso-library:/seed:ro openpxe:0.3.2 seed --from /seed --dry-run
|
||||
```
|
||||
|
||||
### Environment overrides
|
||||
|
||||
@@ -21,23 +21,6 @@ time.workspace = true
|
||||
uuid.workspace = true
|
||||
parking_lot.workspace = true
|
||||
tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
|
||||
# bcrypt for the admin Forms auth (v0.4.5). Already in the workspace
|
||||
# for per-ISO boot passwords; just re-exported here.
|
||||
bcrypt.workspace = true
|
||||
|
||||
# v0.5.1: pure-Rust SAML 2.0 SP. bergshamra = XML-DSig verify + exclusive
|
||||
# c14n (no OpenSSL/C). roxmltree/quick-xml parse + build SAML XML;
|
||||
# x509-parser pulls the IdP signing cert out of metadata; flate2+base64
|
||||
# encode the HTTP-Redirect binding's SAMLRequest.
|
||||
bergshamra.workspace = true
|
||||
roxmltree.workspace = true
|
||||
quick-xml.workspace = true
|
||||
x509-parser.workspace = true
|
||||
flate2.workspace = true
|
||||
base64.workspace = true
|
||||
|
||||
[dev-dependencies]
|
||||
tempfile = "3.12"
|
||||
# v0.5.1: generate a throwaway self-signed signing cert/key so SAML
|
||||
# verification tests can produce genuinely signed SAMLResponses.
|
||||
rcgen = "0.13"
|
||||
|
||||
@@ -1,353 +0,0 @@
|
||||
//! Operator authentication — Sonarr/Radarr-style single-admin Forms model.
|
||||
//!
|
||||
//! On a fresh install, no admin account exists; the WebUI's first-run
|
||||
//! flow prompts the operator to create one. After that the chosen
|
||||
//! credentials gate `/api/*` access. The admin can rotate username +
|
||||
//! password from Settings → Account.
|
||||
//!
|
||||
//! Multi-user RBAC isn't a goal for OpenPXE — the user explicitly asked
|
||||
//! for "you have access or you don't". When SSO is configured, additional
|
||||
//! users come in through the IdP; the locally-stored admin is the
|
||||
//! fallback owner who can change SSO config or the seal-breaker for an
|
||||
//! IdP outage. So one record is enough.
|
||||
//!
|
||||
//! Storage policy mirrors [`crate::host_bindings::HostBindings`] and
|
||||
//! [`crate::boot_log::BootLog`]: in-memory authoritative; disk is the
|
||||
//! crash-survival cache; a corrupt `auth.json` falls back to "no admin
|
||||
//! configured" rather than blocking startup, which puts the UI back
|
||||
//! into setup mode rather than locking the operator out.
|
||||
|
||||
use parking_lot::RwLock;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::path::PathBuf;
|
||||
use std::sync::Arc;
|
||||
use time::OffsetDateTime;
|
||||
|
||||
use crate::{Error, Result};
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct AdminAccount {
|
||||
pub username: String,
|
||||
/// bcrypt hash (cost 10). The plaintext password never leaves the
|
||||
/// request that set it — same discipline as the per-ISO boot password.
|
||||
pub password_hash: String,
|
||||
#[serde(with = "time::serde::rfc3339")]
|
||||
pub created_at: OffsetDateTime,
|
||||
#[serde(with = "time::serde::rfc3339")]
|
||||
pub updated_at: OffsetDateTime,
|
||||
}
|
||||
|
||||
/// Public projection — no hash, safe to ship to the WebUI.
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct AdminPublic {
|
||||
pub username: String,
|
||||
#[serde(with = "time::serde::rfc3339")]
|
||||
pub created_at: OffsetDateTime,
|
||||
#[serde(with = "time::serde::rfc3339")]
|
||||
pub updated_at: OffsetDateTime,
|
||||
}
|
||||
|
||||
impl From<&AdminAccount> for AdminPublic {
|
||||
fn from(a: &AdminAccount) -> Self {
|
||||
Self {
|
||||
username: a.username.clone(),
|
||||
created_at: a.created_at,
|
||||
updated_at: a.updated_at,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
|
||||
struct Inner {
|
||||
admin: Option<AdminAccount>,
|
||||
}
|
||||
|
||||
/// In-memory + on-disk admin registry. Cheap to clone.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct AdminStore {
|
||||
path: Arc<PathBuf>,
|
||||
inner: Arc<RwLock<Inner>>,
|
||||
}
|
||||
|
||||
impl AdminStore {
|
||||
/// Load from `<work_dir>/auth.json`, or start empty. A bad file
|
||||
/// logs a warning and falls back to "no admin configured" — better
|
||||
/// to surface the setup flow than lock the operator out of their
|
||||
/// own install.
|
||||
#[must_use]
|
||||
pub fn load_or_default(work_dir: &std::path::Path) -> Self {
|
||||
let path = work_dir.join("auth.json");
|
||||
let inner = match std::fs::read_to_string(&path) {
|
||||
Ok(text) => match serde_json::from_str::<Inner>(&text) {
|
||||
Ok(parsed) => parsed,
|
||||
Err(e) => {
|
||||
tracing::warn!(
|
||||
target: "openpxe::auth",
|
||||
"auth.json present but unreadable ({e}); starting in setup mode"
|
||||
);
|
||||
Inner::default()
|
||||
}
|
||||
},
|
||||
Err(_) => Inner::default(),
|
||||
};
|
||||
Self {
|
||||
path: Arc::new(path),
|
||||
inner: Arc::new(RwLock::new(inner)),
|
||||
}
|
||||
}
|
||||
|
||||
/// Has an admin been bootstrapped? Drives the first-run / login
|
||||
/// fork in the HTTP layer.
|
||||
#[must_use]
|
||||
pub fn is_configured(&self) -> bool {
|
||||
self.inner.read().admin.is_some()
|
||||
}
|
||||
|
||||
/// Public-safe snapshot for the WebUI.
|
||||
#[must_use]
|
||||
pub fn snapshot(&self) -> Option<AdminPublic> {
|
||||
self.inner.read().admin.as_ref().map(AdminPublic::from)
|
||||
}
|
||||
|
||||
/// First-run setup: create the admin account. Fails if one already
|
||||
/// exists — the HTTP layer surfaces that as 409.
|
||||
pub fn bootstrap(&self, username: &str, password: &str) -> Result<AdminPublic> {
|
||||
validate_username(username)?;
|
||||
validate_password(password)?;
|
||||
let hash = bcrypt_hash(password)?;
|
||||
let now = OffsetDateTime::now_utc();
|
||||
let admin = AdminAccount {
|
||||
username: username.trim().to_string(),
|
||||
password_hash: hash,
|
||||
created_at: now,
|
||||
updated_at: now,
|
||||
};
|
||||
{
|
||||
let mut g = self.inner.write();
|
||||
if g.admin.is_some() {
|
||||
return Err(Error::Invalid(
|
||||
"admin account already configured".into(),
|
||||
));
|
||||
}
|
||||
g.admin = Some(admin.clone());
|
||||
}
|
||||
self.persist();
|
||||
tracing::info!(
|
||||
target: "openpxe::auth",
|
||||
username = %admin.username,
|
||||
"admin account created (first-run setup)"
|
||||
);
|
||||
Ok((&admin).into())
|
||||
}
|
||||
|
||||
/// Verify credentials. Returns the admin record (public projection)
|
||||
/// on success, `Ok(None)` on mismatch, `Err` on systemic bcrypt
|
||||
/// failure (treated as "auth not available right now" by callers).
|
||||
pub fn verify(&self, username: &str, password: &str) -> Result<Option<AdminPublic>> {
|
||||
let Some(admin) = self.inner.read().admin.clone() else {
|
||||
return Ok(None);
|
||||
};
|
||||
if username.trim() != admin.username {
|
||||
return Ok(None);
|
||||
}
|
||||
// bcrypt compares in constant time relative to the same hash.
|
||||
// Doing the username check first is fine — a username mismatch
|
||||
// returns immediately, but the only thing leaked is "this isn't
|
||||
// the admin's username" which the operator already knows.
|
||||
match bcrypt::verify(password, &admin.password_hash) {
|
||||
Ok(true) => Ok(Some((&admin).into())),
|
||||
Ok(false) => Ok(None),
|
||||
Err(e) => Err(Error::Other(e.into())),
|
||||
}
|
||||
}
|
||||
|
||||
/// Rotate username and/or password. `current_password` must match
|
||||
/// the *existing* hash — same flow as Sonarr's "current password
|
||||
/// required to change". `new_username`/`new_password` are optional:
|
||||
/// pass only what you want to change.
|
||||
pub fn update_credentials(
|
||||
&self,
|
||||
current_password: &str,
|
||||
new_username: Option<&str>,
|
||||
new_password: Option<&str>,
|
||||
) -> Result<AdminPublic> {
|
||||
// Re-check ownership before any state mutation.
|
||||
let existing = self
|
||||
.inner
|
||||
.read()
|
||||
.admin
|
||||
.clone()
|
||||
.ok_or_else(|| Error::Invalid("no admin configured".into()))?;
|
||||
match bcrypt::verify(current_password, &existing.password_hash) {
|
||||
Ok(true) => {}
|
||||
Ok(false) => return Err(Error::Invalid("current password is incorrect".into())),
|
||||
Err(e) => return Err(Error::Other(e.into())),
|
||||
}
|
||||
|
||||
let mut updated = existing.clone();
|
||||
if let Some(u) = new_username {
|
||||
validate_username(u)?;
|
||||
updated.username = u.trim().to_string();
|
||||
}
|
||||
if let Some(p) = new_password {
|
||||
validate_password(p)?;
|
||||
updated.password_hash = bcrypt_hash(p)?;
|
||||
}
|
||||
updated.updated_at = OffsetDateTime::now_utc();
|
||||
|
||||
{
|
||||
let mut g = self.inner.write();
|
||||
g.admin = Some(updated.clone());
|
||||
}
|
||||
self.persist();
|
||||
tracing::info!(
|
||||
target: "openpxe::auth",
|
||||
username = %updated.username,
|
||||
"admin credentials updated"
|
||||
);
|
||||
Ok((&updated).into())
|
||||
}
|
||||
|
||||
fn persist(&self) {
|
||||
let snap = self.inner.read().clone();
|
||||
let body = match serde_json::to_vec_pretty(&snap) {
|
||||
Ok(b) => b,
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::auth", "serialize auth.json: {e}");
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Some(parent) = self.path.parent() {
|
||||
let _ = std::fs::create_dir_all(parent);
|
||||
}
|
||||
let tmp = self.path.with_extension("json.tmp");
|
||||
if let Err(e) = std::fs::write(&tmp, body) {
|
||||
tracing::warn!(target: "openpxe::auth", "write auth.json tmp: {e}");
|
||||
return;
|
||||
}
|
||||
if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
|
||||
tracing::warn!(target: "openpxe::auth", "rename auth.json: {e}");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn validate_username(u: &str) -> Result<()> {
|
||||
let u = u.trim();
|
||||
if u.is_empty() {
|
||||
return Err(Error::Invalid("username must not be empty".into()));
|
||||
}
|
||||
if u.len() > 64 {
|
||||
return Err(Error::Invalid("username must be 64 chars or fewer".into()));
|
||||
}
|
||||
if !u.chars().all(|c| c.is_ascii_graphic() && c != ':') {
|
||||
return Err(Error::Invalid(
|
||||
"username must be ASCII printable with no ':' character".into(),
|
||||
));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn validate_password(p: &str) -> Result<()> {
|
||||
if p.len() < 8 {
|
||||
return Err(Error::Invalid(
|
||||
"password must be at least 8 characters".into(),
|
||||
));
|
||||
}
|
||||
if p.len() > 256 {
|
||||
return Err(Error::Invalid(
|
||||
"password must be 256 characters or fewer".into(),
|
||||
));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn bcrypt_hash(password: &str) -> Result<String> {
|
||||
bcrypt::hash(password, bcrypt::DEFAULT_COST).map_err(|e| Error::Other(e.into()))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tempfile::tempdir;
|
||||
|
||||
#[test]
|
||||
fn empty_after_load_when_no_file() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = AdminStore::load_or_default(dir.path());
|
||||
assert!(!s.is_configured());
|
||||
assert!(s.snapshot().is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn bootstrap_then_verify_round_trip() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = AdminStore::load_or_default(dir.path());
|
||||
let pub_ = s.bootstrap("admin", "hunter2hunter2").unwrap();
|
||||
assert_eq!(pub_.username, "admin");
|
||||
assert!(s.is_configured());
|
||||
|
||||
// Correct creds match; wrong creds don't.
|
||||
assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
|
||||
assert!(s.verify("admin", "wrong").unwrap().is_none());
|
||||
assert!(s.verify("nobody", "hunter2hunter2").unwrap().is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn bootstrap_rejects_second_call() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = AdminStore::load_or_default(dir.path());
|
||||
s.bootstrap("admin", "hunter2hunter2").unwrap();
|
||||
let r = s.bootstrap("other", "anotherpass1");
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn round_trip_survives_disk_reload() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = AdminStore::load_or_default(dir.path());
|
||||
s.bootstrap("admin", "hunter2hunter2").unwrap();
|
||||
drop(s);
|
||||
let s2 = AdminStore::load_or_default(dir.path());
|
||||
assert!(s2.is_configured());
|
||||
assert!(s2.verify("admin", "hunter2hunter2").unwrap().is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn update_credentials_requires_current_password() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = AdminStore::load_or_default(dir.path());
|
||||
s.bootstrap("admin", "hunter2hunter2").unwrap();
|
||||
// Wrong current password → no change.
|
||||
let r = s.update_credentials("nope", None, Some("newpassword1"));
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
assert!(s.verify("admin", "hunter2hunter2").unwrap().is_some());
|
||||
|
||||
// Correct current password rotates only what's supplied.
|
||||
s.update_credentials("hunter2hunter2", Some("alice"), Some("newpassword1"))
|
||||
.unwrap();
|
||||
assert!(s.verify("admin", "hunter2hunter2").unwrap().is_none());
|
||||
assert!(s.verify("alice", "newpassword1").unwrap().is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn update_credentials_partial_password_only_keeps_username() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = AdminStore::load_or_default(dir.path());
|
||||
s.bootstrap("admin", "hunter2hunter2").unwrap();
|
||||
s.update_credentials("hunter2hunter2", None, Some("newpassword1"))
|
||||
.unwrap();
|
||||
assert!(s.verify("admin", "newpassword1").unwrap().is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn validates_username_and_password() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = AdminStore::load_or_default(dir.path());
|
||||
assert!(s.bootstrap("", "hunter2hunter2").is_err());
|
||||
assert!(s.bootstrap("ad:min", "hunter2hunter2").is_err()); // ':' reserved
|
||||
assert!(s.bootstrap("admin", "short").is_err()); // <8 chars
|
||||
// 65-char username is too long.
|
||||
let long = "a".repeat(65);
|
||||
assert!(s.bootstrap(&long, "hunter2hunter2").is_err());
|
||||
}
|
||||
}
|
||||
@@ -1,375 +0,0 @@
|
||||
//! Operator-controlled branding overrides.
|
||||
//!
|
||||
//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
|
||||
//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
|
||||
//! branding can upload a replacement that lives at
|
||||
//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
|
||||
//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
|
||||
//! product.
|
||||
//!
|
||||
//! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
|
||||
//! authoritative for the current process, disk is the source of truth on
|
||||
//! restart, and a corrupt cache file falls back to the bundled default
|
||||
//! rather than blocking startup.
|
||||
|
||||
use parking_lot::RwLock;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::sync::Arc;
|
||||
|
||||
/// Allowed MIME types for an uploaded logo. We deliberately keep this
|
||||
/// narrow — anything that can be `<img src="...">`'d into the brand
|
||||
/// block, no scripts. SVG carries the obvious XSS risk for raw inline
|
||||
/// HTML; we always serve the bytes as a separate asset with a strict
|
||||
/// content-type rather than inlining, so SVG is safe.
|
||||
pub const ALLOWED_LOGO_MIMES: &[&str] = &[
|
||||
"image/svg+xml",
|
||||
"image/png",
|
||||
"image/jpeg",
|
||||
"image/webp",
|
||||
"image/gif",
|
||||
];
|
||||
|
||||
/// Disk cap for an uploaded logo. PXE WebUIs are operator-facing — even
|
||||
/// a generous 2 MB cap is comfortable for any reasonable brand mark and
|
||||
/// puts a clear bound on memory + serialization cost.
|
||||
pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
|
||||
|
||||
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
|
||||
struct Inner {
|
||||
/// File name (relative to the branding dir) for the active logo, if
|
||||
/// any. Always under `<work_dir>/branding/`; never an absolute path
|
||||
/// from the operator.
|
||||
logo_filename: Option<String>,
|
||||
/// MIME of the active logo, mirroring `logo_filename`. Cached here
|
||||
/// so the HTTP layer can set Content-Type without re-sniffing.
|
||||
logo_mime: Option<String>,
|
||||
/// Monotonic counter bumped on every set/clear. Surfaces as a
|
||||
/// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
|
||||
/// fetches the new bytes the moment the operator swaps the logo —
|
||||
/// the app version alone can't do this since it doesn't change on
|
||||
/// upload. Persisted so the token stays stable across restarts and
|
||||
/// keeps climbing across multiple swaps.
|
||||
#[serde(default)]
|
||||
rev: u64,
|
||||
}
|
||||
|
||||
/// In-memory + on-disk override registry. Cheap to clone; locks are
|
||||
/// brief. The `branding.json` cache lives alongside the active asset
|
||||
/// inside `<work_dir>/branding/`.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct BrandingStore {
|
||||
/// Root directory: `<work_dir>/branding/`. Created on first write.
|
||||
dir: Arc<PathBuf>,
|
||||
inner: Arc<RwLock<Inner>>,
|
||||
}
|
||||
|
||||
impl BrandingStore {
|
||||
/// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
|
||||
/// missing directories, partial state, and corrupt JSON — a bad
|
||||
/// cache should never block PXE for the network.
|
||||
#[must_use]
|
||||
pub fn load_or_default(work_dir: &Path) -> Self {
|
||||
let dir = work_dir.join("branding");
|
||||
let path = dir.join("branding.json");
|
||||
let mut inner = Inner::default();
|
||||
if let Ok(text) = std::fs::read_to_string(&path) {
|
||||
match serde_json::from_str::<Inner>(&text) {
|
||||
Ok(parsed) => {
|
||||
// Sanity: if the JSON says we have a logo but the
|
||||
// file is gone, clear the in-memory pointer so
|
||||
// /assets/logo.svg falls back to the bundled SVG
|
||||
// rather than 500ing on a missing file.
|
||||
if let Some(name) = parsed.logo_filename.as_deref() {
|
||||
if dir.join(name).is_file() {
|
||||
inner = parsed;
|
||||
} else {
|
||||
tracing::warn!(
|
||||
target: "openpxe::branding",
|
||||
file = %name,
|
||||
"branding.json points at missing file; clearing"
|
||||
);
|
||||
}
|
||||
} else {
|
||||
inner = parsed;
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::warn!(
|
||||
target: "openpxe::branding",
|
||||
"branding.json present but unreadable ({e}); starting empty"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
Self {
|
||||
dir: Arc::new(dir),
|
||||
inner: Arc::new(RwLock::new(inner)),
|
||||
}
|
||||
}
|
||||
|
||||
/// Absolute path to the active logo, if one is set and present on
|
||||
/// disk. `None` means the HTTP layer should serve the bundled SVG.
|
||||
#[must_use]
|
||||
pub fn logo_path(&self) -> Option<PathBuf> {
|
||||
let g = self.inner.read();
|
||||
g.logo_filename.as_deref().map(|n| self.dir.join(n))
|
||||
}
|
||||
|
||||
/// MIME of the active logo, if any. The HTTP layer pairs this with
|
||||
/// the bytes returned by [`Self::logo_path`].
|
||||
#[must_use]
|
||||
pub fn logo_mime(&self) -> Option<String> {
|
||||
self.inner.read().logo_mime.clone()
|
||||
}
|
||||
|
||||
/// Replace the active logo. Returns the chosen on-disk filename so
|
||||
/// the caller can echo it back in the API response. Old logos are
|
||||
/// removed best-effort.
|
||||
pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
|
||||
std::fs::create_dir_all(self.dir.as_path())?;
|
||||
// Single canonical filename per upload — overwriting the old one
|
||||
// (after clearing it) keeps the directory tidy and avoids any
|
||||
// path-traversal concern: the operator never supplies the name.
|
||||
let safe_ext = sanitize_ext(ext);
|
||||
let filename = format!("logo.{safe_ext}");
|
||||
let final_path = self.dir.join(&filename);
|
||||
// Atomic write: tmp -> rename. Guarantees the file is either
|
||||
// entirely the old logo or entirely the new one.
|
||||
let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
|
||||
std::fs::write(&tmp, bytes)?;
|
||||
std::fs::rename(&tmp, &final_path)?;
|
||||
// Clean up any sibling logo.<otherext> so there's exactly one
|
||||
// canonical file at any time.
|
||||
if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
|
||||
for e in entries.flatten() {
|
||||
let p = e.path();
|
||||
let name = p
|
||||
.file_name()
|
||||
.and_then(|s| s.to_str())
|
||||
.unwrap_or("");
|
||||
if name.starts_with("logo.") && name != filename {
|
||||
let _ = std::fs::remove_file(&p);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
{
|
||||
let mut g = self.inner.write();
|
||||
g.logo_filename = Some(filename.clone());
|
||||
g.logo_mime = Some(mime.to_string());
|
||||
g.rev = g.rev.wrapping_add(1);
|
||||
}
|
||||
self.persist();
|
||||
tracing::info!(
|
||||
target: "openpxe::branding",
|
||||
file = %filename, mime = %mime, size = bytes.len(),
|
||||
"custom logo installed"
|
||||
);
|
||||
Ok(filename)
|
||||
}
|
||||
|
||||
/// Drop the override and return to the bundled SVG.
|
||||
pub fn clear_logo(&self) -> std::io::Result<()> {
|
||||
let removed = {
|
||||
let mut g = self.inner.write();
|
||||
let removed = g.logo_filename.take();
|
||||
g.logo_mime = None;
|
||||
g.rev = g.rev.wrapping_add(1);
|
||||
removed
|
||||
};
|
||||
if let Some(name) = removed {
|
||||
let p = self.dir.join(&name);
|
||||
let _ = std::fs::remove_file(&p);
|
||||
tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
|
||||
}
|
||||
self.persist();
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Convenience: true if a custom logo is configured. Surfaces on
|
||||
/// `/api/status` so the WebUI can show "Custom logo: yes" without
|
||||
/// fetching the asset itself.
|
||||
#[must_use]
|
||||
pub fn has_logo(&self) -> bool {
|
||||
self.inner.read().logo_filename.is_some()
|
||||
}
|
||||
|
||||
/// Cache-bust token for the logo asset URL. Changes on every
|
||||
/// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
|
||||
/// whenever the operator swaps the brand mark. Stable otherwise.
|
||||
#[must_use]
|
||||
pub fn logo_rev(&self) -> u64 {
|
||||
self.inner.read().rev
|
||||
}
|
||||
|
||||
fn persist(&self) {
|
||||
let snap = self.inner.read().clone();
|
||||
let body = match serde_json::to_vec_pretty(&snap) {
|
||||
Ok(b) => b,
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::branding", "serialize branding.json: {e}");
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Err(e) = std::fs::create_dir_all(self.dir.as_path()) {
|
||||
tracing::warn!(target: "openpxe::branding", "mkdir branding/: {e}");
|
||||
return;
|
||||
}
|
||||
let path = self.dir.join("branding.json");
|
||||
let tmp = path.with_extension("json.tmp");
|
||||
if let Err(e) = std::fs::write(&tmp, body) {
|
||||
tracing::warn!(target: "openpxe::branding", "write branding.json tmp: {e}");
|
||||
return;
|
||||
}
|
||||
if let Err(e) = std::fs::rename(&tmp, &path) {
|
||||
tracing::warn!(target: "openpxe::branding", "rename branding.json: {e}");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Trim arbitrary operator-supplied extension strings to a small, safe
|
||||
/// alphanumeric form. Anything weird collapses to `bin`. We never let
|
||||
/// the extension affect the path beyond the final segment of `logo.<x>`.
|
||||
fn sanitize_ext(ext: &str) -> String {
|
||||
let lc: String = ext
|
||||
.chars()
|
||||
.filter(char::is_ascii_alphanumeric)
|
||||
.map(|c| c.to_ascii_lowercase())
|
||||
.collect();
|
||||
if lc.is_empty() || lc.len() > 5 {
|
||||
"bin".into()
|
||||
} else {
|
||||
lc
|
||||
}
|
||||
}
|
||||
|
||||
/// Pick a safe filesystem extension from a MIME type. Returns `None`
|
||||
/// if the MIME isn't on the [`ALLOWED_LOGO_MIMES`] allowlist.
|
||||
#[must_use]
|
||||
pub fn ext_for_mime(mime: &str) -> Option<&'static str> {
|
||||
match mime {
|
||||
"image/svg+xml" => Some("svg"),
|
||||
"image/png" => Some("png"),
|
||||
"image/jpeg" => Some("jpg"),
|
||||
"image/webp" => Some("webp"),
|
||||
"image/gif" => Some("gif"),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tempfile::tempdir;
|
||||
|
||||
#[test]
|
||||
fn empty_after_load_when_no_branding_dir() {
|
||||
let dir = tempdir().unwrap();
|
||||
let b = BrandingStore::load_or_default(dir.path());
|
||||
assert!(!b.has_logo());
|
||||
assert!(b.logo_path().is_none());
|
||||
assert!(b.logo_mime().is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn set_clear_round_trip_persists() {
|
||||
let dir = tempdir().unwrap();
|
||||
let b = BrandingStore::load_or_default(dir.path());
|
||||
let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
|
||||
assert_eq!(name, "logo.png");
|
||||
assert!(b.has_logo());
|
||||
assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
|
||||
let p = b.logo_path().unwrap();
|
||||
assert!(p.is_file());
|
||||
|
||||
// Re-open and confirm the override survives a restart.
|
||||
drop(b);
|
||||
let b2 = BrandingStore::load_or_default(dir.path());
|
||||
assert!(b2.has_logo());
|
||||
assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
|
||||
|
||||
// Clear; the file goes away and has_logo flips off.
|
||||
b2.clear_logo().unwrap();
|
||||
assert!(!b2.has_logo());
|
||||
assert!(!p.exists());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn replacing_logo_removes_old_extension_sibling() {
|
||||
// PNG then SVG; only the SVG should remain on disk.
|
||||
let dir = tempdir().unwrap();
|
||||
let b = BrandingStore::load_or_default(dir.path());
|
||||
b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
|
||||
b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
|
||||
let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
|
||||
.unwrap()
|
||||
.filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
|
||||
.collect();
|
||||
assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
|
||||
assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn logo_rev_bumps_on_each_set_and_clear() {
|
||||
let dir = tempdir().unwrap();
|
||||
let b = BrandingStore::load_or_default(dir.path());
|
||||
assert_eq!(b.logo_rev(), 0);
|
||||
b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
|
||||
assert_eq!(b.logo_rev(), 1);
|
||||
b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
|
||||
assert_eq!(b.logo_rev(), 2);
|
||||
b.clear_logo().unwrap();
|
||||
assert_eq!(b.logo_rev(), 3);
|
||||
// Survives a restart.
|
||||
drop(b);
|
||||
let b2 = BrandingStore::load_or_default(dir.path());
|
||||
assert_eq!(b2.logo_rev(), 3);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sanitize_ext_strips_separators_and_path_chars() {
|
||||
assert_eq!(sanitize_ext("svg"), "svg");
|
||||
// Path separators and non-alphanumerics filter out, leaving just
|
||||
// letters. The remaining "etcpasswd" exceeds the 5-char cap so
|
||||
// it collapses to `bin` rather than producing `etcpa`.
|
||||
assert_eq!(sanitize_ext("../etc/passwd"), "bin");
|
||||
// Short alphanumeric strip-through stays itself.
|
||||
assert_eq!(sanitize_ext("../svg"), "svg");
|
||||
assert_eq!(sanitize_ext(""), "bin");
|
||||
assert_eq!(sanitize_ext("PNG"), "png");
|
||||
// Anything past five chars is suspicious — collapse to `bin`.
|
||||
assert_eq!(sanitize_ext("svgvvvv"), "bin");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn missing_file_referenced_by_json_resolves_to_empty() {
|
||||
// If the operator nukes the file out from under the JSON cache,
|
||||
// we should silently fall back to no-override rather than
|
||||
// hanging on to a bogus path.
|
||||
let dir = tempdir().unwrap();
|
||||
let brand_dir = dir.path().join("branding");
|
||||
std::fs::create_dir_all(&brand_dir).unwrap();
|
||||
// Hand-write a branding.json claiming logo.png exists.
|
||||
let inner = Inner {
|
||||
logo_filename: Some("logo.png".into()),
|
||||
logo_mime: Some("image/png".into()),
|
||||
rev: 0,
|
||||
};
|
||||
std::fs::write(
|
||||
brand_dir.join("branding.json"),
|
||||
serde_json::to_vec_pretty(&inner).unwrap(),
|
||||
)
|
||||
.unwrap();
|
||||
let b = BrandingStore::load_or_default(dir.path());
|
||||
assert!(!b.has_logo(), "should fall back when referenced file is missing");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ext_for_mime_only_accepts_known_types() {
|
||||
assert_eq!(ext_for_mime("image/png"), Some("png"));
|
||||
assert_eq!(ext_for_mime("image/svg+xml"), Some("svg"));
|
||||
assert_eq!(ext_for_mime("application/octet-stream"), None);
|
||||
assert_eq!(ext_for_mime("text/html"), None);
|
||||
}
|
||||
}
|
||||
@@ -1,9 +1,10 @@
|
||||
//! Per-MAC host bindings.
|
||||
//!
|
||||
//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
|
||||
//! specific MAC address. When a client with that MAC arrives, the top-level
|
||||
//! boot script chains straight to that target instead of showing the
|
||||
//! interactive menu.
|
||||
//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
|
||||
//! operator can attach a preferred boot target (a `BootEntry::id`) to a
|
||||
//! specific MAC address. When a client with that MAC arrives, the
|
||||
//! top-level boot script chains straight to that target instead of
|
||||
//! showing the interactive menu.
|
||||
//!
|
||||
//! Use cases:
|
||||
//! - "This rack of Dell servers always images with Ubuntu Server 24.04"
|
||||
|
||||
@@ -3,34 +3,23 @@
|
||||
#![forbid(unsafe_code)]
|
||||
|
||||
pub mod arch;
|
||||
pub mod auth;
|
||||
pub mod boot_log;
|
||||
pub mod branding;
|
||||
pub mod client;
|
||||
pub mod config;
|
||||
pub mod error;
|
||||
pub mod host_bindings;
|
||||
pub mod log_bus;
|
||||
pub mod metrics;
|
||||
pub mod notify;
|
||||
pub mod queue;
|
||||
pub mod saml;
|
||||
pub mod settings;
|
||||
pub mod sso;
|
||||
pub mod wol;
|
||||
|
||||
pub use arch::{ClientArch, FirmwareClass};
|
||||
pub use auth::{AdminAccount, AdminPublic, AdminStore};
|
||||
pub use boot_log::{BootEvent, BootLog};
|
||||
pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
|
||||
pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
|
||||
pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
|
||||
pub use error::{Error, Result};
|
||||
pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
|
||||
pub use log_bus::{LogBus, LogBusLayer, LogLine};
|
||||
pub use metrics::{HttpRoute, Metrics};
|
||||
pub use notify::{NotifyConfig, NotifyKind, NotifyStore};
|
||||
pub use queue::{DeploymentQueue, QueueEntry};
|
||||
pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
|
||||
pub use settings::{Settings, SettingsStore, TimeoutAction};
|
||||
pub use sso::{SsoConfig, SsoStore};
|
||||
|
||||
@@ -1,362 +0,0 @@
|
||||
//! Webhook / email notification configuration.
|
||||
//!
|
||||
//! v0.5.0: OpenPXE can ping a chat webhook or send an email when
|
||||
//! something noteworthy happens (a machine PXE-booted an image, a
|
||||
//! deployment was assigned, a WoL was sent). One active provider at a
|
||||
//! time, chosen by `kind` — dead-simple for an L1 tech: pick Slack,
|
||||
//! paste the incoming-webhook URL, done.
|
||||
//!
|
||||
//! This module owns only the *configuration* (validation + persistence
|
||||
//! to `<work_dir>/notify.json`). The actual sending — HTTP POST for the
|
||||
//! chat providers, SMTP for email — lives in the http-api crate, which
|
||||
//! already carries an HTTP client and the SMTP dependency. Keeping the
|
||||
//! network I/O out of `core` matches how `BrandingStore`/`SsoStore`
|
||||
//! stay pure config stores.
|
||||
//!
|
||||
//! Secrets note: the SMTP password is persisted in `notify.json`
|
||||
//! alongside the rest of the config (0644 like the other state files).
|
||||
//! It is never echoed back through the API — the snapshot used for the
|
||||
//! GET response blanks it (see `Self::redacted`).
|
||||
|
||||
use parking_lot::RwLock;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::path::PathBuf;
|
||||
use std::sync::Arc;
|
||||
|
||||
use crate::{Error, Result};
|
||||
|
||||
const MAX_URL_LEN: usize = 2048;
|
||||
const MAX_FIELD_LEN: usize = 512;
|
||||
|
||||
/// Which notification transport is active.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "lowercase")]
|
||||
pub enum NotifyKind {
|
||||
/// Slack incoming webhook (`{ "text": ... }`).
|
||||
#[default]
|
||||
Slack,
|
||||
/// Discord webhook (`{ "content": ... }`).
|
||||
Discord,
|
||||
/// Microsoft Teams incoming webhook (legacy MessageCard JSON).
|
||||
Teams,
|
||||
/// Email via SMTP.
|
||||
Smtp,
|
||||
}
|
||||
|
||||
impl NotifyKind {
|
||||
/// True when this kind drives a chat webhook (POST a JSON body to a
|
||||
/// single URL) rather than SMTP.
|
||||
#[must_use]
|
||||
pub fn is_webhook(self) -> bool {
|
||||
matches!(self, Self::Slack | Self::Discord | Self::Teams)
|
||||
}
|
||||
}
|
||||
|
||||
/// Operator-configurable notification settings. Single provider active
|
||||
/// at a time; the inactive fields are kept so switching providers
|
||||
/// doesn't wipe the other one's values.
|
||||
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
|
||||
pub struct NotifyConfig {
|
||||
#[serde(default)]
|
||||
pub enabled: bool,
|
||||
#[serde(default)]
|
||||
pub kind: NotifyKind,
|
||||
/// Incoming-webhook URL for Slack / Discord / Teams.
|
||||
#[serde(default)]
|
||||
pub webhook_url: String,
|
||||
|
||||
// ── SMTP fields (used when kind == Smtp) ──
|
||||
#[serde(default)]
|
||||
pub smtp_host: String,
|
||||
#[serde(default = "default_smtp_port")]
|
||||
pub smtp_port: u16,
|
||||
#[serde(default)]
|
||||
pub smtp_username: String,
|
||||
#[serde(default)]
|
||||
pub smtp_password: String,
|
||||
/// `From:` address. Falls back to `smtp_username` when blank.
|
||||
#[serde(default)]
|
||||
pub smtp_from: String,
|
||||
/// `To:` address (single recipient — keep it simple).
|
||||
#[serde(default)]
|
||||
pub smtp_to: String,
|
||||
/// Use implicit TLS (port 465). When false we use STARTTLS on the
|
||||
/// configured port (587 typical). Either way the connection is
|
||||
/// encrypted — we never offer plaintext SMTP.
|
||||
#[serde(default)]
|
||||
pub smtp_implicit_tls: bool,
|
||||
}
|
||||
|
||||
fn default_smtp_port() -> u16 {
|
||||
587
|
||||
}
|
||||
|
||||
impl NotifyConfig {
|
||||
/// True when enabled and the active provider has the fields it
|
||||
/// needs to actually send.
|
||||
#[must_use]
|
||||
pub fn is_usable(&self) -> bool {
|
||||
if !self.enabled {
|
||||
return false;
|
||||
}
|
||||
if self.kind.is_webhook() {
|
||||
!self.webhook_url.trim().is_empty()
|
||||
} else {
|
||||
!self.smtp_host.trim().is_empty() && !self.smtp_to.trim().is_empty()
|
||||
}
|
||||
}
|
||||
|
||||
/// A copy safe to return over the API: the SMTP password is blanked
|
||||
/// (replaced with a non-empty sentinel only when one is set, so the
|
||||
/// UI can show "configured" without leaking it).
|
||||
#[must_use]
|
||||
pub fn redacted(&self) -> NotifyConfig {
|
||||
let mut c = self.clone();
|
||||
if !c.smtp_password.is_empty() {
|
||||
c.smtp_password = SECRET_SENTINEL.to_string();
|
||||
}
|
||||
c
|
||||
}
|
||||
}
|
||||
|
||||
/// Returned by the API in place of a stored password. When the UI PUTs
|
||||
/// this value back unchanged we keep the existing password rather than
|
||||
/// overwriting it with the sentinel.
|
||||
pub const SECRET_SENTINEL: &str = "__keep__";
|
||||
|
||||
/// In-memory + on-disk notification config registry.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct NotifyStore {
|
||||
path: Arc<PathBuf>,
|
||||
inner: Arc<RwLock<NotifyConfig>>,
|
||||
}
|
||||
|
||||
impl NotifyStore {
|
||||
#[must_use]
|
||||
pub fn load_or_default(work_dir: &std::path::Path) -> Self {
|
||||
let path = work_dir.join("notify.json");
|
||||
let cfg = match std::fs::read_to_string(&path) {
|
||||
Ok(text) => serde_json::from_str::<NotifyConfig>(&text).unwrap_or_else(|e| {
|
||||
tracing::warn!(
|
||||
target: "openpxe::notify",
|
||||
"notify.json unreadable ({e}); starting with defaults"
|
||||
);
|
||||
NotifyConfig::default()
|
||||
}),
|
||||
Err(_) => NotifyConfig::default(),
|
||||
};
|
||||
Self {
|
||||
path: Arc::new(path),
|
||||
inner: Arc::new(RwLock::new(cfg)),
|
||||
}
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
pub fn snapshot(&self) -> NotifyConfig {
|
||||
self.inner.read().clone()
|
||||
}
|
||||
|
||||
/// Replace the whole config. `incoming.smtp_password == SECRET_SENTINEL`
|
||||
/// is treated as "keep the existing password" so the UI never has to
|
||||
/// round-trip the real secret.
|
||||
pub fn replace(&self, mut incoming: NotifyConfig) -> Result<NotifyConfig> {
|
||||
incoming.webhook_url = incoming.webhook_url.trim().to_string();
|
||||
incoming.smtp_host = incoming.smtp_host.trim().to_string();
|
||||
incoming.smtp_username = incoming.smtp_username.trim().to_string();
|
||||
incoming.smtp_from = incoming.smtp_from.trim().to_string();
|
||||
incoming.smtp_to = incoming.smtp_to.trim().to_string();
|
||||
|
||||
// Preserve the stored password when the UI sends the sentinel.
|
||||
if incoming.smtp_password == SECRET_SENTINEL {
|
||||
incoming
|
||||
.smtp_password
|
||||
.clone_from(&self.inner.read().smtp_password);
|
||||
}
|
||||
|
||||
// Length caps.
|
||||
if incoming.webhook_url.len() > MAX_URL_LEN {
|
||||
return Err(Error::Invalid(format!(
|
||||
"webhook URL exceeds {MAX_URL_LEN}-char cap"
|
||||
)));
|
||||
}
|
||||
for (name, v) in [
|
||||
("smtp_host", &incoming.smtp_host),
|
||||
("smtp_username", &incoming.smtp_username),
|
||||
("smtp_from", &incoming.smtp_from),
|
||||
("smtp_to", &incoming.smtp_to),
|
||||
] {
|
||||
if v.len() > MAX_FIELD_LEN {
|
||||
return Err(Error::Invalid(format!(
|
||||
"{name} exceeds {MAX_FIELD_LEN}-char cap"
|
||||
)));
|
||||
}
|
||||
}
|
||||
|
||||
// Validate the active provider only when enabling.
|
||||
if incoming.enabled {
|
||||
if incoming.kind.is_webhook() {
|
||||
if incoming.webhook_url.is_empty() {
|
||||
return Err(Error::Invalid(
|
||||
"a webhook URL is required to enable chat notifications".into(),
|
||||
));
|
||||
}
|
||||
if !incoming.webhook_url.starts_with("https://")
|
||||
&& !incoming.webhook_url.starts_with("http://")
|
||||
{
|
||||
return Err(Error::Invalid(
|
||||
"webhook URL must start with http:// or https://".into(),
|
||||
));
|
||||
}
|
||||
} else {
|
||||
if incoming.smtp_host.is_empty() {
|
||||
return Err(Error::Invalid(
|
||||
"SMTP host is required to enable email notifications".into(),
|
||||
));
|
||||
}
|
||||
if incoming.smtp_to.is_empty() {
|
||||
return Err(Error::Invalid(
|
||||
"a recipient (To) is required to enable email notifications".into(),
|
||||
));
|
||||
}
|
||||
if incoming.smtp_port == 0 {
|
||||
return Err(Error::Invalid("SMTP port must be non-zero".into()));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
{
|
||||
let mut g = self.inner.write();
|
||||
*g = incoming.clone();
|
||||
}
|
||||
self.persist();
|
||||
tracing::info!(
|
||||
target: "openpxe::notify",
|
||||
enabled = incoming.enabled, kind = ?incoming.kind,
|
||||
"notification configuration updated"
|
||||
);
|
||||
Ok(incoming)
|
||||
}
|
||||
|
||||
fn persist(&self) {
|
||||
let snap = self.inner.read().clone();
|
||||
let body = match serde_json::to_vec_pretty(&snap) {
|
||||
Ok(b) => b,
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::notify", "serialize notify.json: {e}");
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Some(parent) = self.path.parent() {
|
||||
let _ = std::fs::create_dir_all(parent);
|
||||
}
|
||||
let tmp = self.path.with_extension("json.tmp");
|
||||
if let Err(e) = std::fs::write(&tmp, body) {
|
||||
tracing::warn!(target: "openpxe::notify", "write notify.json tmp: {e}");
|
||||
return;
|
||||
}
|
||||
if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
|
||||
tracing::warn!(target: "openpxe::notify", "rename notify.json: {e}");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tempfile::tempdir;
|
||||
|
||||
#[test]
|
||||
fn default_disabled_not_usable() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = NotifyStore::load_or_default(dir.path());
|
||||
assert!(!s.snapshot().enabled);
|
||||
assert!(!s.snapshot().is_usable());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn slack_requires_url_when_enabled() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = NotifyStore::load_or_default(dir.path());
|
||||
let r = s.replace(NotifyConfig {
|
||||
enabled: true,
|
||||
kind: NotifyKind::Slack,
|
||||
..Default::default()
|
||||
});
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
s.replace(NotifyConfig {
|
||||
enabled: true,
|
||||
kind: NotifyKind::Slack,
|
||||
webhook_url: "https://hooks.slack.com/services/XXX".into(),
|
||||
..Default::default()
|
||||
})
|
||||
.unwrap();
|
||||
assert!(s.snapshot().is_usable());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn smtp_requires_host_and_recipient() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = NotifyStore::load_or_default(dir.path());
|
||||
let r = s.replace(NotifyConfig {
|
||||
enabled: true,
|
||||
kind: NotifyKind::Smtp,
|
||||
smtp_host: "smtp.example.com".into(),
|
||||
..Default::default()
|
||||
});
|
||||
assert!(matches!(r, Err(Error::Invalid(_))), "missing recipient should reject");
|
||||
s.replace(NotifyConfig {
|
||||
enabled: true,
|
||||
kind: NotifyKind::Smtp,
|
||||
smtp_host: "smtp.example.com".into(),
|
||||
smtp_port: 587,
|
||||
smtp_to: "[email protected]".into(),
|
||||
smtp_from: "[email protected]".into(),
|
||||
..Default::default()
|
||||
})
|
||||
.unwrap();
|
||||
assert!(s.snapshot().is_usable());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn password_sentinel_preserves_stored_secret() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = NotifyStore::load_or_default(dir.path());
|
||||
s.replace(NotifyConfig {
|
||||
enabled: true,
|
||||
kind: NotifyKind::Smtp,
|
||||
smtp_host: "smtp.example.com".into(),
|
||||
smtp_port: 587,
|
||||
smtp_to: "[email protected]".into(),
|
||||
smtp_password: "s3cret".into(),
|
||||
..Default::default()
|
||||
})
|
||||
.unwrap();
|
||||
// Redacted snapshot hides the password behind the sentinel.
|
||||
assert_eq!(s.snapshot().redacted().smtp_password, SECRET_SENTINEL);
|
||||
// PUTting the sentinel back keeps the real password.
|
||||
s.replace(NotifyConfig {
|
||||
enabled: true,
|
||||
kind: NotifyKind::Smtp,
|
||||
smtp_host: "smtp.example.com".into(),
|
||||
smtp_port: 587,
|
||||
smtp_to: "[email protected]".into(),
|
||||
smtp_password: SECRET_SENTINEL.into(),
|
||||
..Default::default()
|
||||
})
|
||||
.unwrap();
|
||||
assert_eq!(s.snapshot().smtp_password, "s3cret");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn webhook_url_scheme_enforced() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = NotifyStore::load_or_default(dir.path());
|
||||
let r = s.replace(NotifyConfig {
|
||||
enabled: true,
|
||||
kind: NotifyKind::Discord,
|
||||
webhook_url: "ftp://example.com/hook".into(),
|
||||
..Default::default()
|
||||
});
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
}
|
||||
}
|
||||
@@ -1,188 +0,0 @@
|
||||
//! AuthnRequest construction + HTTP-Redirect binding encoding.
|
||||
//!
|
||||
//! For SP-initiated login we build an `<AuthnRequest>`, then encode it for the
|
||||
//! HTTP-Redirect binding: raw DEFLATE (RFC 1951) → base64 → percent-encode,
|
||||
//! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
|
||||
//! unsigned in this release (the IdP must not require client signatures).
|
||||
|
||||
use std::fmt::Write as _;
|
||||
use std::io::Write as _;
|
||||
|
||||
use base64::Engine;
|
||||
use flate2::write::DeflateEncoder;
|
||||
use flate2::Compression;
|
||||
use time::format_description::well_known::Rfc3339;
|
||||
use time::OffsetDateTime;
|
||||
|
||||
use super::{SamlError, SpParams};
|
||||
|
||||
const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
|
||||
const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
|
||||
const NAMEID_EMAIL: &str = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
|
||||
const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
|
||||
|
||||
/// A built AuthnRequest, ready to redirect the browser to the IdP.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct AuthnRequest {
|
||||
/// The request `ID` — the caller records this so the matching response's
|
||||
/// `InResponseTo` can be correlated (replay/CSRF protection).
|
||||
pub id: String,
|
||||
/// The full IdP URL to 302 the browser to (includes `SAMLRequest` and,
|
||||
/// when supplied, `RelayState`).
|
||||
pub location: String,
|
||||
}
|
||||
|
||||
/// Build an AuthnRequest targeting `idp_sso_url` and encode it for the
|
||||
/// HTTP-Redirect binding. `relay_state`, if given, round-trips back to us via
|
||||
/// the response (we use it to send the operator to their intended page).
|
||||
pub fn build(
|
||||
sp: &SpParams,
|
||||
idp_sso_url: &str,
|
||||
relay_state: Option<&str>,
|
||||
) -> Result<AuthnRequest, SamlError> {
|
||||
let id = format!("_{}", uuid::Uuid::new_v4().simple());
|
||||
let issue_instant = OffsetDateTime::now_utc()
|
||||
.replace_nanosecond(0)
|
||||
.unwrap_or_else(|_| OffsetDateTime::now_utc())
|
||||
.format(&Rfc3339)
|
||||
.map_err(|e| SamlError::Timestamp(e.to_string()))?;
|
||||
|
||||
let xml = format!(
|
||||
r#"<samlp:AuthnRequest xmlns:samlp="{NS_PROTOCOL}" xmlns:saml="{NS_ASSERTION}" ID="{id}" Version="2.0" IssueInstant="{instant}" Destination="{dest}" ProtocolBinding="{BINDING_POST}" AssertionConsumerServiceURL="{acs}"><saml:Issuer>{issuer}</saml:Issuer><samlp:NameIDPolicy Format="{NAMEID_EMAIL}" AllowCreate="true"/></samlp:AuthnRequest>"#,
|
||||
instant = issue_instant,
|
||||
dest = xml_escape(idp_sso_url),
|
||||
acs = xml_escape(&sp.acs_url),
|
||||
issuer = xml_escape(&sp.entity_id),
|
||||
);
|
||||
|
||||
let encoded = deflate_base64(&xml)?;
|
||||
|
||||
let sep = if idp_sso_url.contains('?') { '&' } else { '?' };
|
||||
let mut location = format!("{idp_sso_url}{sep}SAMLRequest={}", pct_encode(&encoded));
|
||||
if let Some(rs) = relay_state {
|
||||
location.push_str("&RelayState=");
|
||||
location.push_str(&pct_encode(rs));
|
||||
}
|
||||
|
||||
Ok(AuthnRequest { id, location })
|
||||
}
|
||||
|
||||
/// Raw-DEFLATE then base64 — the HTTP-Redirect binding's `SAMLRequest` payload.
|
||||
fn deflate_base64(xml: &str) -> Result<String, SamlError> {
|
||||
let mut enc = DeflateEncoder::new(Vec::new(), Compression::default());
|
||||
enc.write_all(xml.as_bytes())
|
||||
.and_then(|()| enc.try_finish())
|
||||
.map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
|
||||
let compressed = enc
|
||||
.finish()
|
||||
.map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
|
||||
Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
|
||||
}
|
||||
|
||||
/// Percent-encode a query-string component (RFC 3986 unreserved set passes
|
||||
/// through; everything else is `%XX`).
|
||||
fn pct_encode(s: &str) -> String {
|
||||
let mut out = String::with_capacity(s.len() * 3);
|
||||
for b in s.bytes() {
|
||||
match b {
|
||||
b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
|
||||
out.push(b as char);
|
||||
}
|
||||
_ => {
|
||||
let _ = write!(out, "%{b:02X}");
|
||||
}
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
fn xml_escape(s: &str) -> String {
|
||||
let mut out = String::with_capacity(s.len());
|
||||
for c in s.chars() {
|
||||
match c {
|
||||
'&' => out.push_str("&"),
|
||||
'<' => out.push_str("<"),
|
||||
'>' => out.push_str(">"),
|
||||
'"' => out.push_str("""),
|
||||
'\'' => out.push_str("'"),
|
||||
_ => out.push(c),
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use flate2::read::DeflateDecoder;
|
||||
use std::io::Read;
|
||||
|
||||
fn sp() -> SpParams {
|
||||
SpParams {
|
||||
entity_id: "https://pxe.example.com".into(),
|
||||
acs_url: "https://pxe.example.com/api/sso/acs".into(),
|
||||
}
|
||||
}
|
||||
|
||||
fn pct_decode(s: &str) -> Vec<u8> {
|
||||
let bytes = s.as_bytes();
|
||||
let mut out = Vec::with_capacity(bytes.len());
|
||||
let mut i = 0;
|
||||
while i < bytes.len() {
|
||||
if bytes[i] == b'%' && i + 2 < bytes.len() {
|
||||
let hi = (bytes[i + 1] as char).to_digit(16).unwrap();
|
||||
let lo = (bytes[i + 2] as char).to_digit(16).unwrap();
|
||||
out.push((hi * 16 + lo) as u8);
|
||||
i += 3;
|
||||
} else {
|
||||
out.push(bytes[i]);
|
||||
i += 1;
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn id_is_ncname_and_location_has_request() {
|
||||
let req = build(&sp(), "https://idp.example.com/sso", Some("/dashboard")).unwrap();
|
||||
assert!(req.id.starts_with('_'));
|
||||
assert!(req
|
||||
.location
|
||||
.starts_with("https://idp.example.com/sso?SAMLRequest="));
|
||||
assert!(req.location.contains("&RelayState=%2Fdashboard"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn redirect_payload_round_trips_to_our_authn_request() {
|
||||
let req = build(&sp(), "https://idp.example.com/sso", None).unwrap();
|
||||
// Pull SAMLRequest value out of the query string.
|
||||
let q = req.location.split("SAMLRequest=").nth(1).unwrap();
|
||||
let val = q.split('&').next().unwrap();
|
||||
let compressed = base64::engine::general_purpose::STANDARD
|
||||
.decode(pct_decode(val))
|
||||
.unwrap();
|
||||
let mut inflate = DeflateDecoder::new(&compressed[..]);
|
||||
let mut xml = String::new();
|
||||
inflate.read_to_string(&mut xml).unwrap();
|
||||
|
||||
let doc = roxmltree::Document::parse(&xml).unwrap();
|
||||
let root = doc.root_element();
|
||||
assert_eq!(root.tag_name().name(), "AuthnRequest");
|
||||
assert_eq!(root.attribute("ID").unwrap(), req.id);
|
||||
assert_eq!(
|
||||
root.attribute("AssertionConsumerServiceURL").unwrap(),
|
||||
"https://pxe.example.com/api/sso/acs"
|
||||
);
|
||||
let issuer = root
|
||||
.descendants()
|
||||
.find(|n| n.tag_name().name() == "Issuer")
|
||||
.unwrap();
|
||||
assert_eq!(issuer.text().unwrap(), "https://pxe.example.com");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn existing_query_uses_ampersand_separator() {
|
||||
let req = build(&sp(), "https://idp.example.com/sso?foo=bar", None).unwrap();
|
||||
assert!(req.location.contains("?foo=bar&SAMLRequest="));
|
||||
}
|
||||
}
|
||||
@@ -1,241 +0,0 @@
|
||||
//! IdP metadata parsing + SP metadata generation.
|
||||
//!
|
||||
//! We parse only what the SP flow needs: the IdP Entity ID, its
|
||||
//! `SingleSignOnService` endpoints (HTTP-Redirect / HTTP-POST), and the
|
||||
//! X.509 signing certificate(s). Everything else in the document is ignored.
|
||||
|
||||
use base64::Engine;
|
||||
|
||||
use super::{SamlError, SpParams};
|
||||
|
||||
/// SAML 2.0 binding URIs.
|
||||
pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
|
||||
pub const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
|
||||
|
||||
/// The subset of an IdP's `EntityDescriptor` the SP flow consumes.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct IdpMetadata {
|
||||
/// The IdP's Entity ID — we require incoming assertions to be issued by it.
|
||||
pub entity_id: String,
|
||||
/// SSO endpoint for the HTTP-Redirect binding (where we send AuthnRequests).
|
||||
pub sso_redirect_url: Option<String>,
|
||||
/// SSO endpoint for the HTTP-POST binding (fallback target).
|
||||
pub sso_post_url: Option<String>,
|
||||
/// DER-encoded X.509 signing certificate(s). More than one appears during
|
||||
/// key rotation; verification tries each.
|
||||
pub signing_certs_der: Vec<Vec<u8>>,
|
||||
}
|
||||
|
||||
impl IdpMetadata {
|
||||
/// Parse an IdP `EntityDescriptor` document.
|
||||
///
|
||||
/// Robust to namespace-prefix variation (matches on local element names),
|
||||
/// since IdPs disagree on prefixes (`md:`, `ns0:`, default, …).
|
||||
pub fn parse(xml: &str) -> Result<Self, SamlError> {
|
||||
let doc = roxmltree::Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
|
||||
let root = doc.root_element();
|
||||
|
||||
// The signing IDP descriptor. Some metadata wraps multiple
|
||||
// descriptors (AA, SP) in one document; we want IDPSSODescriptor.
|
||||
let idp_desc = root
|
||||
.descendants()
|
||||
.find(|n| n.is_element() && n.tag_name().name() == "IDPSSODescriptor")
|
||||
.ok_or_else(|| SamlError::Metadata("IDPSSODescriptor".into()))?;
|
||||
|
||||
// Entity ID lives on the EntityDescriptor (root, or an ancestor of the
|
||||
// IDPSSODescriptor when several are nested).
|
||||
let entity_id = idp_desc
|
||||
.ancestors()
|
||||
.find_map(|n| {
|
||||
if n.tag_name().name() == "EntityDescriptor" {
|
||||
n.attribute("entityID")
|
||||
} else {
|
||||
None
|
||||
}
|
||||
})
|
||||
.or_else(|| root.attribute("entityID"))
|
||||
.map(str::to_owned)
|
||||
.ok_or_else(|| SamlError::Metadata("entityID".into()))?;
|
||||
|
||||
let mut sso_redirect_url = None;
|
||||
let mut sso_post_url = None;
|
||||
for sso in idp_desc
|
||||
.children()
|
||||
.filter(|n| n.is_element() && n.tag_name().name() == "SingleSignOnService")
|
||||
{
|
||||
let binding = sso.attribute("Binding").unwrap_or("");
|
||||
let location = sso.attribute("Location").map(str::to_owned);
|
||||
match binding {
|
||||
BINDING_REDIRECT if sso_redirect_url.is_none() => sso_redirect_url = location,
|
||||
BINDING_POST if sso_post_url.is_none() => sso_post_url = location,
|
||||
_ => {}
|
||||
}
|
||||
}
|
||||
|
||||
// Signing certs: KeyDescriptor with use="signing" or no use attribute
|
||||
// (a bare KeyDescriptor is valid for both signing and encryption).
|
||||
let mut signing_certs_der = Vec::new();
|
||||
for kd in idp_desc
|
||||
.children()
|
||||
.filter(|n| n.is_element() && n.tag_name().name() == "KeyDescriptor")
|
||||
{
|
||||
match kd.attribute("use") {
|
||||
Some("signing") | None => {}
|
||||
Some(_) => continue, // encryption-only key — skip
|
||||
}
|
||||
for cert_node in kd
|
||||
.descendants()
|
||||
.filter(|n| n.is_element() && n.tag_name().name() == "X509Certificate")
|
||||
{
|
||||
let b64: String = node_text(&cert_node)
|
||||
.chars()
|
||||
.filter(|c| !c.is_whitespace())
|
||||
.collect();
|
||||
if b64.is_empty() {
|
||||
continue;
|
||||
}
|
||||
let der = base64::engine::general_purpose::STANDARD
|
||||
.decode(b64.as_bytes())
|
||||
.map_err(|e| SamlError::Base64(e.to_string()))?;
|
||||
signing_certs_der.push(der);
|
||||
}
|
||||
}
|
||||
|
||||
if signing_certs_der.is_empty() {
|
||||
return Err(SamlError::NoSigningCert);
|
||||
}
|
||||
|
||||
Ok(Self {
|
||||
entity_id,
|
||||
sso_redirect_url,
|
||||
sso_post_url,
|
||||
signing_certs_der,
|
||||
})
|
||||
}
|
||||
|
||||
/// Preferred SSO destination for an outbound AuthnRequest: HTTP-Redirect
|
||||
/// if advertised, otherwise HTTP-POST.
|
||||
pub fn sso_destination(&self) -> Option<&str> {
|
||||
self.sso_redirect_url
|
||||
.as_deref()
|
||||
.or(self.sso_post_url.as_deref())
|
||||
}
|
||||
}
|
||||
|
||||
/// Build our SP `EntityDescriptor` XML so an IdP admin can import OpenPXE as a
|
||||
/// relying party. Advertises the ACS URL (HTTP-POST binding) and an emailAddress
|
||||
/// NameID format — matching what the response path expects.
|
||||
pub fn build_sp_metadata(sp: &SpParams) -> String {
|
||||
let entity = xml_escape(&sp.entity_id);
|
||||
let acs = xml_escape(&sp.acs_url);
|
||||
format!(
|
||||
r#"<?xml version="1.0" encoding="UTF-8"?>
|
||||
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entity}">
|
||||
<SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
|
||||
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
|
||||
<AssertionConsumerService Binding="{BINDING_POST}" Location="{acs}" index="0" isDefault="true"/>
|
||||
</SPSSODescriptor>
|
||||
</EntityDescriptor>
|
||||
"#
|
||||
)
|
||||
}
|
||||
|
||||
/// Collect the concatenated text of an element's direct text children.
|
||||
fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
|
||||
n.children()
|
||||
.filter(roxmltree::Node::is_text)
|
||||
.filter_map(|c| c.text())
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Minimal XML attribute/text escaping for the values we interpolate.
|
||||
fn xml_escape(s: &str) -> String {
|
||||
let mut out = String::with_capacity(s.len());
|
||||
for c in s.chars() {
|
||||
match c {
|
||||
'&' => out.push_str("&"),
|
||||
'<' => out.push_str("<"),
|
||||
'>' => out.push_str(">"),
|
||||
'"' => out.push_str("""),
|
||||
'\'' => out.push_str("'"),
|
||||
_ => out.push(c),
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
// A trimmed-down Keycloak-style IdP descriptor (cert body is a stand-in;
|
||||
// signing tests build real certs in the parent module's tests).
|
||||
const SAMPLE: &str = r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
||||
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
|
||||
entityID="https://idp.example.com/realms/fleet">
|
||||
<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
|
||||
<md:KeyDescriptor use="signing">
|
||||
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>
|
||||
QUJDREVG
|
||||
</ds:X509Certificate></ds:X509Data></ds:KeyInfo>
|
||||
</md:KeyDescriptor>
|
||||
<md:KeyDescriptor use="encryption">
|
||||
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>WlpaWg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo>
|
||||
</md:KeyDescriptor>
|
||||
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
|
||||
Location="https://idp.example.com/realms/fleet/protocol/saml"/>
|
||||
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
|
||||
Location="https://idp.example.com/realms/fleet/protocol/saml"/>
|
||||
</md:IDPSSODescriptor>
|
||||
</md:EntityDescriptor>"#;
|
||||
|
||||
#[test]
|
||||
fn parses_entity_sso_and_signing_cert() {
|
||||
let m = IdpMetadata::parse(SAMPLE).unwrap();
|
||||
assert_eq!(m.entity_id, "https://idp.example.com/realms/fleet");
|
||||
assert_eq!(
|
||||
m.sso_redirect_url.as_deref(),
|
||||
Some("https://idp.example.com/realms/fleet/protocol/saml")
|
||||
);
|
||||
assert!(m.sso_post_url.is_some());
|
||||
// Only the signing KeyDescriptor's cert is collected (ABCDEF), not the
|
||||
// encryption one (ZZZZ).
|
||||
assert_eq!(m.signing_certs_der.len(), 1);
|
||||
assert_eq!(m.signing_certs_der[0], b"ABCDEF");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn missing_signing_cert_is_rejected() {
|
||||
let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x">
|
||||
<IDPSSODescriptor>
|
||||
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://x/sso"/>
|
||||
</IDPSSODescriptor></EntityDescriptor>"#;
|
||||
assert!(matches!(
|
||||
IdpMetadata::parse(xml),
|
||||
Err(SamlError::NoSigningCert)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn missing_idp_descriptor_is_rejected() {
|
||||
let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x"></EntityDescriptor>"#;
|
||||
assert!(matches!(
|
||||
IdpMetadata::parse(xml),
|
||||
Err(SamlError::Metadata(_))
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sp_metadata_contains_entity_and_acs() {
|
||||
let sp = SpParams {
|
||||
entity_id: "https://pxe.example.com".into(),
|
||||
acs_url: "https://pxe.example.com/api/sso/acs".into(),
|
||||
};
|
||||
let xml = build_sp_metadata(&sp);
|
||||
assert!(xml.contains(r#"entityID="https://pxe.example.com""#));
|
||||
assert!(xml.contains("https://pxe.example.com/api/sso/acs"));
|
||||
assert!(xml.contains(BINDING_POST));
|
||||
// Must be well-formed.
|
||||
roxmltree::Document::parse(&xml).unwrap();
|
||||
}
|
||||
}
|
||||
@@ -1,92 +0,0 @@
|
||||
//! Pure-Rust SAML 2.0 Service Provider (v0.5.1).
|
||||
//!
|
||||
//! This module implements the SP half of a SAML Web-Browser-SSO profile:
|
||||
//!
|
||||
//! * [`metadata`] — parse the IdP's `EntityDescriptor` (SSO URLs + signing
|
||||
//! certificates) and build *our* SP metadata for the IdP admin to import.
|
||||
//! * [`authn_request`] — build an `AuthnRequest` and encode it for the
|
||||
//! HTTP-Redirect binding.
|
||||
//! * [`response`] — decode a `SAMLResponse`, **verify its XML signature**
|
||||
//! against the IdP's pinned certificate (via the pure-Rust `bergshamra`
|
||||
//! crate — no OpenSSL/libxml2/xmlsec, so the static musl binary stays
|
||||
//! C-free), then enforce the SP-side semantic checks (Status, Destination,
|
||||
//! Audience, time bounds) that are where SAML SPs actually get attacked.
|
||||
//!
|
||||
//! Stateful checks (replay of assertion IDs, correlating `InResponseTo`
|
||||
//! against requests *we* issued, gating IdP-initiated login) live in the
|
||||
//! HTTP layer — [`response::consume`] is deliberately stateless and returns
|
||||
//! the IDs the caller needs to perform them.
|
||||
//!
|
||||
//! Access model: any assertion the IdP authenticates and we cryptographically
|
||||
//! verify yields an operator [`VerifiedPrincipal`]. OpenPXE is single-tier —
|
||||
//! there is no per-user role table — and the local admin account remains a
|
||||
//! guaranteed fallback owner regardless of SSO state.
|
||||
|
||||
pub mod authn_request;
|
||||
pub mod metadata;
|
||||
pub mod response;
|
||||
|
||||
pub use authn_request::AuthnRequest;
|
||||
pub use metadata::IdpMetadata;
|
||||
pub use response::{VerifiedPrincipal, VerifiedResponse};
|
||||
|
||||
use thiserror::Error;
|
||||
|
||||
/// Default clock-skew tolerance applied to assertion time bounds. SAML IdPs
|
||||
/// and SPs rarely have perfectly synced clocks; 60s matches common practice
|
||||
/// (Shibboleth/FleetDM defaults are in this ballpark).
|
||||
pub const DEFAULT_CLOCK_SKEW_SECS: i64 = 60;
|
||||
|
||||
/// Runtime SP parameters, derived from [`crate::SsoConfig`] + the advertised
|
||||
/// public base URL by the HTTP layer.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct SpParams {
|
||||
/// Our SP Entity ID (the `<Issuer>` we send and the `Audience` we require
|
||||
/// in responses). Defaults to the public base URL when the operator left
|
||||
/// the Entity ID field blank.
|
||||
pub entity_id: String,
|
||||
/// The Assertion Consumer Service URL the IdP POSTs the response to —
|
||||
/// `<public_base_url>/api/sso/acs`.
|
||||
pub acs_url: String,
|
||||
}
|
||||
|
||||
/// Everything that can go wrong consuming a SAML response. Kept coarse on
|
||||
/// purpose: the HTTP layer logs the detail and shows the operator a generic
|
||||
/// "SSO sign-in failed" — we never leak which specific check tripped to the
|
||||
/// browser, since that aids an attacker probing the SP.
|
||||
#[derive(Debug, Error)]
|
||||
pub enum SamlError {
|
||||
#[error("SAML XML parse error: {0}")]
|
||||
Xml(String),
|
||||
#[error("IdP metadata is missing a required element: {0}")]
|
||||
Metadata(String),
|
||||
#[error("no usable IdP signing certificate in metadata")]
|
||||
NoSigningCert,
|
||||
#[error("signature verification failed: {0}")]
|
||||
Signature(String),
|
||||
#[error("the signature does not cover the assertion we read")]
|
||||
SignatureScope,
|
||||
#[error("SAML response status was not Success: {0}")]
|
||||
Status(String),
|
||||
#[error("response is missing a required element: {0}")]
|
||||
MissingElement(String),
|
||||
#[error("encrypted assertions are not supported in this release")]
|
||||
EncryptedAssertionUnsupported,
|
||||
#[error("expected exactly one assertion, found {0}")]
|
||||
AssertionCount(usize),
|
||||
#[error("issuer mismatch: response was not issued by the configured IdP")]
|
||||
IssuerMismatch,
|
||||
#[error("audience mismatch: assertion is not addressed to this service provider")]
|
||||
AudienceMismatch,
|
||||
#[error("response destination does not match our ACS URL")]
|
||||
DestinationMismatch,
|
||||
#[error("assertion is expired or not yet valid")]
|
||||
TimeBounds,
|
||||
#[error("invalid SAML timestamp: {0}")]
|
||||
Timestamp(String),
|
||||
#[error("base64 decode failed: {0}")]
|
||||
Base64(String),
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests;
|
||||
@@ -1,294 +0,0 @@
|
||||
//! SAMLResponse consumption: signature verification + SP-side validation.
|
||||
//!
|
||||
//! [`consume`] is intentionally **stateless** — it verifies the XML signature
|
||||
//! against the IdP's pinned certificate(s) and enforces every check that can
|
||||
//! be made from the response alone (Status, Destination, Issuer, Audience,
|
||||
//! time bounds, signature scope). It then returns the `assertion_id` and
|
||||
//! `in_response_to` so the HTTP layer can perform the *stateful* checks it
|
||||
//! owns: replay rejection, correlating the request we issued, and gating
|
||||
//! IdP-initiated login.
|
||||
|
||||
use roxmltree::{Document, Node};
|
||||
use time::format_description::well_known::Rfc3339;
|
||||
use time::{Duration, OffsetDateTime};
|
||||
|
||||
use super::metadata::IdpMetadata;
|
||||
use super::{SamlError, SpParams};
|
||||
|
||||
const STATUS_SUCCESS: &str = "urn:oasis:names:tc:SAML:2.0:status:Success";
|
||||
|
||||
/// The verified subject of a SAML assertion. OpenPXE is single-tier, so this
|
||||
/// is all an operator session needs.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct VerifiedPrincipal {
|
||||
/// The `<NameID>` value (an email, per our requested NameID format).
|
||||
pub name_id: String,
|
||||
/// Email used as the session identity. Equals `name_id` for the
|
||||
/// emailAddress NameID format.
|
||||
pub email: String,
|
||||
/// Human-readable display name, if the IdP sent one as an attribute.
|
||||
pub display_name: Option<String>,
|
||||
}
|
||||
|
||||
/// Result of a successful [`consume`]. The IDs/expiry feed the HTTP layer's
|
||||
/// stateful checks.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct VerifiedResponse {
|
||||
pub principal: VerifiedPrincipal,
|
||||
/// `InResponseTo` from the response, if present. `None` = unsolicited
|
||||
/// (IdP-initiated) — the HTTP layer only accepts that when the operator
|
||||
/// enabled it.
|
||||
pub in_response_to: Option<String>,
|
||||
/// The assertion's `ID` — used by the caller as the replay-guard key.
|
||||
pub assertion_id: String,
|
||||
/// The assertion's expiry (`Conditions/@NotOnOrAfter`) — the replay
|
||||
/// guard can drop the consumed ID after this instant.
|
||||
pub assertion_expiry: OffsetDateTime,
|
||||
/// `AuthnStatement/@SessionIndex`, if present (useful for future SLO).
|
||||
pub session_index: Option<String>,
|
||||
}
|
||||
|
||||
/// Verify and validate a decoded `SAMLResponse` XML document.
|
||||
pub fn consume(
|
||||
xml: &str,
|
||||
sp: &SpParams,
|
||||
idp: &IdpMetadata,
|
||||
now: OffsetDateTime,
|
||||
clock_skew: Duration,
|
||||
) -> Result<VerifiedResponse, SamlError> {
|
||||
// 1. Cryptographically verify the signature against the pinned IdP cert(s).
|
||||
// `trusted_keys_only` ignores any cert embedded in the document's
|
||||
// KeyInfo, so an attacker can't substitute their own key.
|
||||
let verified_uris = verify_signature(xml, &idp.signing_certs_der)?;
|
||||
|
||||
// 2. Parse for semantic validation.
|
||||
let doc = Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
|
||||
let root = doc.root_element();
|
||||
if root.tag_name().name() != "Response" {
|
||||
return Err(SamlError::MissingElement("Response".into()));
|
||||
}
|
||||
let response_id = root.attribute("ID").map(str::to_owned);
|
||||
let in_response_to = root.attribute("InResponseTo").map(str::to_owned);
|
||||
|
||||
// 3. Status must be Success.
|
||||
let status_value = root
|
||||
.descendants()
|
||||
.find(|n| n.is_element() && n.tag_name().name() == "StatusCode")
|
||||
.and_then(|sc| sc.attribute("Value"))
|
||||
.unwrap_or("");
|
||||
if status_value != STATUS_SUCCESS && !status_value.ends_with(":Success") {
|
||||
return Err(SamlError::Status(status_value.to_owned()));
|
||||
}
|
||||
|
||||
// 4. Destination (if the IdP set one) must be our ACS.
|
||||
if let Some(dest) = root.attribute("Destination") {
|
||||
if !urls_equal(dest, &sp.acs_url) {
|
||||
return Err(SamlError::DestinationMismatch);
|
||||
}
|
||||
}
|
||||
|
||||
// 5. Exactly one (unencrypted) Assertion.
|
||||
if root
|
||||
.descendants()
|
||||
.any(|n| n.is_element() && n.tag_name().name() == "EncryptedAssertion")
|
||||
{
|
||||
return Err(SamlError::EncryptedAssertionUnsupported);
|
||||
}
|
||||
let assertions: Vec<Node<'_, '_>> = root
|
||||
.children()
|
||||
.filter(|c| c.is_element() && c.tag_name().name() == "Assertion")
|
||||
.collect();
|
||||
if assertions.len() != 1 {
|
||||
return Err(SamlError::AssertionCount(assertions.len()));
|
||||
}
|
||||
let assertion = assertions[0];
|
||||
let assertion_id = assertion
|
||||
.attribute("ID")
|
||||
.map(str::to_owned)
|
||||
.ok_or_else(|| SamlError::MissingElement("Assertion/@ID".into()))?;
|
||||
|
||||
// 6. The signature must actually cover the assertion we're about to trust:
|
||||
// either the assertion itself, the enclosing response, or the whole
|
||||
// document. (bergshamra's strict_verification already constrains where
|
||||
// the signed element may sit; this ties it to *our* assertion.)
|
||||
let covers_assertion = verified_uris.iter().any(|u| {
|
||||
u.is_empty()
|
||||
|| u == &format!("#{assertion_id}")
|
||||
|| response_id
|
||||
.as_ref()
|
||||
.is_some_and(|rid| u == &format!("#{rid}"))
|
||||
});
|
||||
if !covers_assertion {
|
||||
return Err(SamlError::SignatureScope);
|
||||
}
|
||||
|
||||
// 7. Issuer must be the configured IdP.
|
||||
let issuer = first_child(assertion, "Issuer")
|
||||
.map(text_of)
|
||||
.unwrap_or_default();
|
||||
if !idp.entity_id.is_empty() && issuer != idp.entity_id {
|
||||
return Err(SamlError::IssuerMismatch);
|
||||
}
|
||||
|
||||
// 8. Subject → NameID + SubjectConfirmationData time/recipient checks.
|
||||
let subject = first_child(assertion, "Subject")
|
||||
.ok_or_else(|| SamlError::MissingElement("Subject".into()))?;
|
||||
let name_id = first_child(subject, "NameID")
|
||||
.map(text_of)
|
||||
.filter(|s| !s.is_empty())
|
||||
.ok_or_else(|| SamlError::MissingElement("NameID".into()))?;
|
||||
if let Some(scd) = subject
|
||||
.descendants()
|
||||
.find(|n| n.is_element() && n.tag_name().name() == "SubjectConfirmationData")
|
||||
{
|
||||
if let Some(recipient) = scd.attribute("Recipient") {
|
||||
if !urls_equal(recipient, &sp.acs_url) {
|
||||
return Err(SamlError::DestinationMismatch);
|
||||
}
|
||||
}
|
||||
if let Some(noa) = scd.attribute("NotOnOrAfter") {
|
||||
let noa = parse_instant(noa)?;
|
||||
if now >= noa + clock_skew {
|
||||
return Err(SamlError::TimeBounds);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// 9. Conditions: time window + audience.
|
||||
let conditions = first_child(assertion, "Conditions");
|
||||
if let Some(cond) = conditions {
|
||||
if let Some(nb) = cond.attribute("NotBefore") {
|
||||
let nb = parse_instant(nb)?;
|
||||
if now < nb - clock_skew {
|
||||
return Err(SamlError::TimeBounds);
|
||||
}
|
||||
}
|
||||
}
|
||||
let assertion_expiry = conditions
|
||||
.and_then(|c| c.attribute("NotOnOrAfter"))
|
||||
.map(parse_instant)
|
||||
.transpose()?
|
||||
.ok_or_else(|| SamlError::MissingElement("Conditions/@NotOnOrAfter".into()))?;
|
||||
if now >= assertion_expiry + clock_skew {
|
||||
return Err(SamlError::TimeBounds);
|
||||
}
|
||||
|
||||
let audience_ok = conditions.is_some_and(|c| {
|
||||
c.descendants()
|
||||
.filter(|n| n.is_element() && n.tag_name().name() == "Audience")
|
||||
.any(|a| text_of(a) == sp.entity_id)
|
||||
});
|
||||
if !audience_ok {
|
||||
return Err(SamlError::AudienceMismatch);
|
||||
}
|
||||
|
||||
// 10. Optional: SessionIndex + display-name attribute.
|
||||
let session_index = assertion
|
||||
.descendants()
|
||||
.find(|n| n.is_element() && n.tag_name().name() == "AuthnStatement")
|
||||
.and_then(|a| a.attribute("SessionIndex"))
|
||||
.map(str::to_owned);
|
||||
|
||||
let display_name = extract_display_name(assertion);
|
||||
|
||||
Ok(VerifiedResponse {
|
||||
principal: VerifiedPrincipal {
|
||||
email: name_id.clone(),
|
||||
name_id,
|
||||
display_name,
|
||||
},
|
||||
in_response_to,
|
||||
assertion_id,
|
||||
assertion_expiry,
|
||||
session_index,
|
||||
})
|
||||
}
|
||||
|
||||
/// Verify the document's XML-DSig against each pinned IdP cert in turn
|
||||
/// (handles key rotation), returning the verified `<Reference>` URIs.
|
||||
fn verify_signature(xml: &str, certs_der: &[Vec<u8>]) -> Result<Vec<String>, SamlError> {
|
||||
let mut last_err = String::from("no signing certificate matched");
|
||||
for der in certs_der {
|
||||
let key = match bergshamra::keys::loader::load_x509_cert_der(der) {
|
||||
Ok(k) => k,
|
||||
Err(e) => {
|
||||
last_err = e.to_string();
|
||||
continue;
|
||||
}
|
||||
};
|
||||
let mut km = bergshamra::keys::KeysManager::new();
|
||||
km.add_key(key);
|
||||
// trusted_keys_only: only ever trust the pinned IdP key, never an
|
||||
// inline KeyInfo cert. strict_verification: XSW positional defense.
|
||||
let ctx = bergshamra::DsigContext::new(km)
|
||||
.with_trusted_keys_only(true)
|
||||
.with_strict_verification(true);
|
||||
match bergshamra::verify(&ctx, xml) {
|
||||
Ok(bergshamra::VerifyResult::Valid { references, .. }) => {
|
||||
return Ok(references.into_iter().map(|r| r.uri).collect());
|
||||
}
|
||||
Ok(bergshamra::VerifyResult::Invalid { reason }) => last_err = reason,
|
||||
Err(e) => last_err = e.to_string(),
|
||||
}
|
||||
}
|
||||
Err(SamlError::Signature(last_err))
|
||||
}
|
||||
|
||||
/// Pull a display name from the assertion's attribute statement, trying the
|
||||
/// common attribute names IdPs use (FleetDM checks the same set).
|
||||
fn extract_display_name(assertion: Node<'_, '_>) -> Option<String> {
|
||||
const WANTED: &[&str] = &[
|
||||
"name",
|
||||
"displayname",
|
||||
"cn",
|
||||
"urn:oid:2.5.4.3",
|
||||
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
|
||||
];
|
||||
for attr in assertion
|
||||
.descendants()
|
||||
.filter(|n| n.is_element() && n.tag_name().name() == "Attribute")
|
||||
{
|
||||
let key = attr
|
||||
.attribute("Name")
|
||||
.or_else(|| attr.attribute("FriendlyName"))
|
||||
.unwrap_or("")
|
||||
.to_ascii_lowercase();
|
||||
if WANTED.contains(&key.as_str()) {
|
||||
if let Some(val) = attr
|
||||
.descendants()
|
||||
.find(|n| n.is_element() && n.tag_name().name() == "AttributeValue")
|
||||
{
|
||||
let v = text_of(val);
|
||||
if !v.is_empty() {
|
||||
return Some(v);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
fn first_child<'a, 'i>(n: Node<'a, 'i>, local: &str) -> Option<Node<'a, 'i>> {
|
||||
n.children()
|
||||
.find(|c| c.is_element() && c.tag_name().name() == local)
|
||||
}
|
||||
|
||||
fn text_of(n: Node<'_, '_>) -> String {
|
||||
n.children()
|
||||
.filter(Node::is_text)
|
||||
.filter_map(|c| c.text())
|
||||
.collect::<String>()
|
||||
.trim()
|
||||
.to_owned()
|
||||
}
|
||||
|
||||
/// Parse an `xs:dateTime` (e.g. `2026-05-31T12:00:00.000Z`).
|
||||
fn parse_instant(s: &str) -> Result<OffsetDateTime, SamlError> {
|
||||
OffsetDateTime::parse(s.trim(), &Rfc3339).map_err(|e| SamlError::Timestamp(format!("{s}: {e}")))
|
||||
}
|
||||
|
||||
/// Compare two URLs for SAML endpoint-matching purposes: exact, or differing
|
||||
/// only by a single trailing slash.
|
||||
fn urls_equal(a: &str, b: &str) -> bool {
|
||||
a == b || a.trim_end_matches('/') == b.trim_end_matches('/')
|
||||
}
|
||||
@@ -1,287 +0,0 @@
|
||||
//! End-to-end SAML SP tests.
|
||||
//!
|
||||
//! We mint a throwaway self-signed cert/key with `rcgen`, sign a SAML Response
|
||||
//! template with `bergshamra::sign` (the same engine that verifies it), and
|
||||
//! drive [`response::consume`] through the accept path and every reject path.
|
||||
//! This proves both the signature wiring and the SP-semantic checks.
|
||||
|
||||
use time::format_description::well_known::Rfc3339;
|
||||
use time::{Duration, OffsetDateTime};
|
||||
|
||||
use super::metadata::IdpMetadata;
|
||||
use super::{response, SamlError, SpParams};
|
||||
|
||||
const SP_ENTITY: &str = "https://pxe.example.com";
|
||||
const ACS: &str = "https://pxe.example.com/api/sso/acs";
|
||||
const IDP_ENTITY: &str = "https://idp.example.com/realms/fleet";
|
||||
const EMAIL: &str = "[email protected]";
|
||||
|
||||
struct TestIdp {
|
||||
cert_der: Vec<u8>,
|
||||
key_pem: String,
|
||||
}
|
||||
|
||||
fn test_idp() -> TestIdp {
|
||||
let ck = rcgen::generate_simple_self_signed(vec!["idp.example.com".to_string()]).unwrap();
|
||||
TestIdp {
|
||||
cert_der: ck.cert.der().as_ref().to_vec(),
|
||||
key_pem: ck.key_pair.serialize_pem(),
|
||||
}
|
||||
}
|
||||
|
||||
fn fmt(t: OffsetDateTime) -> String {
|
||||
t.replace_nanosecond(0).unwrap().format(&Rfc3339).unwrap()
|
||||
}
|
||||
|
||||
/// Knobs for building a response template — defaults are a valid response.
|
||||
struct Resp {
|
||||
issuer: String,
|
||||
audience: String,
|
||||
status: String,
|
||||
not_before: OffsetDateTime,
|
||||
not_on_or_after: OffsetDateTime,
|
||||
in_response_to: Option<String>,
|
||||
recipient: String,
|
||||
}
|
||||
|
||||
impl Default for Resp {
|
||||
fn default() -> Self {
|
||||
let now = OffsetDateTime::now_utc();
|
||||
Self {
|
||||
issuer: IDP_ENTITY.into(),
|
||||
audience: SP_ENTITY.into(),
|
||||
status: "urn:oasis:names:tc:SAML:2.0:status:Success".into(),
|
||||
not_before: now - Duration::minutes(5),
|
||||
not_on_or_after: now + Duration::hours(1),
|
||||
in_response_to: Some("_req-abc".into()),
|
||||
recipient: ACS.into(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Resp {
|
||||
/// The unsigned template (a `<ds:Signature>` with empty values).
|
||||
fn template(&self) -> String {
|
||||
let now = fmt(OffsetDateTime::now_utc());
|
||||
let irt = self
|
||||
.in_response_to
|
||||
.as_ref()
|
||||
.map(|v| format!(r#" InResponseTo="{v}""#))
|
||||
.unwrap_or_default();
|
||||
format!(
|
||||
r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{ACS}"{irt}>
|
||||
<saml:Issuer>{issuer}</saml:Issuer>
|
||||
<samlp:Status><samlp:StatusCode Value="{status}"/></samlp:Status>
|
||||
<saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
|
||||
<saml:Issuer>{issuer}</saml:Issuer>
|
||||
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
|
||||
<ds:SignedInfo>
|
||||
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
|
||||
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
|
||||
<ds:Reference URI="#_assertion1">
|
||||
<ds:Transforms>
|
||||
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
|
||||
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
|
||||
</ds:Transforms>
|
||||
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
|
||||
<ds:DigestValue></ds:DigestValue>
|
||||
</ds:Reference>
|
||||
</ds:SignedInfo>
|
||||
<ds:SignatureValue></ds:SignatureValue>
|
||||
</ds:Signature>
|
||||
<saml:Subject>
|
||||
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{EMAIL}</saml:NameID>
|
||||
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
|
||||
<saml:SubjectConfirmationData Recipient="{recipient}" NotOnOrAfter="{noa}"{irt}/>
|
||||
</saml:SubjectConfirmation>
|
||||
</saml:Subject>
|
||||
<saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
|
||||
<saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction>
|
||||
</saml:Conditions>
|
||||
<saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-123">
|
||||
<saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
|
||||
</saml:AuthnStatement>
|
||||
<saml:AttributeStatement>
|
||||
<saml:Attribute Name="displayName"><saml:AttributeValue>Miles Ward</saml:AttributeValue></saml:Attribute>
|
||||
</saml:AttributeStatement>
|
||||
</saml:Assertion>
|
||||
</samlp:Response>"##,
|
||||
issuer = self.issuer,
|
||||
status = self.status,
|
||||
audience = self.audience,
|
||||
recipient = self.recipient,
|
||||
nb = fmt(self.not_before),
|
||||
noa = fmt(self.not_on_or_after),
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
fn sign(template: &str, key_pem: &str) -> String {
|
||||
let key = bergshamra::keys::loader::load_pem_auto(key_pem.as_bytes(), None)
|
||||
.expect("load test signing key");
|
||||
let mut km = bergshamra::keys::KeysManager::new();
|
||||
km.add_key(key);
|
||||
let ctx = bergshamra::DsigContext::new(km);
|
||||
bergshamra::sign(&ctx, template).expect("sign test response")
|
||||
}
|
||||
|
||||
fn sp() -> SpParams {
|
||||
SpParams {
|
||||
entity_id: SP_ENTITY.into(),
|
||||
acs_url: ACS.into(),
|
||||
}
|
||||
}
|
||||
|
||||
fn idp(cert_der: Vec<u8>) -> IdpMetadata {
|
||||
IdpMetadata {
|
||||
entity_id: IDP_ENTITY.into(),
|
||||
sso_redirect_url: None,
|
||||
sso_post_url: None,
|
||||
signing_certs_der: vec![cert_der],
|
||||
}
|
||||
}
|
||||
|
||||
fn consume(xml: &str, cert_der: Vec<u8>) -> Result<response::VerifiedResponse, SamlError> {
|
||||
response::consume(
|
||||
xml,
|
||||
&sp(),
|
||||
&idp(cert_der),
|
||||
OffsetDateTime::now_utc(),
|
||||
Duration::seconds(60),
|
||||
)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn good_response_yields_principal() {
|
||||
let t = test_idp();
|
||||
let signed = sign(&Resp::default().template(), &t.key_pem);
|
||||
let out = consume(&signed, t.cert_der).expect("valid response should verify");
|
||||
assert_eq!(out.principal.email, EMAIL);
|
||||
assert_eq!(out.principal.name_id, EMAIL);
|
||||
assert_eq!(out.principal.display_name.as_deref(), Some("Miles Ward"));
|
||||
assert_eq!(out.in_response_to.as_deref(), Some("_req-abc"));
|
||||
assert_eq!(out.assertion_id, "_assertion1");
|
||||
assert_eq!(out.session_index.as_deref(), Some("sess-123"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn tampered_assertion_is_rejected() {
|
||||
let t = test_idp();
|
||||
let signed = sign(&Resp::default().template(), &t.key_pem);
|
||||
// Flip the subject email after signing — breaks the digest.
|
||||
let tampered = signed.replace(EMAIL, "[email protected]");
|
||||
assert_ne!(signed, tampered);
|
||||
assert!(matches!(
|
||||
consume(&tampered, t.cert_der),
|
||||
Err(SamlError::Signature(_) | SamlError::SignatureScope)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unsigned_response_is_rejected() {
|
||||
let t = test_idp();
|
||||
// Feed the *unsigned* template (empty SignatureValue) straight in.
|
||||
let unsigned = Resp::default().template();
|
||||
assert!(matches!(
|
||||
consume(&unsigned, t.cert_der),
|
||||
Err(SamlError::Signature(_))
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn wrong_signing_key_is_rejected() {
|
||||
let signer = test_idp();
|
||||
let other = test_idp(); // different keypair pinned as the "IdP" cert
|
||||
let signed = sign(&Resp::default().template(), &signer.key_pem);
|
||||
assert!(matches!(
|
||||
consume(&signed, other.cert_der),
|
||||
Err(SamlError::Signature(_))
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn wrong_audience_is_rejected() {
|
||||
let t = test_idp();
|
||||
let r = Resp {
|
||||
audience: "https://someone-else.example".into(),
|
||||
..Resp::default()
|
||||
};
|
||||
let signed = sign(&r.template(), &t.key_pem);
|
||||
assert!(matches!(
|
||||
consume(&signed, t.cert_der),
|
||||
Err(SamlError::AudienceMismatch)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn expired_assertion_is_rejected() {
|
||||
let t = test_idp();
|
||||
let now = OffsetDateTime::now_utc();
|
||||
let r = Resp {
|
||||
not_before: now - Duration::hours(2),
|
||||
not_on_or_after: now - Duration::hours(1),
|
||||
..Resp::default()
|
||||
};
|
||||
let signed = sign(&r.template(), &t.key_pem);
|
||||
assert!(matches!(
|
||||
consume(&signed, t.cert_der),
|
||||
Err(SamlError::TimeBounds)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn future_assertion_is_rejected() {
|
||||
let t = test_idp();
|
||||
let now = OffsetDateTime::now_utc();
|
||||
let r = Resp {
|
||||
not_before: now + Duration::hours(1),
|
||||
not_on_or_after: now + Duration::hours(2),
|
||||
..Resp::default()
|
||||
};
|
||||
let signed = sign(&r.template(), &t.key_pem);
|
||||
assert!(matches!(
|
||||
consume(&signed, t.cert_der),
|
||||
Err(SamlError::TimeBounds)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn wrong_issuer_is_rejected() {
|
||||
let t = test_idp();
|
||||
let r = Resp {
|
||||
issuer: "https://evil-idp.example".into(),
|
||||
..Resp::default()
|
||||
};
|
||||
let signed = sign(&r.template(), &t.key_pem);
|
||||
assert!(matches!(
|
||||
consume(&signed, t.cert_der),
|
||||
Err(SamlError::IssuerMismatch)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn non_success_status_is_rejected() {
|
||||
let t = test_idp();
|
||||
let r = Resp {
|
||||
status: "urn:oasis:names:tc:SAML:2.0:status:Requester".into(),
|
||||
..Resp::default()
|
||||
};
|
||||
let signed = sign(&r.template(), &t.key_pem);
|
||||
assert!(matches!(
|
||||
consume(&signed, t.cert_der),
|
||||
Err(SamlError::Status(_))
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn idp_initiated_has_no_in_response_to() {
|
||||
// No InResponseTo => the HTTP layer must gate it behind allow_idp_initiated.
|
||||
let t = test_idp();
|
||||
let r = Resp {
|
||||
in_response_to: None,
|
||||
..Resp::default()
|
||||
};
|
||||
let signed = sign(&r.template(), &t.key_pem);
|
||||
let out = consume(&signed, t.cert_der).expect("unsolicited but otherwise valid");
|
||||
assert!(out.in_response_to.is_none());
|
||||
}
|
||||
@@ -1,390 +0,0 @@
|
||||
//! SAML SSO configuration — FleetDM-shaped.
|
||||
//!
|
||||
//! The operator pastes their IdP's metadata XML (or its URL) and a
|
||||
//! human-readable label. As of v0.5.1 the SAML login flow is wired
|
||||
//! end-to-end (see [`crate::saml`]): SP-initiated AuthnRequest, the ACS
|
||||
//! endpoint, pure-Rust signature verification, and operator-session
|
||||
//! minting. This module owns only the persisted *configuration*.
|
||||
//!
|
||||
//! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
|
||||
//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: any
|
||||
//! IdP-authenticated user the SP cryptographically verifies gets an
|
||||
//! operator session; there is no per-user role table). Entity ID is
|
||||
//! exposed (FleetDM-style) but defaults to the advertised public base
|
||||
//! URL when blank, which is what most IdPs expect anyway.
|
||||
|
||||
use parking_lot::RwLock;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::path::PathBuf;
|
||||
use std::sync::Arc;
|
||||
|
||||
use crate::{Error, Result};
|
||||
|
||||
/// The configurable surface. `metadata` and `metadata_url` are mutually
|
||||
/// exclusive at apply time (one or the other identifies the IdP); the
|
||||
/// store keeps both fields so an operator can switch between them
|
||||
/// without losing the inactive one.
|
||||
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
|
||||
pub struct SsoConfig {
|
||||
/// Master switch — when false, all SSO machinery (planned for a
|
||||
/// later release) is skipped regardless of the rest of the fields.
|
||||
#[serde(default)]
|
||||
pub enabled: bool,
|
||||
/// Display name shown on the WebUI's login screen as the "Sign in
|
||||
/// with X" button label. Empty/whitespace falls back to "SSO".
|
||||
#[serde(default)]
|
||||
pub idp_name: String,
|
||||
/// Optional HTTPS URL pointing at the IdP's brand logo. Rendered
|
||||
/// next to `idp_name` on the WebUI's login screen (FleetDM-style).
|
||||
/// Length-capped at [`MAX_URL_LEN`]; empty is fine.
|
||||
#[serde(default)]
|
||||
pub idp_logo_url: String,
|
||||
/// Raw SAML metadata XML pasted by the operator. Mutually exclusive
|
||||
/// with `metadata_url`; if both are set, the URL wins at apply time
|
||||
/// (operators typically forget about a stale XML paste).
|
||||
#[serde(default)]
|
||||
pub metadata: String,
|
||||
/// HTTPS URL where the IdP serves its metadata. Loaded lazily by the
|
||||
/// future SAML flow; not validated here beyond a basic length cap.
|
||||
#[serde(default)]
|
||||
pub metadata_url: String,
|
||||
/// SP Entity ID advertised to the IdP — mirrors FleetDM's "Entity ID".
|
||||
/// Must exactly match the SP/Relying-Party entry configured on the IdP.
|
||||
/// Empty falls back to the advertised public base URL at runtime, which
|
||||
/// is what most IdPs expect. Length-capped at [`MAX_URL_LEN`].
|
||||
#[serde(default)]
|
||||
pub entity_id: String,
|
||||
/// Allow IdP-initiated login — an unsolicited `<Response>` POSTed to the
|
||||
/// ACS with no `InResponseTo`. Mirrors FleetDM's "Allow SSO login
|
||||
/// initiated by identity provider". Default off; SP-initiated (the
|
||||
/// "Sign in with X" button) is always allowed regardless.
|
||||
#[serde(default)]
|
||||
pub allow_idp_initiated: bool,
|
||||
}
|
||||
|
||||
impl SsoConfig {
|
||||
/// Returns `true` only when the config is *usable* — enabled, and
|
||||
/// at least one of metadata/metadata_url is present. The future
|
||||
/// login flow will key off this; for v0.4.5 the WebUI uses it to
|
||||
/// surface a yellow "configured but not live yet" hint.
|
||||
#[must_use]
|
||||
pub fn is_usable(&self) -> bool {
|
||||
self.enabled && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
|
||||
}
|
||||
}
|
||||
|
||||
/// In-memory + on-disk SSO settings registry.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct SsoStore {
|
||||
path: Arc<PathBuf>,
|
||||
inner: Arc<RwLock<SsoConfig>>,
|
||||
}
|
||||
|
||||
impl SsoStore {
|
||||
/// Load from `<work_dir>/sso.json`, or start with the default empty
|
||||
/// (`enabled = false`) config. A corrupt file falls back to default
|
||||
/// rather than blocking startup.
|
||||
#[must_use]
|
||||
pub fn load_or_default(work_dir: &std::path::Path) -> Self {
|
||||
let path = work_dir.join("sso.json");
|
||||
let cfg = match std::fs::read_to_string(&path) {
|
||||
Ok(text) => match serde_json::from_str::<SsoConfig>(&text) {
|
||||
Ok(parsed) => parsed,
|
||||
Err(e) => {
|
||||
tracing::warn!(
|
||||
target: "openpxe::sso",
|
||||
"sso.json present but unreadable ({e}); starting with default config"
|
||||
);
|
||||
SsoConfig::default()
|
||||
}
|
||||
},
|
||||
Err(_) => SsoConfig::default(),
|
||||
};
|
||||
Self {
|
||||
path: Arc::new(path),
|
||||
inner: Arc::new(RwLock::new(cfg)),
|
||||
}
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
pub fn snapshot(&self) -> SsoConfig {
|
||||
self.inner.read().clone()
|
||||
}
|
||||
|
||||
/// Replace the whole config in one shot. Light validation: metadata
|
||||
/// XML and URL are length-capped so an operator can't OOM us by
|
||||
/// pasting a 10 GiB blob; the IdP UI tab clamps the input visually,
|
||||
/// but the server enforces a hard ceiling regardless.
|
||||
pub fn replace(&self, mut cfg: SsoConfig) -> Result<SsoConfig> {
|
||||
cfg.idp_name = cfg.idp_name.trim().to_string();
|
||||
cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
|
||||
cfg.metadata = cfg.metadata.trim().to_string();
|
||||
cfg.metadata_url = cfg.metadata_url.trim().to_string();
|
||||
cfg.entity_id = cfg.entity_id.trim().to_string();
|
||||
if cfg.entity_id.len() > MAX_URL_LEN {
|
||||
return Err(Error::Invalid(format!(
|
||||
"entity_id exceeds {MAX_URL_LEN}-char cap"
|
||||
)));
|
||||
}
|
||||
if cfg.metadata.len() > MAX_METADATA_BYTES {
|
||||
return Err(Error::Invalid(format!(
|
||||
"metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
|
||||
)));
|
||||
}
|
||||
if cfg.metadata_url.len() > MAX_URL_LEN {
|
||||
return Err(Error::Invalid(format!(
|
||||
"metadata_url exceeds {MAX_URL_LEN}-char cap"
|
||||
)));
|
||||
}
|
||||
if cfg.idp_logo_url.len() > MAX_URL_LEN {
|
||||
return Err(Error::Invalid(format!(
|
||||
"idp_logo_url exceeds {MAX_URL_LEN}-char cap"
|
||||
)));
|
||||
}
|
||||
if !cfg.metadata_url.is_empty()
|
||||
&& !cfg.metadata_url.starts_with("http://")
|
||||
&& !cfg.metadata_url.starts_with("https://")
|
||||
{
|
||||
return Err(Error::Invalid(
|
||||
"metadata_url must start with http:// or https://".into(),
|
||||
));
|
||||
}
|
||||
if !cfg.idp_logo_url.is_empty()
|
||||
&& !cfg.idp_logo_url.starts_with("http://")
|
||||
&& !cfg.idp_logo_url.starts_with("https://")
|
||||
{
|
||||
return Err(Error::Invalid(
|
||||
"idp_logo_url must start with http:// or https://".into(),
|
||||
));
|
||||
}
|
||||
// If they're trying to *enable* the integration but haven't
|
||||
// supplied either source, reject — saves a "configured but
|
||||
// unusable" surprise later.
|
||||
if cfg.enabled && cfg.metadata.is_empty() && cfg.metadata_url.is_empty() {
|
||||
return Err(Error::Invalid(
|
||||
"enable SSO requires either metadata XML or a metadata URL".into(),
|
||||
));
|
||||
}
|
||||
{
|
||||
let mut g = self.inner.write();
|
||||
*g = cfg.clone();
|
||||
}
|
||||
self.persist();
|
||||
tracing::info!(
|
||||
target: "openpxe::sso",
|
||||
enabled = cfg.enabled,
|
||||
idp = %cfg.idp_name,
|
||||
has_xml = !cfg.metadata.is_empty(),
|
||||
has_url = !cfg.metadata_url.is_empty(),
|
||||
"sso configuration updated"
|
||||
);
|
||||
Ok(cfg)
|
||||
}
|
||||
|
||||
fn persist(&self) {
|
||||
let snap = self.inner.read().clone();
|
||||
let body = match serde_json::to_vec_pretty(&snap) {
|
||||
Ok(b) => b,
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::sso", "serialize sso.json: {e}");
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Some(parent) = self.path.parent() {
|
||||
let _ = std::fs::create_dir_all(parent);
|
||||
}
|
||||
let tmp = self.path.with_extension("json.tmp");
|
||||
if let Err(e) = std::fs::write(&tmp, body) {
|
||||
tracing::warn!(target: "openpxe::sso", "write sso.json tmp: {e}");
|
||||
return;
|
||||
}
|
||||
if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
|
||||
tracing::warn!(target: "openpxe::sso", "rename sso.json: {e}");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Saturation caps. The numbers are generous for any real IdP metadata
|
||||
/// document — Okta's largest is ~50 KB, Azure AD's ~30 KB.
|
||||
const MAX_METADATA_BYTES: usize = 1024 * 1024;
|
||||
const MAX_URL_LEN: usize = 2048;
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tempfile::tempdir;
|
||||
|
||||
#[test]
|
||||
fn default_is_disabled_and_empty() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
let cfg = s.snapshot();
|
||||
assert!(!cfg.enabled);
|
||||
assert!(cfg.metadata.is_empty());
|
||||
assert!(cfg.metadata_url.is_empty());
|
||||
assert!(!cfg.is_usable());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn replace_metadata_url_round_trip_via_disk() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
s.replace(SsoConfig {
|
||||
enabled: true,
|
||||
idp_name: "Okta".into(),
|
||||
metadata: String::new(),
|
||||
metadata_url: "https://idp.example.com/metadata".into(),
|
||||
idp_logo_url: String::new(),
|
||||
entity_id: String::new(),
|
||||
allow_idp_initiated: false,
|
||||
})
|
||||
.unwrap();
|
||||
drop(s);
|
||||
let s2 = SsoStore::load_or_default(dir.path());
|
||||
let cfg = s2.snapshot();
|
||||
assert!(cfg.enabled);
|
||||
assert!(cfg.is_usable());
|
||||
assert_eq!(cfg.idp_name, "Okta");
|
||||
assert_eq!(cfg.metadata_url, "https://idp.example.com/metadata");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn replace_xml_paste_is_accepted() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">test</EntityDescriptor>"#;
|
||||
s.replace(SsoConfig {
|
||||
enabled: true,
|
||||
idp_name: "Test IdP".into(),
|
||||
metadata: xml.into(),
|
||||
metadata_url: String::new(),
|
||||
idp_logo_url: String::new(),
|
||||
entity_id: String::new(),
|
||||
allow_idp_initiated: false,
|
||||
})
|
||||
.unwrap();
|
||||
assert!(s.snapshot().is_usable());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn enable_without_source_is_rejected() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
let r = s.replace(SsoConfig {
|
||||
enabled: true,
|
||||
idp_name: "Okta".into(),
|
||||
metadata: String::new(),
|
||||
metadata_url: String::new(),
|
||||
idp_logo_url: String::new(),
|
||||
entity_id: String::new(),
|
||||
allow_idp_initiated: false,
|
||||
});
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
// …and a disabled blank config is fine.
|
||||
s.replace(SsoConfig::default()).unwrap();
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn metadata_url_must_be_http_scheme() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
let r = s.replace(SsoConfig {
|
||||
enabled: false,
|
||||
idp_name: String::new(),
|
||||
metadata: String::new(),
|
||||
metadata_url: "ftp://idp.example.com/metadata".into(),
|
||||
idp_logo_url: String::new(),
|
||||
entity_id: String::new(),
|
||||
allow_idp_initiated: false,
|
||||
});
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn idp_logo_url_must_be_http_scheme() {
|
||||
// v0.4.6: SSO settings learned an idp_logo_url so the login
|
||||
// screen can render the FleetDM-style "Sign in with <IdP-logo>"
|
||||
// affordance. Same scheme rule as metadata_url.
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
let r = s.replace(SsoConfig {
|
||||
enabled: false,
|
||||
idp_name: "Okta".into(),
|
||||
metadata: String::new(),
|
||||
metadata_url: String::new(),
|
||||
idp_logo_url: "data:image/png;base64,...".into(),
|
||||
entity_id: String::new(),
|
||||
allow_idp_initiated: false,
|
||||
});
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
// Real HTTPS URL is fine.
|
||||
s.replace(SsoConfig {
|
||||
enabled: false,
|
||||
idp_name: "Okta".into(),
|
||||
metadata: String::new(),
|
||||
metadata_url: String::new(),
|
||||
idp_logo_url: "https://idp.example.com/logo.png".into(),
|
||||
entity_id: String::new(),
|
||||
allow_idp_initiated: false,
|
||||
})
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
s.snapshot().idp_logo_url,
|
||||
"https://idp.example.com/logo.png"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn entity_id_and_idp_initiated_round_trip() {
|
||||
// v0.5.1: SP Entity ID + IdP-initiated toggle persist across reload.
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
s.replace(SsoConfig {
|
||||
enabled: true,
|
||||
idp_name: "Keycloak".into(),
|
||||
metadata: String::new(),
|
||||
metadata_url: "https://idp.example.com/metadata".into(),
|
||||
idp_logo_url: String::new(),
|
||||
entity_id: "https://pxe.example.com".into(),
|
||||
allow_idp_initiated: true,
|
||||
})
|
||||
.unwrap();
|
||||
drop(s);
|
||||
let cfg = SsoStore::load_or_default(dir.path()).snapshot();
|
||||
assert_eq!(cfg.entity_id, "https://pxe.example.com");
|
||||
assert!(cfg.allow_idp_initiated);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn entity_id_cap_enforced() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
let r = s.replace(SsoConfig {
|
||||
enabled: false,
|
||||
idp_name: String::new(),
|
||||
metadata: String::new(),
|
||||
metadata_url: String::new(),
|
||||
idp_logo_url: String::new(),
|
||||
entity_id: "x".repeat(MAX_URL_LEN + 1),
|
||||
allow_idp_initiated: false,
|
||||
});
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn metadata_size_cap_enforced() {
|
||||
let dir = tempdir().unwrap();
|
||||
let s = SsoStore::load_or_default(dir.path());
|
||||
let oversize = "a".repeat(MAX_METADATA_BYTES + 1);
|
||||
let r = s.replace(SsoConfig {
|
||||
enabled: false,
|
||||
idp_name: String::new(),
|
||||
metadata: oversize,
|
||||
metadata_url: String::new(),
|
||||
idp_logo_url: String::new(),
|
||||
entity_id: String::new(),
|
||||
allow_idp_initiated: false,
|
||||
});
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
}
|
||||
}
|
||||
@@ -1,210 +0,0 @@
|
||||
//! Wake-on-LAN.
|
||||
//!
|
||||
//! v0.5.0: from the Hosts tab, an operator can wake a bound machine.
|
||||
//! WoL is a "magic packet" — six `0xFF` bytes followed by the target
|
||||
//! MAC repeated sixteen times (102 bytes total) — broadcast on the
|
||||
//! local segment. The NIC's WoL logic matches the repeated MAC and
|
||||
//! powers the board on.
|
||||
//!
|
||||
//! ## Why this is trivial and safe in our container
|
||||
//!
|
||||
//! - It's a single UDP datagram to a broadcast address. No privileged
|
||||
//! *local* port is needed (we bind an ephemeral source port); the
|
||||
//! destination port is conventionally 9 (discard) or 7 (echo), and
|
||||
//! nothing actually listens there — the magic is in the payload, not
|
||||
//! the port. So WoL works without any extra capability.
|
||||
//! - We send to the limited broadcast `255.255.255.255` (stays on the
|
||||
//! local link) and, when the caller knows the server's own subnet
|
||||
//! broadcast, to that too — directed broadcast reaches the right VLAN
|
||||
//! even when the host bridges multiple segments.
|
||||
//!
|
||||
//! ## Limits
|
||||
//!
|
||||
//! WoL only crosses L2. If the target is on a different subnet than the
|
||||
//! OpenPXE host, the intervening router must be configured to forward
|
||||
//! directed broadcasts (most aren't, by design). For the common case —
|
||||
//! OpenPXE and its PXE clients on the same VLAN — the limited broadcast
|
||||
//! is enough.
|
||||
|
||||
use crate::{Error, Result};
|
||||
use std::net::{Ipv4Addr, SocketAddrV4, UdpSocket};
|
||||
|
||||
/// Conventional WoL destination port. 9 (discard) is the de-facto
|
||||
/// default; the port is immaterial since the match is on the payload.
|
||||
const WOL_PORT: u16 = 9;
|
||||
|
||||
/// Parse a MAC string in any common form (`aa:bb:cc:dd:ee:ff`,
|
||||
/// `aa-bb-...`, `aabb.ccdd.eeff`, or bare hex) into six octets.
|
||||
///
|
||||
/// Returns `Error::Invalid` if it doesn't resolve to exactly six bytes.
|
||||
pub fn parse_mac(mac: &str) -> Result<[u8; 6]> {
|
||||
// Strip every non-hex-digit, then expect exactly 12 hex chars.
|
||||
let hex: String = mac.chars().filter(char::is_ascii_hexdigit).collect();
|
||||
if hex.len() != 12 {
|
||||
return Err(Error::Invalid(format!(
|
||||
"invalid MAC '{mac}': expected 6 octets (12 hex digits), got {}",
|
||||
hex.len()
|
||||
)));
|
||||
}
|
||||
let mut out = [0u8; 6];
|
||||
for (i, byte) in out.iter_mut().enumerate() {
|
||||
// Each octet is two hex chars; unwrap is safe — we validated
|
||||
// the length and that every char is a hex digit above.
|
||||
*byte = u8::from_str_radix(&hex[i * 2..i * 2 + 2], 16)
|
||||
.map_err(|e| Error::Invalid(format!("invalid MAC '{mac}': {e}")))?;
|
||||
}
|
||||
Ok(out)
|
||||
}
|
||||
|
||||
/// Build the 102-byte magic packet for `mac`.
|
||||
#[must_use]
|
||||
pub fn magic_packet(mac: [u8; 6]) -> [u8; 102] {
|
||||
let mut pkt = [0u8; 102];
|
||||
// 6 bytes of 0xFF.
|
||||
for b in &mut pkt[..6] {
|
||||
*b = 0xFF;
|
||||
}
|
||||
// MAC repeated 16 times.
|
||||
for rep in 0..16 {
|
||||
let start = 6 + rep * 6;
|
||||
pkt[start..start + 6].copy_from_slice(&mac);
|
||||
}
|
||||
pkt
|
||||
}
|
||||
|
||||
/// Send a Wake-on-LAN magic packet for `mac` to every address in
|
||||
/// `broadcasts` (e.g. `255.255.255.255` plus the server's subnet
|
||||
/// broadcast). Returns the number of broadcast addresses the packet was
|
||||
/// successfully sent to; errors only if the MAC is malformed or the
|
||||
/// socket can't be opened at all.
|
||||
pub fn wake(mac: &str, broadcasts: &[Ipv4Addr]) -> Result<usize> {
|
||||
let parsed = parse_mac(mac)?;
|
||||
let packet = magic_packet(parsed);
|
||||
|
||||
// Always include the limited broadcast even if the caller didn't —
|
||||
// it's the one that works with zero network configuration.
|
||||
let mut targets: Vec<Ipv4Addr> = vec![Ipv4Addr::BROADCAST];
|
||||
for b in broadcasts {
|
||||
if !targets.contains(b) {
|
||||
targets.push(*b);
|
||||
}
|
||||
}
|
||||
|
||||
let sent = send_magic(&packet, &targets, WOL_PORT)?;
|
||||
tracing::info!(
|
||||
target: "openpxe::wol",
|
||||
mac = %mac, broadcasts = sent,
|
||||
"Wake-on-LAN magic packet sent"
|
||||
);
|
||||
Ok(sent)
|
||||
}
|
||||
|
||||
/// Open a broadcast-enabled UDP socket and send `packet` to every
|
||||
/// `target:port`. Returns how many sends succeeded. Errors if the
|
||||
/// socket can't be opened or if *no* target accepted the packet.
|
||||
fn send_magic(packet: &[u8], targets: &[Ipv4Addr], port: u16) -> Result<usize> {
|
||||
// Bind an ephemeral local UDP port on all interfaces. SO_BROADCAST
|
||||
// must be enabled to send to a broadcast address.
|
||||
let sock = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::UNSPECIFIED, 0))
|
||||
.map_err(|e| Error::Invalid(format!("could not open WoL socket: {e}")))?;
|
||||
sock.set_broadcast(true)
|
||||
.map_err(|e| Error::Invalid(format!("could not enable broadcast: {e}")))?;
|
||||
|
||||
let mut sent = 0usize;
|
||||
for &addr in targets {
|
||||
match sock.send_to(packet, SocketAddrV4::new(addr, port)) {
|
||||
Ok(_) => sent += 1,
|
||||
Err(e) => {
|
||||
tracing::warn!(
|
||||
target: "openpxe::wol",
|
||||
broadcast = %addr,
|
||||
"WoL send failed: {e}"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
if sent == 0 {
|
||||
return Err(Error::Invalid(
|
||||
"Wake-on-LAN: no broadcast address accepted the packet".into(),
|
||||
));
|
||||
}
|
||||
Ok(sent)
|
||||
}
|
||||
|
||||
/// Compute the IPv4 broadcast address for `ip`/`mask`, if both parse.
|
||||
/// Used so the caller can include the server's own subnet broadcast
|
||||
/// alongside the limited broadcast.
|
||||
#[must_use]
|
||||
pub fn subnet_broadcast(ip: Ipv4Addr, mask: Ipv4Addr) -> Ipv4Addr {
|
||||
let ip = u32::from(ip);
|
||||
let mask = u32::from(mask);
|
||||
Ipv4Addr::from(ip | !mask)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn parse_mac_accepts_common_forms() {
|
||||
let want = [0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff];
|
||||
assert_eq!(parse_mac("aa:bb:cc:dd:ee:ff").unwrap(), want);
|
||||
assert_eq!(parse_mac("AA-BB-CC-DD-EE-FF").unwrap(), want);
|
||||
assert_eq!(parse_mac("aabb.ccdd.eeff").unwrap(), want);
|
||||
assert_eq!(parse_mac("aabbccddeeff").unwrap(), want);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_mac_rejects_bad_length() {
|
||||
assert!(parse_mac("aa:bb:cc").is_err());
|
||||
assert!(parse_mac("").is_err());
|
||||
assert!(parse_mac("zz:bb:cc:dd:ee:ff").is_err()); // non-hex stripped → too short
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn magic_packet_shape() {
|
||||
let pkt = magic_packet([0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
|
||||
assert_eq!(&pkt[..6], &[0xFF; 6]);
|
||||
// First MAC repetition.
|
||||
assert_eq!(&pkt[6..12], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
|
||||
// Last (16th) repetition ends the packet.
|
||||
assert_eq!(&pkt[96..102], &[0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn subnet_broadcast_computes() {
|
||||
assert_eq!(
|
||||
subnet_broadcast(
|
||||
Ipv4Addr::new(192, 168, 1, 49),
|
||||
Ipv4Addr::new(255, 255, 255, 0)
|
||||
),
|
||||
Ipv4Addr::new(192, 168, 1, 255)
|
||||
);
|
||||
assert_eq!(
|
||||
subnet_broadcast(
|
||||
Ipv4Addr::new(10, 5, 3, 7),
|
||||
Ipv4Addr::new(255, 255, 0, 0)
|
||||
),
|
||||
Ipv4Addr::new(10, 5, 255, 255)
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn send_magic_delivers_intact_packet_over_loopback() {
|
||||
// Deterministic round-trip that doesn't depend on the sandbox
|
||||
// permitting a real L2 broadcast: bind a receiver on loopback
|
||||
// and confirm send_magic transmits the exact 102-byte packet.
|
||||
let rx = UdpSocket::bind(SocketAddrV4::new(Ipv4Addr::LOCALHOST, 0)).unwrap();
|
||||
let port = rx.local_addr().unwrap().port();
|
||||
rx.set_read_timeout(Some(std::time::Duration::from_secs(2))).unwrap();
|
||||
|
||||
let packet = magic_packet([0x0a, 0x1b, 0x2c, 0x3d, 0x4e, 0x5f]);
|
||||
let sent = send_magic(&packet, &[Ipv4Addr::LOCALHOST], port).unwrap();
|
||||
assert_eq!(sent, 1);
|
||||
|
||||
let mut buf = [0u8; 128];
|
||||
let n = rx.recv(&mut buf).unwrap();
|
||||
assert_eq!(n, 102, "magic packet should be 102 bytes");
|
||||
assert_eq!(&buf[..102], &packet[..]);
|
||||
}
|
||||
}
|
||||
@@ -4,10 +4,6 @@ version.workspace = true
|
||||
edition.workspace = true
|
||||
license.workspace = true
|
||||
authors.workspace = true
|
||||
# v0.5.0: inherit the workspace repository so CARGO_PKG_REPOSITORY is
|
||||
# populated at build time — the About-tab update check derives the
|
||||
# Gitea releases API URL from it.
|
||||
repository.workspace = true
|
||||
description = "HTTP server: ISO uploads, iPXE script generation, ISO streaming"
|
||||
|
||||
[lints]
|
||||
@@ -35,17 +31,6 @@ bytes.workspace = true
|
||||
futures.workspace = true
|
||||
mime.workspace = true
|
||||
mime_guess.workspace = true
|
||||
uuid.workspace = true
|
||||
# v0.4.5 Forms auth: lock-free session store and cookie helpers.
|
||||
parking_lot.workspace = true
|
||||
# v0.5.0: outbound HTTP for chat webhooks (Slack/Teams/Discord) and the
|
||||
# About-tab "check for updates" call to the Gitea releases API; SMTP for
|
||||
# email notifications. Both use rustls so the static musl binary stays
|
||||
# OpenSSL-free.
|
||||
reqwest.workspace = true
|
||||
lettre.workspace = true
|
||||
# v0.5.1: decode the base64 SAMLResponse at the ACS endpoint.
|
||||
base64.workspace = true
|
||||
|
||||
[dev-dependencies]
|
||||
tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
|
||||
@@ -53,11 +38,3 @@ tower = { workspace = true }
|
||||
tempfile = "3.12"
|
||||
serde_json = { workspace = true }
|
||||
time = { workspace = true }
|
||||
# v0.4.61: integration tests need to generate real PNG bytes for the
|
||||
# `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
|
||||
image = { version = "0.25", default-features = false, features = ["png"] }
|
||||
# v0.5.1: the SAML ACS integration tests mint a throwaway IdP keypair
|
||||
# (rcgen) and sign a SAMLResponse with bergshamra so the happy-path,
|
||||
# replay, and IdP-initiated-gating flows exercise real signatures.
|
||||
rcgen = "0.13"
|
||||
bergshamra = { workspace = true }
|
||||
|
||||
+62
-1190
File diff suppressed because it is too large
Load Diff
@@ -1,516 +0,0 @@
|
||||
//! Forms auth layer — sessions, login, setup, middleware.
|
||||
//!
|
||||
//! Three states:
|
||||
//!
|
||||
//! * **Unconfigured** (`AdminStore::is_configured() == false`). The
|
||||
//! middleware passes every request through — there's no one to gate
|
||||
//! against. The UI's `/api/me` returns `setup_required: true` and the
|
||||
//! front-end pushes the operator into the first-run flow.
|
||||
//! * **Logged in**. The session cookie maps to an in-memory session
|
||||
//! record with an idle expiry; `/api/me` returns the username.
|
||||
//! * **Logged out**. The middleware bounces `/api/*` (with the PXE
|
||||
//! allowlist below) to `401 Unauthorized`; the front-end intercepts
|
||||
//! that and shows `/login`.
|
||||
//!
|
||||
//! Allowlist for unauthenticated access *after* the admin is set up:
|
||||
//!
|
||||
//! * everything outside `/api/*` (the WebUI bundle, asset chrome, PXE
|
||||
//! script endpoints, the bundled iPXE/wimboot binaries, ISO bytes,
|
||||
//! liveness/readiness probes, the Prometheus scrape) — these are
|
||||
//! read-only or PXE-essential and breaking them locks out booting
|
||||
//! machines that have no way to authenticate;
|
||||
//! * `/api/setup`, `/api/login`, `/api/me` (the auth surface itself);
|
||||
//! * `/api/queue/join`, `/api/queue/poll/:entry_id` (iPXE long-poll for
|
||||
//! Queued Deployment — the iPXE client can't send a session cookie).
|
||||
//!
|
||||
//! Everything else inside `/api/*` requires a valid session.
|
||||
|
||||
use crate::state::AppState;
|
||||
use axum::{
|
||||
body::Body,
|
||||
extract::{Request, State},
|
||||
http::{header, HeaderValue, StatusCode},
|
||||
middleware::Next,
|
||||
response::{IntoResponse, Response},
|
||||
Json,
|
||||
};
|
||||
use openpxe_core::AdminPublic;
|
||||
use parking_lot::RwLock;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use serde_json::json;
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
use std::time::{Duration, Instant};
|
||||
use uuid::Uuid;
|
||||
|
||||
/// Idle session lifetime. Sliding — every authenticated request resets
|
||||
/// the expiry. 24h is the Sonarr default and matches what most operators
|
||||
/// expect for an on-prem admin console.
|
||||
const SESSION_TTL: Duration = Duration::from_hours(24);
|
||||
|
||||
/// Name of the cookie we set/read. Distinct from a generic `session=`
|
||||
/// to avoid collisions with anything else sharing the host.
|
||||
pub const SESSION_COOKIE: &str = "openpxe_session";
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
struct Session {
|
||||
username: String,
|
||||
expires_at: Instant,
|
||||
}
|
||||
|
||||
/// In-memory session table. Cheap to clone (Arc-shared) and contention
|
||||
/// is rare — operators sign in once per browser session.
|
||||
#[derive(Debug, Clone, Default)]
|
||||
pub struct SessionStore {
|
||||
inner: Arc<RwLock<HashMap<String, Session>>>,
|
||||
}
|
||||
|
||||
impl SessionStore {
|
||||
/// Mint a fresh session for `username` and return the opaque cookie
|
||||
/// value. UUID v4 gives us 122 random bits — comfortably more than
|
||||
/// the 64-128 bits typical for session IDs.
|
||||
#[must_use]
|
||||
pub fn create(&self, username: &str) -> String {
|
||||
let id = Uuid::new_v4().simple().to_string();
|
||||
let session = Session {
|
||||
username: username.to_string(),
|
||||
expires_at: Instant::now() + SESSION_TTL,
|
||||
};
|
||||
self.inner.write().insert(id.clone(), session);
|
||||
id
|
||||
}
|
||||
|
||||
/// Resolve a cookie value to the owning username, refreshing the
|
||||
/// idle timer. Returns `None` for missing / expired sessions and
|
||||
/// proactively evicts the expired entry so the map doesn't grow
|
||||
/// unbounded across long-lived deployments.
|
||||
pub fn touch(&self, id: &str) -> Option<String> {
|
||||
let mut g = self.inner.write();
|
||||
let s = g.get_mut(id)?;
|
||||
if s.expires_at <= Instant::now() {
|
||||
g.remove(id);
|
||||
return None;
|
||||
}
|
||||
s.expires_at = Instant::now() + SESSION_TTL;
|
||||
Some(s.username.clone())
|
||||
}
|
||||
|
||||
/// Invalidate one session (the user's `/api/logout`).
|
||||
pub fn revoke(&self, id: &str) {
|
||||
self.inner.write().remove(id);
|
||||
}
|
||||
|
||||
/// Invalidate every session — used after a credentials rotation so
|
||||
/// stale cookies for the old password can't keep operating.
|
||||
pub fn revoke_all(&self) {
|
||||
self.inner.write().clear();
|
||||
}
|
||||
|
||||
/// Periodic / opportunistic GC. Not currently scheduled (we evict
|
||||
/// on touch), but exposed for a future janitor task.
|
||||
pub fn gc(&self) {
|
||||
let now = Instant::now();
|
||||
self.inner.write().retain(|_, s| s.expires_at > now);
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
pub fn len(&self) -> usize {
|
||||
self.inner.read().len()
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
pub fn is_empty(&self) -> bool {
|
||||
self.len() == 0
|
||||
}
|
||||
}
|
||||
|
||||
// ── Cookie helpers ────────────────────────────────────────────────────────
|
||||
|
||||
fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
|
||||
// Same flags FleetDM and Sonarr ship by default:
|
||||
// - HttpOnly: blocks JS access (XSS containment)
|
||||
// - SameSite=Lax: allows top-level GET navigations from the IdP
|
||||
// to land authenticated when SSO arrives, but blocks
|
||||
// cross-site POST CSRF;
|
||||
// - Path=/: the cookie applies to the whole app;
|
||||
// - no Secure flag yet — many operators host on plain http://
|
||||
// LAN IPs (Unraid templates default to that); we'll add Secure
|
||||
// opportunistically when we add a TLS terminator option.
|
||||
// SESSION_TTL fits in 32 bits comfortably (24h ≈ 86400 seconds); we
|
||||
// never overflow i64, but clippy's `cast_possible_wrap` lint wants
|
||||
// us to be explicit. `cast_signed` is the documented form.
|
||||
let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
|
||||
format!("{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}")
|
||||
}
|
||||
|
||||
/// Build the `Set-Cookie` header value that establishes a fresh operator
|
||||
/// session with the default 24h TTL. Exposed so the SAML ACS handler can
|
||||
/// attach an operator session to its post-login redirect, exactly as the
|
||||
/// Forms-login path does via [`login_response`].
|
||||
#[must_use]
|
||||
pub fn session_cookie(session: &str) -> String {
|
||||
cookie_attrs(session, None)
|
||||
}
|
||||
|
||||
fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
|
||||
// `Cookie: a=b; c=d` parsing — small enough not to drag in a crate.
|
||||
let raw = headers.get(header::COOKIE)?.to_str().ok()?;
|
||||
for part in raw.split(';') {
|
||||
let part = part.trim();
|
||||
if let Some(v) = part.strip_prefix(&format!("{SESSION_COOKIE}=")) {
|
||||
return Some(v.to_string());
|
||||
}
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
// ── Middleware ────────────────────────────────────────────────────────────
|
||||
|
||||
/// Return `true` if `path` is on the allowlist and should bypass the
|
||||
/// session check. The middleware applies this rule only when the admin
|
||||
/// account is configured; before then everything is open.
|
||||
fn is_public_path(path: &str) -> bool {
|
||||
// Non-API paths: WebUI bundle, PXE chain, ISO bytes, health probes,
|
||||
// metrics. All read-only / PXE-essential.
|
||||
if !path.starts_with("/api/") {
|
||||
return true;
|
||||
}
|
||||
// Auth surface and iPXE long-poll endpoints (no cookie available).
|
||||
// The SAML SP endpoints are pre-auth by nature — the operator hasn't a
|
||||
// session yet when they start (or arrive from) the IdP. `/api/sso`
|
||||
// (the config GET/PUT, no trailing slash) stays gated.
|
||||
matches!(
|
||||
path,
|
||||
"/api/setup"
|
||||
| "/api/login"
|
||||
| "/api/logout"
|
||||
| "/api/me"
|
||||
| "/api/sso/login"
|
||||
| "/api/sso/acs"
|
||||
| "/api/sso/metadata"
|
||||
) || path.starts_with("/api/queue/join")
|
||||
|| path.starts_with("/api/queue/poll/")
|
||||
}
|
||||
|
||||
/// Axum middleware: gate `/api/*` behind a valid session, with the
|
||||
/// allowlist above. `State<AppState>` reaches in for the admin store +
|
||||
/// session store.
|
||||
pub async fn require_auth(
|
||||
State(state): State<AppState>,
|
||||
req: Request<Body>,
|
||||
next: Next,
|
||||
) -> Response {
|
||||
// Bypass entirely while unconfigured. The /api/setup endpoint is
|
||||
// the only one that can flip this back to "configured", and it
|
||||
// refuses to run a second time. Tests + fresh installs ride this
|
||||
// path.
|
||||
if !state.admin.is_configured() {
|
||||
return next.run(req).await;
|
||||
}
|
||||
let path = req.uri().path();
|
||||
if is_public_path(path) {
|
||||
return next.run(req).await;
|
||||
}
|
||||
// Authenticated path. The cookie must be present, map to a live
|
||||
// session, and the TTL refresh happens as a side-effect.
|
||||
let token = parse_cookie(req.headers());
|
||||
if let Some(t) = token {
|
||||
if state.sessions.touch(&t).is_some() {
|
||||
return next.run(req).await;
|
||||
}
|
||||
}
|
||||
(
|
||||
StatusCode::UNAUTHORIZED,
|
||||
Json(json!({ "error": "authentication required" })),
|
||||
)
|
||||
.into_response()
|
||||
}
|
||||
|
||||
// ── Handlers ──────────────────────────────────────────────────────────────
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct SetupBody {
|
||||
pub username: String,
|
||||
pub password: String,
|
||||
}
|
||||
|
||||
/// First-run setup. Refuses to run once an admin already exists — that
|
||||
/// guards against a leaked WebUI being re-bootstrapped by an attacker
|
||||
/// who's seen the deployment URL. After bootstrap, the new session
|
||||
/// cookie is set so the operator goes straight to the dashboard.
|
||||
pub async fn api_setup(State(state): State<AppState>, Json(body): Json<SetupBody>) -> Response {
|
||||
if state.admin.is_configured() {
|
||||
return (
|
||||
StatusCode::CONFLICT,
|
||||
Json(json!({ "error": "admin account already configured" })),
|
||||
)
|
||||
.into_response();
|
||||
}
|
||||
match state.admin.bootstrap(&body.username, &body.password) {
|
||||
Ok(pub_) => {
|
||||
let session = state.sessions.create(&pub_.username);
|
||||
login_response(StatusCode::CREATED, &pub_, &session)
|
||||
}
|
||||
Err(openpxe_core::Error::Invalid(msg)) => {
|
||||
(StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
|
||||
}
|
||||
Err(e) => (
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": format!("{e}") })),
|
||||
)
|
||||
.into_response(),
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct LoginBody {
|
||||
pub username: String,
|
||||
pub password: String,
|
||||
}
|
||||
|
||||
pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody>) -> Response {
|
||||
// Brief, deliberately vague — "invalid credentials" rather than
|
||||
// "no such user" / "wrong password". Same anti-enumeration posture
|
||||
// as Sonarr/Radarr.
|
||||
let pub_ = match state.admin.verify(&body.username, &body.password) {
|
||||
Ok(Some(u)) => u,
|
||||
Ok(None) => {
|
||||
return (
|
||||
StatusCode::UNAUTHORIZED,
|
||||
Json(json!({ "error": "invalid username or password" })),
|
||||
)
|
||||
.into_response();
|
||||
}
|
||||
Err(e) => {
|
||||
return (
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": format!("{e}") })),
|
||||
)
|
||||
.into_response();
|
||||
}
|
||||
};
|
||||
let session = state.sessions.create(&pub_.username);
|
||||
login_response(StatusCode::OK, &pub_, &session)
|
||||
}
|
||||
|
||||
pub async fn api_logout(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
|
||||
if let Some(t) = parse_cookie(&headers) {
|
||||
state.sessions.revoke(&t);
|
||||
}
|
||||
// Stomp the cookie unconditionally — even if the request didn't
|
||||
// carry one, the browser shouldn't keep a stale value.
|
||||
let mut resp = StatusCode::NO_CONTENT.into_response();
|
||||
resp.headers_mut().insert(
|
||||
header::SET_COOKIE,
|
||||
HeaderValue::from_str(&cookie_attrs("", Some(0))).unwrap(),
|
||||
);
|
||||
resp
|
||||
}
|
||||
|
||||
/// Status surface for the front-end shell. Returns four cases:
|
||||
///
|
||||
/// * `setup_required: true` — no admin yet; show first-run page.
|
||||
/// * `authenticated: false` — admin exists, no session; show login.
|
||||
/// * `authenticated: true` + `user` — let the dashboard load.
|
||||
pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
|
||||
// v0.5.0: include branding bootstrap so the pre-auth login/setup
|
||||
// screens can render the FleetDM-style full-width custom logo (and
|
||||
// cache-bust it) without an extra round trip. `/api/me` is public,
|
||||
// and the logo asset is public, so this leaks nothing sensitive.
|
||||
let has_custom_logo = state.branding.has_logo();
|
||||
let logo_rev = state.branding.logo_rev();
|
||||
if !state.admin.is_configured() {
|
||||
return (
|
||||
StatusCode::OK,
|
||||
Json(json!({
|
||||
"setup_required": true,
|
||||
"authenticated": false,
|
||||
"has_custom_logo": has_custom_logo,
|
||||
"logo_rev": logo_rev,
|
||||
})),
|
||||
)
|
||||
.into_response();
|
||||
}
|
||||
let token = parse_cookie(&headers);
|
||||
let username = token.as_deref().and_then(|t| state.sessions.touch(t));
|
||||
match username {
|
||||
Some(u) => (
|
||||
StatusCode::OK,
|
||||
Json(json!({
|
||||
"setup_required": false,
|
||||
"authenticated": true,
|
||||
"user": state.admin.snapshot(),
|
||||
"session_user": u,
|
||||
"has_custom_logo": has_custom_logo,
|
||||
"logo_rev": logo_rev,
|
||||
})),
|
||||
)
|
||||
.into_response(),
|
||||
None => (
|
||||
StatusCode::OK,
|
||||
Json(json!({
|
||||
"setup_required": false,
|
||||
"authenticated": false,
|
||||
"has_custom_logo": has_custom_logo,
|
||||
"logo_rev": logo_rev,
|
||||
})),
|
||||
)
|
||||
.into_response(),
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct UpdateCredentialsBody {
|
||||
pub current_password: String,
|
||||
#[serde(default)]
|
||||
pub new_username: Option<String>,
|
||||
#[serde(default)]
|
||||
pub new_password: Option<String>,
|
||||
}
|
||||
|
||||
/// Rotate the admin's username and/or password. Auth middleware has
|
||||
/// already proved the caller owns a session; we additionally require
|
||||
/// the *current* password to prove "person at the keyboard right now".
|
||||
/// On success we issue a fresh session cookie keyed to the (possibly
|
||||
/// new) username and revoke every prior session so a stolen cookie
|
||||
/// from before the rotation stops working.
|
||||
pub async fn api_update_credentials(
|
||||
State(state): State<AppState>,
|
||||
Json(body): Json<UpdateCredentialsBody>,
|
||||
) -> Response {
|
||||
if !state.admin.is_configured() {
|
||||
return (
|
||||
StatusCode::CONFLICT,
|
||||
Json(json!({ "error": "no admin configured" })),
|
||||
)
|
||||
.into_response();
|
||||
}
|
||||
let result = state.admin.update_credentials(
|
||||
&body.current_password,
|
||||
body.new_username.as_deref(),
|
||||
body.new_password.as_deref(),
|
||||
);
|
||||
match result {
|
||||
Ok(pub_) => {
|
||||
state.sessions.revoke_all();
|
||||
let session = state.sessions.create(&pub_.username);
|
||||
login_response(StatusCode::OK, &pub_, &session)
|
||||
}
|
||||
Err(openpxe_core::Error::Invalid(msg)) => {
|
||||
(StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
|
||||
}
|
||||
Err(e) => (
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
Json(json!({ "error": format!("{e}") })),
|
||||
)
|
||||
.into_response(),
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Serialize)]
|
||||
struct LoginPayload<'a> {
|
||||
user: &'a AdminPublic,
|
||||
authenticated: bool,
|
||||
}
|
||||
|
||||
fn login_response(status: StatusCode, user: &AdminPublic, session: &str) -> Response {
|
||||
let body = Json(LoginPayload {
|
||||
user,
|
||||
authenticated: true,
|
||||
});
|
||||
let mut resp = (status, body).into_response();
|
||||
resp.headers_mut().insert(
|
||||
header::SET_COOKIE,
|
||||
HeaderValue::from_str(&cookie_attrs(session, None)).unwrap(),
|
||||
);
|
||||
resp
|
||||
}
|
||||
|
||||
// ── Tests ─────────────────────────────────────────────────────────────────
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn session_create_touch_revoke() {
|
||||
let s = SessionStore::default();
|
||||
assert!(s.is_empty());
|
||||
let t = s.create("admin");
|
||||
assert_eq!(s.len(), 1);
|
||||
assert_eq!(s.touch(&t).as_deref(), Some("admin"));
|
||||
s.revoke(&t);
|
||||
assert!(s.is_empty());
|
||||
// Stale token doesn't error, just returns None.
|
||||
assert!(s.touch(&t).is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn session_revoke_all_clears() {
|
||||
let s = SessionStore::default();
|
||||
let _ = s.create("a");
|
||||
let _ = s.create("b");
|
||||
assert_eq!(s.len(), 2);
|
||||
s.revoke_all();
|
||||
assert!(s.is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn public_path_allowlist() {
|
||||
// PXE + chrome paths bypass auth.
|
||||
for p in [
|
||||
"/",
|
||||
"/assets/app.js",
|
||||
"/boot.ipxe",
|
||||
"/boot/fake.ipxe",
|
||||
"/iso/fake.iso",
|
||||
"/ipxe/snponly.efi",
|
||||
"/healthz",
|
||||
"/readyz",
|
||||
"/metrics",
|
||||
// v0.4.6: iPXE fetches this for `console --picture` before
|
||||
// it can possibly have a session cookie.
|
||||
"/branding/pxe-logo",
|
||||
] {
|
||||
assert!(is_public_path(p), "expected {p} to be public");
|
||||
}
|
||||
// Auth surface itself is public.
|
||||
for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
|
||||
assert!(is_public_path(p), "expected {p} to be public");
|
||||
}
|
||||
// v0.5.1: SAML SP endpoints are pre-auth (no session yet).
|
||||
for p in ["/api/sso/login", "/api/sso/acs", "/api/sso/metadata"] {
|
||||
assert!(is_public_path(p), "expected {p} to be public");
|
||||
}
|
||||
// iPXE long-poll endpoints are public (no cookie available).
|
||||
assert!(is_public_path("/api/queue/join"));
|
||||
assert!(is_public_path("/api/queue/poll/abc"));
|
||||
// Everything else under /api/* must auth.
|
||||
for p in [
|
||||
"/api/isos",
|
||||
"/api/isos/x/category",
|
||||
"/api/storage/disk",
|
||||
"/api/branding/logo",
|
||||
"/api/sso",
|
||||
"/api/hosts",
|
||||
] {
|
||||
assert!(!is_public_path(p), "expected {p} to require auth");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn cookie_parse_picks_session_value() {
|
||||
let mut h = axum::http::HeaderMap::new();
|
||||
h.insert(
|
||||
header::COOKIE,
|
||||
HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux")).unwrap(),
|
||||
);
|
||||
assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
|
||||
// Different name → None.
|
||||
let mut h2 = axum::http::HeaderMap::new();
|
||||
h2.insert(header::COOKIE, HeaderValue::from_str("foo=bar").unwrap());
|
||||
assert!(parse_cookie(&h2).is_none());
|
||||
// No cookie header at all → None.
|
||||
assert!(parse_cookie(&axum::http::HeaderMap::new()).is_none());
|
||||
}
|
||||
}
|
||||
@@ -29,16 +29,6 @@ use std::fmt::Write as _;
|
||||
|
||||
/// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
|
||||
/// clients because iPXE normalises the menu primitives across firmwares.
|
||||
///
|
||||
/// v0.4.69: rendered with an iVentoy-style graphical frame — a
|
||||
/// `console --picture` directive paints a full-screen PNG background
|
||||
/// (the operator's uploaded logo on a dark field, or the default
|
||||
/// OpenPXE mark) with the menu text overlaid below a reserved top
|
||||
/// margin, plus a footer carrying version + arch + firmware kind. On
|
||||
/// iPXE binaries built with `IMAGE_PNG` + `CONSOLE_FRAMEBUFFER` (our
|
||||
/// x86_64 UEFI binaries, compiled from source) the background paints;
|
||||
/// on binaries without PNG support the `|| console` fallback yields a
|
||||
/// clean text menu. The old ASCII wordmark has been removed.
|
||||
#[must_use]
|
||||
pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
|
||||
let mut s = String::new();
|
||||
@@ -57,36 +47,8 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
|
||||
let _ = writeln!(s, "set base-url {base}");
|
||||
let _ = writeln!(s, "set esc:hex 1b");
|
||||
let _ = writeln!(s, "set cls ${{esc:string}}[2J");
|
||||
// v0.4.69: graphical background. `/branding/pxe-logo` always
|
||||
// returns a full-screen 1024×768 PNG now — the operator's logo on a
|
||||
// dark field, or a default OpenPXE mark when none is uploaded. The
|
||||
// `--top 290` reserves the top band (where the logo paints) so the
|
||||
// menu text lands below it. On an iPXE build *with* `IMAGE_PNG` +
|
||||
// `CONSOLE_FRAMEBUFFER` (our x86_64 UEFI binaries, built from source
|
||||
// — see deploy/docker/Dockerfile) this paints the background and
|
||||
// overlays the menu. On a build *without* PNG support (the fetched
|
||||
// BIOS/i386/arm64 binaries) the whole `console --picture …` command
|
||||
// fails and the `|| console` resets to a clean full-screen text
|
||||
// menu. Either way there's no ASCII placeholder anymore.
|
||||
let _ = writeln!(
|
||||
s,
|
||||
"console --picture {base}/branding/pxe-logo --top 290 || console"
|
||||
);
|
||||
// Map iPXE's ${{buildarch}} + ${{platform}} into the human form the
|
||||
// user asked for (e.g. "x86 BIOS", "x86_64 UEFI", "arm64 UEFI").
|
||||
// iPXE evaluates `iseq` lazily, so we only set whichever line
|
||||
// matches. Anything not on the allowlist falls through to a generic
|
||||
// `<buildarch> <platform>` display.
|
||||
let _ = writeln!(s, "set arch-label ${{buildarch}} ${{platform}}");
|
||||
let _ = writeln!(
|
||||
s,
|
||||
"iseq ${{buildarch}} i386 && iseq ${{platform}} pcbios && set arch-label x86 BIOS || iseq ${{buildarch}} x86_64 && iseq ${{platform}} efi && set arch-label x86_64 UEFI || iseq ${{buildarch}} arm64 && iseq ${{platform}} efi && set arch-label arm64 UEFI || true"
|
||||
);
|
||||
let _ = writeln!(s, ":menu");
|
||||
let _ = writeln!(s, "menu OpenPXE - network boot menu");
|
||||
// v0.4.69: the ASCII wordmark is gone — the graphical background
|
||||
// (set via `console --picture` above) carries the branding now.
|
||||
let _ = writeln!(s, "item --gap");
|
||||
let _ = writeln!(
|
||||
s,
|
||||
"item --gap -- ------------------------- Default -------------------------"
|
||||
@@ -120,18 +82,6 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
|
||||
let _ = writeln!(s, "item queue Queued Deployment (join queue)");
|
||||
let _ = writeln!(s, "item --gap");
|
||||
let _ = writeln!(s, "item --key x exit Exit iPXE");
|
||||
// v0.4.6 footer line. Sits just above the `choose` line so it's
|
||||
// always visible regardless of how the menu paginates. iPXE
|
||||
// interpolates `${arch-label}` (set near the top of this script)
|
||||
// and `${version}` is the binary-baked iPXE version — *not* the
|
||||
// OpenPXE version — so we hard-code the OpenPXE version string
|
||||
// here.
|
||||
let openpxe_version = env!("CARGO_PKG_VERSION");
|
||||
let _ = writeln!(s, "item --gap");
|
||||
let _ = writeln!(
|
||||
s,
|
||||
"item --gap -- OpenPXE v{openpxe_version} - ${{arch-label}}"
|
||||
);
|
||||
|
||||
if matches!(settings.timeout_action, TimeoutAction::Stay) {
|
||||
let _ = writeln!(s, "choose --default {default_item} target || goto menu");
|
||||
@@ -199,13 +149,6 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
|
||||
if !filter(iso.introspection.family) {
|
||||
continue;
|
||||
}
|
||||
// v0.4.4: ISOs the operator flipped to the Tools category move
|
||||
// out of the OS installer submenus entirely — they only appear
|
||||
// under Tools. Without this filter the operator would see the
|
||||
// same ISO in both menus.
|
||||
if matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
|
||||
continue;
|
||||
}
|
||||
for entry in &iso.boot_entries {
|
||||
let size_label = fmt_size_mib(iso.size_bytes);
|
||||
let key = hotkey_for_index(count);
|
||||
@@ -240,7 +183,7 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
|
||||
"iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
|
||||
);
|
||||
// Pass `?mac=${mac}` so the per-entry handler can record the booting
|
||||
// client into the Host log. iPXE substitutes `${mac}` before
|
||||
// client into the Host log (v0.4.0). iPXE substitutes `${mac}` before
|
||||
// the HTTP fetch; if the firmware can't resolve it the literal
|
||||
// `${mac}` is sent and the server treats it as "unknown".
|
||||
let _ = writeln!(
|
||||
@@ -267,52 +210,15 @@ fn hotkey_for_index(i: usize) -> String {
|
||||
}
|
||||
}
|
||||
|
||||
/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware,
|
||||
/// plus any ISOs the operator flipped to [`IsoCategory::Tools`] in the
|
||||
/// Storage tab. The category-Tools ISOs render first so frequently used
|
||||
/// recovery / hardware tools are reachable with a single number key
|
||||
/// before the built-in shortcuts.
|
||||
/// Tools submenu — Utilities, Shell, NIC Info, Reboot, Exit to firmware.
|
||||
#[must_use]
|
||||
pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
|
||||
pub fn render_tools_menu(base_url: &str) -> String {
|
||||
let base = base_url.trim_end_matches('/');
|
||||
let mut s = String::new();
|
||||
let _ = writeln!(s, "#!ipxe");
|
||||
let _ = writeln!(s, "set base-url {base}");
|
||||
let _ = writeln!(s, ":menu");
|
||||
let _ = writeln!(s, "menu OpenPXE - Tools");
|
||||
|
||||
// Operator-categorized tool ISOs (hotkeys 1..9), each chained the
|
||||
// same way as a per-family menu pick — through the boot-entry id
|
||||
// route, carrying `?mac=${mac}` for Host log attribution.
|
||||
let mut count = 0;
|
||||
for iso in isos {
|
||||
if !matches!(iso.category, openpxe_iso_store::IsoCategory::Tools) {
|
||||
continue;
|
||||
}
|
||||
for entry in &iso.boot_entries {
|
||||
let size_label = fmt_size_mib(iso.size_bytes);
|
||||
let key = hotkey_for_index(count);
|
||||
let lock = if iso.is_password_protected() {
|
||||
"*"
|
||||
} else {
|
||||
" "
|
||||
};
|
||||
let _ = writeln!(
|
||||
s,
|
||||
"item {}{} {}[{:>6}] {}",
|
||||
key,
|
||||
entry.id,
|
||||
lock,
|
||||
size_label,
|
||||
escape_label(&entry.title),
|
||||
);
|
||||
count += 1;
|
||||
}
|
||||
}
|
||||
if count > 0 {
|
||||
let _ = writeln!(s, "item --gap");
|
||||
}
|
||||
|
||||
let _ = writeln!(s, "item --key u util Utilities (memtest, ...)");
|
||||
let _ = writeln!(s, "item --key s shell OpenPXE Shell");
|
||||
let _ = writeln!(s, "item --key n nic Network Card Info");
|
||||
@@ -346,12 +252,7 @@ pub fn render_tools_menu(isos: &[IsoMeta], base_url: &str) -> String {
|
||||
s,
|
||||
"iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
|
||||
);
|
||||
// Fall-through for category-Tools ISO ids — same as the family
|
||||
// submenu, carrying `?mac=${mac}` for the boot log.
|
||||
let _ = writeln!(
|
||||
s,
|
||||
"chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
|
||||
);
|
||||
let _ = writeln!(s, "goto menu");
|
||||
s
|
||||
}
|
||||
|
||||
@@ -568,7 +469,7 @@ pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str
|
||||
let _ = writeln!(s, ":submit");
|
||||
let _ = writeln!(s, "echo Verifying...");
|
||||
// Carry `mac=${mac}` alongside the token so a successful unlock
|
||||
// records the actual client MAC into the Host log. On
|
||||
// records the actual client MAC into the Host log (v0.4.0). On
|
||||
// older iPXE that can't resolve `${mac}` the server just stores it
|
||||
// as "unknown" rather than refusing to boot.
|
||||
let _ = writeln!(
|
||||
@@ -625,61 +526,12 @@ mod password_tests {
|
||||
assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn top_menu_has_polished_branding_and_arch_footer() {
|
||||
// v0.4.69: the menu emits a `console --picture` line that paints
|
||||
// a full-screen PNG background (the operator's logo, or the
|
||||
// default OpenPXE mark) reserving a top margin for it, then
|
||||
// falls back to a clean text console on iPXE builds without PNG
|
||||
// support. The ASCII wordmark is gone — the graphical
|
||||
// background carries the branding now. A single-line footer
|
||||
// still carries the OpenPXE version + arch.
|
||||
let settings = Settings::default();
|
||||
let s = render_menu(&[], &settings, "http://10.0.0.5");
|
||||
assert!(
|
||||
s.contains("console --picture http://10.0.0.5/branding/pxe-logo"),
|
||||
"missing console --picture line:\n{s}"
|
||||
);
|
||||
// The picture call reserves a top margin for the logo band.
|
||||
assert!(s.contains("--top 290"), "missing --top margin:\n{s}");
|
||||
// Picture-or-text-console must be a single statement so older
|
||||
// iPXE parsers don't choke on the chain.
|
||||
assert!(s.contains("|| console"), "missing graceful fallback:\n{s}");
|
||||
// The ASCII wordmark must be GONE — its removal is the whole
|
||||
// point of v0.4.69's graphical background.
|
||||
assert!(
|
||||
!s.contains("___ ___ __ __ ___"),
|
||||
"ASCII banner should have been removed:\n{s}"
|
||||
);
|
||||
// Footer with version + arch interpolation. The version comes
|
||||
// from CARGO_PKG_VERSION at compile time.
|
||||
let version = env!("CARGO_PKG_VERSION");
|
||||
assert!(
|
||||
s.contains(&format!("OpenPXE v{version}")),
|
||||
"footer missing OpenPXE version:\n{s}"
|
||||
);
|
||||
assert!(
|
||||
s.contains("${arch-label}"),
|
||||
"footer missing arch-label interpolation:\n{s}"
|
||||
);
|
||||
// No website URL — the design brief calls that out as tacky.
|
||||
assert!(
|
||||
!s.to_ascii_lowercase().contains("openpxe.com"),
|
||||
"footer should not advertise the website:\n{s}"
|
||||
);
|
||||
// Arch-label mapping covers the three labels from the brief:
|
||||
// "x86 BIOS", "x86_64 UEFI", "arm64 UEFI".
|
||||
assert!(s.contains("x86 BIOS"), "{s}");
|
||||
assert!(s.contains("x86_64 UEFI"), "{s}");
|
||||
assert!(s.contains("arm64 UEFI"), "{s}");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
|
||||
let settings = Settings::default();
|
||||
let scripts = [
|
||||
render_menu(&[], &settings, "http://10.0.0.5"),
|
||||
render_tools_menu(&[], "http://10.0.0.5"),
|
||||
render_tools_menu("http://10.0.0.5"),
|
||||
render_local_hdd("http://10.0.0.5"),
|
||||
render_util("http://10.0.0.5"),
|
||||
render_shell("http://10.0.0.5"),
|
||||
|
||||
@@ -14,15 +14,11 @@
|
||||
#![forbid(unsafe_code)]
|
||||
|
||||
pub mod app;
|
||||
pub mod auth;
|
||||
pub mod ipxe_script;
|
||||
pub mod iso_fs;
|
||||
pub mod log_stream;
|
||||
pub mod notify;
|
||||
pub mod saml_routes;
|
||||
pub mod state;
|
||||
pub mod terminal;
|
||||
pub mod uploads;
|
||||
|
||||
pub use app::build_router;
|
||||
pub use state::AppState;
|
||||
|
||||
@@ -1,138 +0,0 @@
|
||||
//! Notification *delivery* — the network half of the notify feature.
|
||||
//!
|
||||
//! `openpxe_core::notify` owns the config + persistence; this module
|
||||
//! turns a `NotifyConfig` + a message into an actual delivery:
|
||||
//!
|
||||
//! - Slack / Discord / Teams → HTTP POST of a provider-shaped JSON
|
||||
//! body to the operator's incoming-webhook URL (via `reqwest`).
|
||||
//! - SMTP → a TLS email via `lettre`.
|
||||
//!
|
||||
//! Every send is best-effort and time-bounded: a flaky webhook must
|
||||
//! never wedge a PXE boot. Callers fire these from a detached task.
|
||||
|
||||
use openpxe_core::{NotifyConfig, NotifyKind};
|
||||
use std::time::Duration;
|
||||
|
||||
/// Hard ceiling on any single delivery so a hung endpoint can't pin a
|
||||
/// task forever.
|
||||
const SEND_TIMEOUT: Duration = Duration::from_secs(10);
|
||||
|
||||
/// Deliver `body` (with an optional `subject`, used as the email
|
||||
/// subject / chat bold-line) using the active provider in `cfg`.
|
||||
/// Returns `Ok(())` on success, or a human-readable error suitable for
|
||||
/// surfacing in the "Send test" response.
|
||||
pub async fn send(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
|
||||
if !cfg.is_usable() {
|
||||
return Err("notifications are not enabled / fully configured".into());
|
||||
}
|
||||
match cfg.kind {
|
||||
NotifyKind::Slack | NotifyKind::Discord | NotifyKind::Teams => {
|
||||
send_webhook(cfg, subject, body).await
|
||||
}
|
||||
NotifyKind::Smtp => send_email(cfg, subject, body).await,
|
||||
}
|
||||
}
|
||||
|
||||
async fn send_webhook(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
|
||||
// Each chat platform wants a different JSON shape for an incoming
|
||||
// webhook. Keep the bodies minimal and plain-text-ish so they
|
||||
// render cleanly everywhere.
|
||||
let combined = if subject.is_empty() {
|
||||
body.to_string()
|
||||
} else {
|
||||
format!("*{subject}*\n{body}")
|
||||
};
|
||||
let payload = match cfg.kind {
|
||||
NotifyKind::Slack => serde_json::json!({ "text": combined }),
|
||||
NotifyKind::Discord => serde_json::json!({ "content": combined }),
|
||||
NotifyKind::Teams => serde_json::json!({
|
||||
// Legacy MessageCard — the format every Teams "Incoming
|
||||
// Webhook" connector still accepts.
|
||||
"@type": "MessageCard",
|
||||
"@context": "https://schema.org/extensions",
|
||||
"summary": if subject.is_empty() { "OpenPXE" } else { subject },
|
||||
"title": subject,
|
||||
"text": body,
|
||||
}),
|
||||
NotifyKind::Smtp => unreachable!("smtp handled separately"),
|
||||
};
|
||||
|
||||
let client = reqwest::Client::builder()
|
||||
.timeout(SEND_TIMEOUT)
|
||||
.build()
|
||||
.map_err(|e| format!("could not build HTTP client: {e}"))?;
|
||||
let resp = client
|
||||
.post(&cfg.webhook_url)
|
||||
.json(&payload)
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| format!("webhook POST failed: {e}"))?;
|
||||
let status = resp.status();
|
||||
if status.is_success() {
|
||||
Ok(())
|
||||
} else {
|
||||
let snippet = resp
|
||||
.text()
|
||||
.await
|
||||
.unwrap_or_default()
|
||||
.chars()
|
||||
.take(200)
|
||||
.collect::<String>();
|
||||
Err(format!("webhook returned HTTP {status}: {snippet}"))
|
||||
}
|
||||
}
|
||||
|
||||
async fn send_email(cfg: &NotifyConfig, subject: &str, body: &str) -> Result<(), String> {
|
||||
use lettre::transport::smtp::authentication::Credentials;
|
||||
use lettre::{AsyncSmtpTransport, AsyncTransport, Message, Tokio1Executor};
|
||||
|
||||
let from = if cfg.smtp_from.trim().is_empty() {
|
||||
cfg.smtp_username.trim()
|
||||
} else {
|
||||
cfg.smtp_from.trim()
|
||||
};
|
||||
if from.is_empty() {
|
||||
return Err("SMTP requires a From address (or a username to fall back to)".into());
|
||||
}
|
||||
|
||||
let email = Message::builder()
|
||||
.from(
|
||||
from.parse()
|
||||
.map_err(|e| format!("invalid From address '{from}': {e}"))?,
|
||||
)
|
||||
.to(cfg
|
||||
.smtp_to
|
||||
.trim()
|
||||
.parse()
|
||||
.map_err(|e| format!("invalid To address '{}': {e}", cfg.smtp_to))?)
|
||||
.subject(if subject.is_empty() { "OpenPXE" } else { subject })
|
||||
.body(body.to_string())
|
||||
.map_err(|e| format!("could not build email: {e}"))?;
|
||||
|
||||
// Implicit TLS (465) vs STARTTLS (587). We never send plaintext.
|
||||
let mut builder = if cfg.smtp_implicit_tls {
|
||||
AsyncSmtpTransport::<Tokio1Executor>::relay(&cfg.smtp_host)
|
||||
.map_err(|e| format!("SMTP relay setup failed: {e}"))?
|
||||
} else {
|
||||
AsyncSmtpTransport::<Tokio1Executor>::starttls_relay(&cfg.smtp_host)
|
||||
.map_err(|e| format!("SMTP STARTTLS setup failed: {e}"))?
|
||||
}
|
||||
.port(cfg.smtp_port)
|
||||
.timeout(Some(SEND_TIMEOUT));
|
||||
|
||||
// Auth is optional — some internal relays accept unauthenticated
|
||||
// mail from trusted hosts. Only attach credentials when a username
|
||||
// is set.
|
||||
if !cfg.smtp_username.trim().is_empty() {
|
||||
builder = builder.credentials(Credentials::new(
|
||||
cfg.smtp_username.trim().to_string(),
|
||||
cfg.smtp_password.clone(),
|
||||
));
|
||||
}
|
||||
let mailer = builder.build();
|
||||
mailer
|
||||
.send(email)
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(|e| format!("SMTP send failed: {e}"))
|
||||
}
|
||||
@@ -1,338 +0,0 @@
|
||||
//! SAML 2.0 Service Provider HTTP endpoints (v0.5.1).
|
||||
//!
|
||||
//! * `GET /api/sso/login` — SP-initiated: build an AuthnRequest, record its
|
||||
//! ID, and 302 the browser to the IdP.
|
||||
//! * `POST /api/sso/acs` — Assertion Consumer Service: verify + validate
|
||||
//! the IdP's `SAMLResponse`, perform the stateful checks (InResponseTo
|
||||
//! correlation, IdP-initiated gating, assertion replay), mint an operator
|
||||
//! session, and 302 to the dashboard. (Mirrors FleetDM's `/sso/callback`.)
|
||||
//! * `GET /api/sso/metadata` — serve our SP metadata XML for IdP import.
|
||||
//!
|
||||
//! Stateless crypto + semantic validation live in `openpxe_core::saml`; this
|
||||
//! module owns only the HTTP glue and the in-memory state the SP needs.
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
use std::time::{Duration as StdDuration, Instant};
|
||||
|
||||
use axum::{
|
||||
body::Body,
|
||||
extract::{Form, Query, State},
|
||||
http::{header, StatusCode},
|
||||
response::{IntoResponse, Response},
|
||||
};
|
||||
use base64::Engine;
|
||||
use parking_lot::Mutex;
|
||||
use serde::Deserialize;
|
||||
use time::{Duration, OffsetDateTime};
|
||||
|
||||
use openpxe_core::saml::{self, metadata::IdpMetadata, SamlError, SpParams};
|
||||
use openpxe_core::SsoConfig;
|
||||
|
||||
use crate::auth;
|
||||
use crate::state::AppState;
|
||||
|
||||
/// Outstanding AuthnRequest IDs live at most this long before a matching
|
||||
/// response is considered stale (covers a slow human at the IdP login form).
|
||||
const REQUEST_TTL: StdDuration = StdDuration::from_mins(10);
|
||||
/// How long we fetch-cache IdP metadata loaded from a URL.
|
||||
const METADATA_FETCH_TIMEOUT: StdDuration = StdDuration::from_secs(10);
|
||||
|
||||
/// In-memory SAML runtime state. Cheap to clone (Arc-shared).
|
||||
#[derive(Clone, Default)]
|
||||
pub struct SamlRuntime {
|
||||
/// request_id → issued_at. Correlates a response's `InResponseTo` to a
|
||||
/// request *we* actually sent (replay / CSRF defense for SP-initiated).
|
||||
outstanding: Arc<Mutex<HashMap<String, Instant>>>,
|
||||
/// assertion_id → expiry. A consumed assertion may not be replayed.
|
||||
consumed: Arc<Mutex<HashMap<String, Instant>>>,
|
||||
/// Cache of IdP metadata fetched from a URL: (url, parsed).
|
||||
metadata_cache: Arc<Mutex<Option<(String, IdpMetadata)>>>,
|
||||
}
|
||||
|
||||
impl SamlRuntime {
|
||||
/// Record an AuthnRequest we just sent.
|
||||
pub fn register_request(&self, id: &str) {
|
||||
let mut g = self.outstanding.lock();
|
||||
prune(&mut g);
|
||||
g.insert(id.to_owned(), Instant::now());
|
||||
}
|
||||
|
||||
/// Consume an outstanding request ID, returning `true` if it was present
|
||||
/// and still fresh. A miss means the response doesn't correlate to any
|
||||
/// live request we issued.
|
||||
pub fn take_request(&self, id: &str) -> bool {
|
||||
let mut g = self.outstanding.lock();
|
||||
prune(&mut g);
|
||||
g.remove(id).is_some()
|
||||
}
|
||||
|
||||
/// Record a consumed assertion. Returns `false` if it was already
|
||||
/// consumed (a replay) — in which case the caller must reject.
|
||||
pub fn record_assertion(&self, id: &str, expiry: OffsetDateTime) -> bool {
|
||||
let mut g = self.consumed.lock();
|
||||
prune(&mut g);
|
||||
if g.contains_key(id) {
|
||||
return false;
|
||||
}
|
||||
let ttl = (expiry - OffsetDateTime::now_utc())
|
||||
.max(Duration::ZERO)
|
||||
.unsigned_abs();
|
||||
g.insert(id.to_owned(), Instant::now() + ttl);
|
||||
true
|
||||
}
|
||||
|
||||
fn cached_metadata(&self, url: &str) -> Option<IdpMetadata> {
|
||||
let g = self.metadata_cache.lock();
|
||||
match &*g {
|
||||
Some((cached_url, md)) if cached_url == url => Some(md.clone()),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
fn cache_metadata(&self, url: String, md: IdpMetadata) {
|
||||
*self.metadata_cache.lock() = Some((url, md));
|
||||
}
|
||||
}
|
||||
|
||||
/// Drop expired entries so neither map grows unbounded.
|
||||
fn prune(map: &mut HashMap<String, Instant>) {
|
||||
let now = Instant::now();
|
||||
// For the request map this over-prunes (entries store issued_at, not
|
||||
// expiry), so cap by REQUEST_TTL; the consumed map stores absolute
|
||||
// expiry instants. Using saturating logic keeps both correct: request
|
||||
// entries older than REQUEST_TTL go, consumed entries past expiry go.
|
||||
map.retain(|_, &mut t| now.saturating_duration_since(t) < REQUEST_TTL || t > now);
|
||||
}
|
||||
|
||||
// ─── GET /api/sso/login ───────────────────────────────────────────────────
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct LoginQuery {
|
||||
/// Optional local path to return to after login (becomes RelayState).
|
||||
#[serde(default)]
|
||||
pub next: Option<String>,
|
||||
}
|
||||
|
||||
pub async fn sso_login(State(state): State<AppState>, Query(q): Query<LoginQuery>) -> Response {
|
||||
let cfg = state.sso.snapshot();
|
||||
if !cfg.is_usable() {
|
||||
return redirect("/?sso_error=unavailable");
|
||||
}
|
||||
let idp = match resolve_idp_metadata(&state, &cfg).await {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::saml", "sso_login: metadata unavailable: {e}");
|
||||
return redirect("/?sso_error=metadata");
|
||||
}
|
||||
};
|
||||
let Some(dest) = idp.sso_destination().map(str::to_owned) else {
|
||||
tracing::warn!(target: "openpxe::saml", "sso_login: IdP metadata has no SSO endpoint");
|
||||
return redirect("/?sso_error=metadata");
|
||||
};
|
||||
let sp = sp_params(&state, &cfg);
|
||||
let relay = safe_local_path(q.next.as_deref());
|
||||
match saml::authn_request::build(&sp, &dest, Some(&relay)) {
|
||||
Ok(req) => {
|
||||
state.saml.register_request(&req.id);
|
||||
redirect(&req.location)
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::saml", "sso_login: build AuthnRequest failed: {e}");
|
||||
redirect("/?sso_error=request")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ─── POST /api/sso/acs ──────────────────────────────────────────────────────
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct AcsForm {
|
||||
#[serde(rename = "SAMLResponse")]
|
||||
pub saml_response: String,
|
||||
#[serde(rename = "RelayState", default)]
|
||||
pub relay_state: Option<String>,
|
||||
}
|
||||
|
||||
pub async fn sso_acs(State(state): State<AppState>, Form(form): Form<AcsForm>) -> Response {
|
||||
let cfg = state.sso.snapshot();
|
||||
if !cfg.is_usable() {
|
||||
return redirect("/?sso_error=unavailable");
|
||||
}
|
||||
let xml = match base64::engine::general_purpose::STANDARD.decode(form.saml_response.as_bytes())
|
||||
{
|
||||
Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::saml", "acs: base64 decode failed: {e}");
|
||||
return redirect("/?sso_error=1");
|
||||
}
|
||||
};
|
||||
let idp = match resolve_idp_metadata(&state, &cfg).await {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::saml", "acs: metadata unavailable: {e}");
|
||||
return redirect("/?sso_error=metadata");
|
||||
}
|
||||
};
|
||||
let sp = sp_params(&state, &cfg);
|
||||
|
||||
// Signature verification + semantic checks are CPU-bound — keep them off
|
||||
// the async executor.
|
||||
let now = OffsetDateTime::now_utc();
|
||||
let skew = Duration::seconds(saml::DEFAULT_CLOCK_SKEW_SECS);
|
||||
let verify = {
|
||||
let xml = xml.clone();
|
||||
let sp = sp.clone();
|
||||
tokio::task::spawn_blocking(move || saml::response::consume(&xml, &sp, &idp, now, skew))
|
||||
.await
|
||||
};
|
||||
let verified = match verify {
|
||||
Ok(Ok(v)) => v,
|
||||
Ok(Err(e)) => {
|
||||
// Never leak which specific check failed to the browser.
|
||||
tracing::warn!(target: "openpxe::saml", "acs: response rejected: {e}");
|
||||
return redirect("/?sso_error=1");
|
||||
}
|
||||
Err(join) => {
|
||||
tracing::error!(target: "openpxe::saml", "acs: verify task panicked: {join}");
|
||||
return redirect("/?sso_error=1");
|
||||
}
|
||||
};
|
||||
|
||||
// Stateful checks the core deliberately left to us.
|
||||
match &verified.in_response_to {
|
||||
Some(id) => {
|
||||
if !state.saml.take_request(id) {
|
||||
tracing::warn!(target: "openpxe::saml", "acs: InResponseTo matches no live request");
|
||||
return redirect("/?sso_error=1");
|
||||
}
|
||||
}
|
||||
None => {
|
||||
if !cfg.allow_idp_initiated {
|
||||
tracing::warn!(target: "openpxe::saml", "acs: IdP-initiated login is disabled");
|
||||
return redirect("/?sso_error=idp_initiated");
|
||||
}
|
||||
}
|
||||
}
|
||||
if !state
|
||||
.saml
|
||||
.record_assertion(&verified.assertion_id, verified.assertion_expiry)
|
||||
{
|
||||
tracing::warn!(target: "openpxe::saml", "acs: assertion replay rejected");
|
||||
return redirect("/?sso_error=1");
|
||||
}
|
||||
|
||||
// Success → mint an operator session keyed to the verified email.
|
||||
let session = state.sessions.create(&verified.principal.email);
|
||||
tracing::info!(
|
||||
target: "openpxe::saml",
|
||||
email = %verified.principal.email,
|
||||
idp_initiated = verified.in_response_to.is_none(),
|
||||
"SAML SSO sign-in"
|
||||
);
|
||||
// safe_local_path already maps None / unsafe values to "/".
|
||||
let relay = safe_local_path(form.relay_state.as_deref());
|
||||
redirect_with_session(&relay, &session)
|
||||
}
|
||||
|
||||
// ─── GET /api/sso/metadata ──────────────────────────────────────────────────
|
||||
|
||||
pub async fn sso_metadata(State(state): State<AppState>) -> Response {
|
||||
let cfg = state.sso.snapshot();
|
||||
let sp = sp_params(&state, &cfg);
|
||||
let xml = saml::metadata::build_sp_metadata(&sp);
|
||||
(
|
||||
StatusCode::OK,
|
||||
[(header::CONTENT_TYPE, "application/samlmetadata+xml")],
|
||||
xml,
|
||||
)
|
||||
.into_response()
|
||||
}
|
||||
|
||||
// ─── helpers ────────────────────────────────────────────────────────────────
|
||||
|
||||
/// Derive runtime SP parameters from config + the advertised public base URL.
|
||||
fn sp_params(state: &AppState, cfg: &SsoConfig) -> SpParams {
|
||||
let base = state.public_base_url.trim_end_matches('/');
|
||||
let entity_id = if cfg.entity_id.trim().is_empty() {
|
||||
base.to_owned()
|
||||
} else {
|
||||
cfg.entity_id.trim().to_owned()
|
||||
};
|
||||
SpParams {
|
||||
entity_id,
|
||||
acs_url: format!("{base}/api/sso/acs"),
|
||||
}
|
||||
}
|
||||
|
||||
/// Resolve the IdP metadata: prefer the metadata URL (fetched + cached) per
|
||||
/// the "URL wins" rule, else parse the pasted XML.
|
||||
async fn resolve_idp_metadata(state: &AppState, cfg: &SsoConfig) -> Result<IdpMetadata, SamlError> {
|
||||
let url = cfg.metadata_url.trim();
|
||||
if !url.is_empty() {
|
||||
if let Some(md) = state.saml.cached_metadata(url) {
|
||||
return Ok(md);
|
||||
}
|
||||
let body = fetch_metadata(url).await?;
|
||||
let md = IdpMetadata::parse(&body)?;
|
||||
state.saml.cache_metadata(url.to_owned(), md.clone());
|
||||
return Ok(md);
|
||||
}
|
||||
if !cfg.metadata.trim().is_empty() {
|
||||
return IdpMetadata::parse(&cfg.metadata);
|
||||
}
|
||||
Err(SamlError::Metadata("no metadata source configured".into()))
|
||||
}
|
||||
|
||||
async fn fetch_metadata(url: &str) -> Result<String, SamlError> {
|
||||
let client = reqwest::Client::builder()
|
||||
.timeout(METADATA_FETCH_TIMEOUT)
|
||||
.build()
|
||||
.map_err(|e| SamlError::Metadata(format!("http client: {e}")))?;
|
||||
let resp = client
|
||||
.get(url)
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| SamlError::Metadata(format!("fetch {url}: {e}")))?;
|
||||
if !resp.status().is_success() {
|
||||
return Err(SamlError::Metadata(format!(
|
||||
"fetch {url}: HTTP {}",
|
||||
resp.status()
|
||||
)));
|
||||
}
|
||||
resp.text()
|
||||
.await
|
||||
.map_err(|e| SamlError::Metadata(format!("read {url}: {e}")))
|
||||
}
|
||||
|
||||
/// Only permit a same-site path (single leading slash) as a redirect target —
|
||||
/// blocks open-redirect / protocol-relative (`//evil.com`) abuse of RelayState.
|
||||
fn safe_local_path(p: Option<&str>) -> String {
|
||||
match p {
|
||||
Some(p) if p.starts_with('/') && !p.starts_with("//") => p.to_owned(),
|
||||
_ => "/".to_owned(),
|
||||
}
|
||||
}
|
||||
|
||||
fn redirect(location: &str) -> Response {
|
||||
Response::builder()
|
||||
.status(StatusCode::FOUND)
|
||||
.header(header::LOCATION, location)
|
||||
.body(Body::empty())
|
||||
.map_or_else(
|
||||
|_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
|
||||
IntoResponse::into_response,
|
||||
)
|
||||
}
|
||||
|
||||
fn redirect_with_session(location: &str, session: &str) -> Response {
|
||||
Response::builder()
|
||||
.status(StatusCode::FOUND)
|
||||
.header(header::LOCATION, location)
|
||||
.header(header::SET_COOKIE, auth::session_cookie(session))
|
||||
.body(Body::empty())
|
||||
.map_or_else(
|
||||
|_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
|
||||
IntoResponse::into_response,
|
||||
)
|
||||
}
|
||||
@@ -1,11 +1,7 @@
|
||||
use crate::auth::SessionStore;
|
||||
use crate::saml_routes::SamlRuntime;
|
||||
use crate::uploads::UploadSessions;
|
||||
use openpxe_core::{
|
||||
AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
|
||||
Metrics, NotifyStore, SettingsStore, SsoStore,
|
||||
BootLog, ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore,
|
||||
};
|
||||
use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
|
||||
use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
|
||||
use std::sync::Arc;
|
||||
use time::OffsetDateTime;
|
||||
|
||||
@@ -23,29 +19,6 @@ pub struct AppState {
|
||||
/// every `/boot/<entry>.ipxe` chain that goes on to serve a script
|
||||
/// (i.e. an image actually starting to install on a machine).
|
||||
pub boot_log: BootLog,
|
||||
/// Operator-controlled UI overrides (custom logo). When the
|
||||
/// operator hasn't uploaded anything, the WebUI serves the bundled
|
||||
/// rainbow-horizon mark.
|
||||
pub branding: BrandingStore,
|
||||
/// Forms-auth admin record + first-run bootstrap state. When
|
||||
/// `admin.is_configured() == false`, the auth middleware passes
|
||||
/// every request through and `/api/me` reports `setup_required`.
|
||||
pub admin: AdminStore,
|
||||
/// In-memory session table for active operator logins. Cleared on
|
||||
/// process restart (sessions are tied to UI state, not persisted —
|
||||
/// matches Sonarr/Radarr behaviour).
|
||||
pub sessions: SessionStore,
|
||||
/// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
|
||||
pub sso: SsoStore,
|
||||
/// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
|
||||
/// (for InResponseTo correlation), consumed-assertion replay guard, and
|
||||
/// a cache of fetched IdP metadata. Tied to process lifetime, like
|
||||
/// `sessions`; a restart simply invalidates any in-flight SSO login.
|
||||
pub saml: SamlRuntime,
|
||||
/// v0.5.0: webhook / email notification config (Slack/Teams/Discord/
|
||||
/// SMTP). Drives the fire-and-forget pings on boot events and powers
|
||||
/// the Advanced tab's config + "Send test" button.
|
||||
pub notify: NotifyStore,
|
||||
/// Lock-free metrics counters surfaced at `/metrics` in Prometheus
|
||||
/// text format. Cheap to clone (handles to atomics).
|
||||
pub metrics: Metrics,
|
||||
@@ -53,24 +26,11 @@ pub struct AppState {
|
||||
/// `smb_dir` at startup; `None` in pure-Linux-only deployments where
|
||||
/// Windows support is not wired in. Settings toggle drives start/stop.
|
||||
pub smb: Option<Arc<SmbManager>>,
|
||||
/// v0.4.65: SMB share manager — userspace consumer of remote SMB
|
||||
/// shares via Samba's `smbclient` CLI. Replaces the kernel-mount
|
||||
/// NFS path that v0.4.64 shipped; that path didn't work on hosts
|
||||
/// (Unraid, etc.) whose kernel ships without the nfs/cifs client
|
||||
/// modules, and no container-side configuration could fix it.
|
||||
/// `smbclient` does the SMB protocol over a plain TCP socket in
|
||||
/// userspace — works in any container, no special caps required.
|
||||
pub smb_shares: SmbShareManager,
|
||||
/// v0.4.67: NFSv3 share manager — pure-Rust userspace consumer
|
||||
/// via the `nfs3_client` crate. Ships alongside the SMB manager
|
||||
/// so operators pick whichever protocol their NAS prefers.
|
||||
/// In-process (no subprocess); supports HTTP Range requests on
|
||||
/// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
|
||||
pub nfs_shares: NfsShareManager,
|
||||
/// Browser chunked upload state. Multipart uploads still go straight
|
||||
/// through `IsoStore`, but the UI uses sessions so large ISO transfers
|
||||
/// can show deterministic progress and leave visible partial files.
|
||||
pub uploads: UploadSessions,
|
||||
/// NFS share manager. Always present (mounting is opt-in by the
|
||||
/// operator from the Storage tab); `add()` requires `mount.nfs` to be
|
||||
/// available in the runtime image. Surfaces errors per-mount rather
|
||||
/// than failing the global state.
|
||||
pub nfs: NfsManager,
|
||||
/// Live log bus consumed by the Terminal tab via SSE. Operator-issued
|
||||
/// terminal commands also push synthetic lines onto it so the tail
|
||||
/// shows them inline.
|
||||
|
||||
+56
-186
@@ -88,14 +88,8 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
|
||||
"isos" | "images" => Ok(isos_text(state)),
|
||||
"clients" => Ok(clients_text(state)),
|
||||
"queue" => queue_command(state, tail).await,
|
||||
// `smb` controls the outbound Samba server for Windows
|
||||
// install media. `share` lists/manages remote SMB shares
|
||||
// OpenPXE pulls ISOs from (v0.4.65). `nfs` is the parallel
|
||||
// command for remote NFSv3 shares (v0.4.67, in-process via
|
||||
// nfs3_client — not the v0.4.64 kernel-mount path).
|
||||
"share" | "smb-share" => smb_share_command(state, tail).await,
|
||||
"nfs" => nfs_command(state, tail).await,
|
||||
"smb" => smb_command(state, tail).await,
|
||||
"nfs" => nfs_share_command(state, tail).await,
|
||||
"log" => log_command(state, tail),
|
||||
"whoami" => Ok("operator".to_string()),
|
||||
"echo" => Ok(tail.join(" ")),
|
||||
@@ -113,22 +107,18 @@ fn status_text(s: &AppState) -> String {
|
||||
let clients = s.clients.list();
|
||||
let queue_entries = s.queue.list();
|
||||
let smb = s.smb.as_ref().map(|m| m.snapshot());
|
||||
let smb_shares = s.smb_shares.list();
|
||||
let smb_reachable = smb_shares.iter().filter(|m| m.reachable).count();
|
||||
// v0.4.67: NFSv3 sources too.
|
||||
let nfs_shares = s.nfs_shares.list();
|
||||
let nfs_reachable = nfs_shares.iter().filter(|m| m.reachable).count();
|
||||
let nfs = s.nfs.list();
|
||||
let nfs_active = nfs.iter().filter(|m| m.mounted).count();
|
||||
format!(
|
||||
"OpenPXE {ver}\n\
|
||||
base url: {base}\n\
|
||||
interface: {nic}\n\
|
||||
uptime: {up}\n\
|
||||
isos: {n_isos} (local: {n_local}, smb: {n_smb}, nfs: {n_nfs})\n\
|
||||
isos: {n_isos} (local: {n_local}, nfs: {n_nfs})\n\
|
||||
clients: {n_clients}\n\
|
||||
queue: {n_entries}\n\
|
||||
smb server: {smb}\n\
|
||||
smb shares: {n_smb_total} configured ({n_smb_active} reachable)\n\
|
||||
nfs shares: {n_nfs_total} configured ({n_nfs_active} reachable)\n",
|
||||
smb: {smb}\n\
|
||||
nfs mounts: {n_total} configured ({n_active} active)\n",
|
||||
ver = env!("CARGO_PKG_VERSION"),
|
||||
base = s.public_base_url,
|
||||
nic = if s.nic_name.is_empty() {
|
||||
@@ -142,21 +132,15 @@ fn status_text(s: &AppState) -> String {
|
||||
.iter()
|
||||
.filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
|
||||
.count(),
|
||||
n_smb = isos
|
||||
.iter()
|
||||
.filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Smb { .. }))
|
||||
.count(),
|
||||
n_nfs = isos
|
||||
.iter()
|
||||
.filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Nfs { .. }))
|
||||
.filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
|
||||
.count(),
|
||||
n_clients = clients.len(),
|
||||
n_entries = queue_entries.len(),
|
||||
smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
|
||||
n_smb_total = smb_shares.len(),
|
||||
n_smb_active = smb_reachable,
|
||||
n_nfs_total = nfs_shares.len(),
|
||||
n_nfs_active = nfs_reachable,
|
||||
n_total = nfs.len(),
|
||||
n_active = nfs_active,
|
||||
)
|
||||
}
|
||||
|
||||
@@ -174,9 +158,7 @@ fn isos_text(s: &AppState) -> String {
|
||||
for i in isos {
|
||||
let src = match i.source {
|
||||
openpxe_iso_store::IsoSource::Local => "local".to_string(),
|
||||
openpxe_iso_store::IsoSource::Smb { share_id, .. } => format!("smb:{share_id}"),
|
||||
// v0.4.67: NFSv3 via in-process nfs3_client.
|
||||
openpxe_iso_store::IsoSource::Nfs { share_id, .. } => format!("nfs:{share_id}"),
|
||||
openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
|
||||
};
|
||||
let _ = writeln!(
|
||||
out,
|
||||
@@ -282,136 +264,31 @@ async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String>
|
||||
}
|
||||
}
|
||||
|
||||
// ── share (v0.4.65: SMB shares) ─────────────────────────────────────────
|
||||
// ── nfs ────────────────────────────────────────────────────────────────
|
||||
|
||||
async fn smb_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
|
||||
async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
|
||||
match args.first().map(String::as_str) {
|
||||
None | Some("list") => {
|
||||
let shares = s.smb_shares.list();
|
||||
if shares.is_empty() {
|
||||
return Ok("(no SMB shares configured)".into());
|
||||
let mounts = s.nfs.list();
|
||||
if mounts.is_empty() {
|
||||
return Ok("(no NFS mounts configured)".into());
|
||||
}
|
||||
let mut out = String::new();
|
||||
let _ = writeln!(
|
||||
out,
|
||||
"{:<24} {:<7} {:<6} {:<6} TARGET",
|
||||
"ID", "STATUS", "AUTH", "ISOS"
|
||||
"{:<24} {:<6} {:<7} {:<6} TARGET",
|
||||
"ID", "VER", "STATUS", "ISOS"
|
||||
);
|
||||
for m in shares {
|
||||
let status = if m.reachable { "ok" } else { "down" };
|
||||
let auth = if m.guest { "guest" } else { "user" };
|
||||
for m in mounts {
|
||||
let status = if m.mounted { "ok" } else { "down" };
|
||||
let _ = writeln!(
|
||||
out,
|
||||
"{:<24} {:<7} {:<6} {:<6} //{}/{}",
|
||||
truncate(&m.id, 24),
|
||||
status,
|
||||
auth,
|
||||
m.iso_count,
|
||||
m.server,
|
||||
m.share,
|
||||
);
|
||||
if let Some(e) = m.last_error {
|
||||
let _ = writeln!(out, " error: {e}");
|
||||
}
|
||||
if let Some(h) = m.last_hint {
|
||||
let _ = writeln!(out, " hint: {h}");
|
||||
}
|
||||
}
|
||||
Ok(out)
|
||||
}
|
||||
Some("add") => {
|
||||
// share add //server/share [guest|user:password]
|
||||
let target = args
|
||||
.get(1)
|
||||
.ok_or_else(|| {
|
||||
"usage: share add //server/share [guest|user:password]".to_string()
|
||||
})?;
|
||||
// Accept either `//server/share` (UNC-style) or
|
||||
// `server:share` (shorter to type).
|
||||
let stripped = target.trim_start_matches('/').trim_start_matches('\\');
|
||||
let (server, share) = if let Some((s, p)) = stripped.split_once('/') {
|
||||
(s, p)
|
||||
} else if let Some((s, p)) = stripped.split_once(':') {
|
||||
(s, p)
|
||||
} else {
|
||||
return Err("target must be '//server/share' or 'server:share'".into());
|
||||
};
|
||||
|
||||
// Auth spec: "guest" or "user:password". Default: guest.
|
||||
let auth = args.get(2).cloned().unwrap_or_else(|| "guest".into());
|
||||
let (guest, username, password) = if auth == "guest" {
|
||||
(true, None, None)
|
||||
} else if let Some((u, p)) = auth.split_once(':') {
|
||||
(false, Some(u.to_string()), Some(p.to_string()))
|
||||
} else {
|
||||
return Err("auth must be 'guest' or 'user:password'".into());
|
||||
};
|
||||
|
||||
let req = openpxe_iso_store::SmbAddRequest {
|
||||
server: server.to_string(),
|
||||
share: share.to_string(),
|
||||
username,
|
||||
password,
|
||||
guest,
|
||||
port: None,
|
||||
};
|
||||
match s.smb_shares.add(req).await {
|
||||
Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
|
||||
Err(e) => {
|
||||
let mut out = format!("add failed: {}", e.error);
|
||||
if let Some(h) = e.hint {
|
||||
out.push_str("\nhint: ");
|
||||
out.push_str(&h);
|
||||
}
|
||||
Err(out)
|
||||
}
|
||||
}
|
||||
}
|
||||
Some("remove") => {
|
||||
let id = args
|
||||
.get(1)
|
||||
.ok_or_else(|| "usage: share remove <id>".to_string())?;
|
||||
match s.smb_shares.remove(id).await {
|
||||
Ok(()) => Ok(format!("removed {id}")),
|
||||
Err(e) => Err(format!("remove failed: {e}")),
|
||||
}
|
||||
}
|
||||
Some("scan") => {
|
||||
let id = args
|
||||
.get(1)
|
||||
.ok_or_else(|| "usage: share scan <id>".to_string())?;
|
||||
match s.smb_shares.rescan(id).await {
|
||||
Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
|
||||
Err(e) => Err(format!("scan failed: {e}")),
|
||||
}
|
||||
}
|
||||
Some(other) => Err(format!(
|
||||
"unknown share subcommand: {other}\ntry: share [list|add|remove|scan]"
|
||||
)),
|
||||
}
|
||||
}
|
||||
|
||||
// ── nfs (v0.4.67: in-process NFSv3 via nfs3_client) ────────────────────
|
||||
|
||||
async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, String> {
|
||||
match args.first().map(String::as_str) {
|
||||
None | Some("list") => {
|
||||
let shares = s.nfs_shares.list();
|
||||
if shares.is_empty() {
|
||||
return Ok("(no NFS shares configured)".into());
|
||||
}
|
||||
let mut out = String::new();
|
||||
let _ = writeln!(
|
||||
out,
|
||||
"{:<24} {:<7} {:<6} TARGET",
|
||||
"ID", "STATUS", "ISOS"
|
||||
);
|
||||
for m in shares {
|
||||
let status = if m.reachable { "ok" } else { "down" };
|
||||
let _ = writeln!(
|
||||
out,
|
||||
"{:<24} {:<7} {:<6} {}:{}",
|
||||
"{:<24} {:<6} {:<7} {:<6} {}:{}",
|
||||
truncate(&m.id, 24),
|
||||
match m.version {
|
||||
openpxe_iso_store::NfsVersion::V3 => "v3",
|
||||
openpxe_iso_store::NfsVersion::V41 => "v4.1",
|
||||
},
|
||||
status,
|
||||
m.iso_count,
|
||||
m.server,
|
||||
@@ -420,58 +297,56 @@ async fn nfs_share_command(s: &AppState, args: &[String]) -> Result<String, Stri
|
||||
if let Some(e) = m.last_error {
|
||||
let _ = writeln!(out, " error: {e}");
|
||||
}
|
||||
if let Some(h) = m.last_hint {
|
||||
let _ = writeln!(out, " hint: {h}");
|
||||
}
|
||||
}
|
||||
Ok(out)
|
||||
}
|
||||
Some("add") => {
|
||||
// nfs add <server>:<export> [port]
|
||||
Some("mount") => {
|
||||
// nfs mount <server>:<export> [v3|v41] [ro|rw]
|
||||
let target = args
|
||||
.get(1)
|
||||
.ok_or_else(|| "usage: nfs add <server>:<export> [port]".to_string())?;
|
||||
.ok_or_else(|| "usage: nfs mount <server>:<export> [v3|v41] [ro|rw]".to_string())?;
|
||||
let (server, export) = target
|
||||
.split_once(':')
|
||||
.ok_or_else(|| "target must be 'server:/export'".to_string())?;
|
||||
let port = args.get(2).and_then(|s| s.parse::<u16>().ok());
|
||||
let version = match args.get(2).map(String::as_str) {
|
||||
Some("v3") => openpxe_iso_store::NfsVersion::V3,
|
||||
Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
|
||||
Some(other) => {
|
||||
return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
|
||||
}
|
||||
};
|
||||
let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
|
||||
let req = openpxe_iso_store::NfsAddRequest {
|
||||
server: server.to_string(),
|
||||
export: export.to_string(),
|
||||
port,
|
||||
version,
|
||||
read_only,
|
||||
};
|
||||
match s.nfs_shares.add(req).await {
|
||||
Ok(m) => Ok(format!("added {} ({} isos)", m.id, m.iso_count)),
|
||||
Err(e) => {
|
||||
let mut out = format!("add failed: {}", e.error);
|
||||
if let Some(h) = e.hint {
|
||||
out.push_str("\nhint: ");
|
||||
out.push_str(&h);
|
||||
}
|
||||
Err(out)
|
||||
}
|
||||
match s.nfs.add(req).await {
|
||||
Ok(m) => Ok(format!("mounted {} ({} isos)", m.id, m.iso_count)),
|
||||
Err(e) => Err(format!("mount failed: {e}")),
|
||||
}
|
||||
}
|
||||
Some("remove") => {
|
||||
Some("unmount") => {
|
||||
let id = args
|
||||
.get(1)
|
||||
.ok_or_else(|| "usage: nfs remove <id>".to_string())?;
|
||||
match s.nfs_shares.remove(id).await {
|
||||
Ok(()) => Ok(format!("removed {id}")),
|
||||
Err(e) => Err(format!("remove failed: {e}")),
|
||||
.ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
|
||||
match s.nfs.remove(id).await {
|
||||
Ok(()) => Ok(format!("unmounted {id}")),
|
||||
Err(e) => Err(format!("unmount failed: {e}")),
|
||||
}
|
||||
}
|
||||
Some("scan") => {
|
||||
let id = args
|
||||
.get(1)
|
||||
.ok_or_else(|| "usage: nfs scan <id>".to_string())?;
|
||||
match s.nfs_shares.rescan(id).await {
|
||||
match s.nfs.rescan(id).await {
|
||||
Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
|
||||
Err(e) => Err(format!("scan failed: {e}")),
|
||||
}
|
||||
}
|
||||
Some(other) => Err(format!(
|
||||
"unknown nfs subcommand: {other}\ntry: nfs [list|add|remove|scan]"
|
||||
"unknown nfs subcommand: {other}\ntry: nfs [list|mount|unmount|scan]"
|
||||
)),
|
||||
}
|
||||
}
|
||||
@@ -612,18 +487,13 @@ OpenPXE terminal — available commands:
|
||||
queue assign-all <target> assign every waiting client
|
||||
queue release <entry_id> release one queued client
|
||||
|
||||
share list list configured SMB shares
|
||||
share add //srv/share [auth] add an SMB share; auth = 'guest' or 'user:pass'
|
||||
share remove <id> forget an SMB share
|
||||
share scan <id> re-list a share for new ISOs
|
||||
nfs list list NFS mounts
|
||||
nfs mount <s>:<e> [v3|v41] [ro|rw] add and mount an NFS share
|
||||
nfs unmount <id> unmount and forget a share
|
||||
nfs scan <id> re-scan a share for new ISOs
|
||||
|
||||
nfs list list configured NFSv3 shares
|
||||
nfs add <srv>:<export> [port] add an NFSv3 share
|
||||
nfs remove <id> forget an NFS share
|
||||
nfs scan <id> re-list an NFS share for new ISOs
|
||||
|
||||
smb status outbound Samba state (Windows install media)
|
||||
smb start | stop | reload control the outbound smbd
|
||||
smb status SMB (Samba) state
|
||||
smb start | stop | reload control smbd
|
||||
|
||||
log clear drop the in-memory log ring buffer
|
||||
log tail [n] show the last n buffered lines (default 20)
|
||||
@@ -638,10 +508,10 @@ mod tests {
|
||||
#[test]
|
||||
fn shell_split_basic() {
|
||||
assert_eq!(shell_split(""), Vec::<String>::new());
|
||||
assert_eq!(shell_split("share list"), vec!["share", "list"]);
|
||||
assert_eq!(shell_split("nfs list"), vec!["nfs", "list"]);
|
||||
assert_eq!(
|
||||
shell_split("share add //nas/isos guest"),
|
||||
vec!["share", "add", "//nas/isos", "guest"]
|
||||
shell_split("nfs mount 10.0.0.5:/srv v41 ro"),
|
||||
vec!["nfs", "mount", "10.0.0.5:/srv", "v41", "ro"]
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
@@ -1,180 +0,0 @@
|
||||
//! Chunked upload sessions for browser-driven ISO uploads.
|
||||
//!
|
||||
//! The legacy multipart endpoint still exists for simple API clients, but
|
||||
//! browsers get a better failure mode with raw chunks: progress advances after
|
||||
//! each acknowledged write, partial files appear in the ISO directory
|
||||
//! immediately, and reverse proxies are less likely to buffer an entire DVD
|
||||
//! image before OpenPXE sees byte one.
|
||||
|
||||
use bytes::Bytes;
|
||||
use openpxe_core::{Error, Result};
|
||||
use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
|
||||
use serde::Serialize;
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
use tokio::sync::Mutex;
|
||||
use uuid::Uuid;
|
||||
|
||||
const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
|
||||
|
||||
#[derive(Clone, Default)]
|
||||
pub struct UploadSessions {
|
||||
inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
|
||||
}
|
||||
|
||||
struct UploadSession {
|
||||
filename: String,
|
||||
expected_size: Option<u64>,
|
||||
offset: u64,
|
||||
handle: Option<UploadHandle>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct UploadStarted {
|
||||
pub upload_id: String,
|
||||
pub iso_id: String,
|
||||
pub filename: String,
|
||||
pub offset: u64,
|
||||
pub chunk_size: u64,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub enum UploadAppend {
|
||||
Progress { offset: u64 },
|
||||
Complete { offset: u64, iso: Box<IsoMeta> },
|
||||
}
|
||||
|
||||
impl UploadSessions {
|
||||
pub async fn begin(
|
||||
&self,
|
||||
store: &IsoStore,
|
||||
filename: &str,
|
||||
expected_size: Option<u64>,
|
||||
) -> Result<UploadStarted> {
|
||||
if !filename.to_ascii_lowercase().ends_with(".iso") {
|
||||
return Err(Error::Invalid("only .iso uploads accepted".to_string()));
|
||||
}
|
||||
|
||||
let handle = store.begin_upload(filename).await?;
|
||||
let iso_id = handle.id.clone();
|
||||
let upload_id = Uuid::new_v4().to_string();
|
||||
let session = UploadSession {
|
||||
filename: filename.to_string(),
|
||||
expected_size,
|
||||
offset: 0,
|
||||
handle: Some(handle),
|
||||
};
|
||||
|
||||
self.inner
|
||||
.lock()
|
||||
.await
|
||||
.insert(upload_id.clone(), Arc::new(Mutex::new(session)));
|
||||
|
||||
Ok(UploadStarted {
|
||||
upload_id,
|
||||
iso_id,
|
||||
filename: filename.to_string(),
|
||||
offset: 0,
|
||||
chunk_size: DEFAULT_CHUNK_SIZE,
|
||||
})
|
||||
}
|
||||
|
||||
pub async fn append(
|
||||
&self,
|
||||
store: &IsoStore,
|
||||
upload_id: &str,
|
||||
offset: u64,
|
||||
chunk: Bytes,
|
||||
complete: bool,
|
||||
) -> Result<UploadAppend> {
|
||||
let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
|
||||
return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
|
||||
};
|
||||
|
||||
let mut session = session_lock.lock().await;
|
||||
if session.offset != offset {
|
||||
return Err(Error::Invalid(format!(
|
||||
"expected offset {}, got {offset}",
|
||||
session.offset
|
||||
)));
|
||||
}
|
||||
|
||||
let new_offset = session
|
||||
.offset
|
||||
.checked_add(chunk.len() as u64)
|
||||
.ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
|
||||
|
||||
if let Some(expected) = session.expected_size {
|
||||
if new_offset > expected {
|
||||
return Err(Error::Invalid(format!(
|
||||
"chunk exceeds declared upload size {expected}"
|
||||
)));
|
||||
}
|
||||
}
|
||||
|
||||
let Some(handle) = session.handle.as_mut() else {
|
||||
return Err(Error::Invalid("upload already completed".to_string()));
|
||||
};
|
||||
if let Err(e) = handle.write_chunk(&chunk).await {
|
||||
let handle = session.handle.take();
|
||||
drop(session);
|
||||
self.inner.lock().await.remove(upload_id);
|
||||
if let Some(handle) = handle {
|
||||
let _ = handle.abort().await;
|
||||
}
|
||||
return Err(e);
|
||||
}
|
||||
|
||||
session.offset = new_offset;
|
||||
if !complete {
|
||||
return Ok(UploadAppend::Progress { offset: new_offset });
|
||||
}
|
||||
|
||||
if let Some(expected) = session.expected_size {
|
||||
if new_offset != expected {
|
||||
return Err(Error::Invalid(format!(
|
||||
"final chunk ended at {new_offset}, expected {expected}"
|
||||
)));
|
||||
}
|
||||
}
|
||||
|
||||
let Some(handle) = session.handle.take() else {
|
||||
return Err(Error::Invalid("upload already completed".to_string()));
|
||||
};
|
||||
let filename = session.filename.clone();
|
||||
drop(session);
|
||||
|
||||
tracing::info!(
|
||||
target: "openpxe::http::upload",
|
||||
upload_id,
|
||||
filename = %filename,
|
||||
received_bytes = new_offset,
|
||||
"chunked upload body complete; introspecting"
|
||||
);
|
||||
|
||||
let meta = match handle.finish(store).await {
|
||||
Ok(meta) => meta,
|
||||
Err(e) => {
|
||||
self.inner.lock().await.remove(upload_id);
|
||||
return Err(e);
|
||||
}
|
||||
};
|
||||
self.inner.lock().await.remove(upload_id);
|
||||
Ok(UploadAppend::Complete {
|
||||
offset: new_offset,
|
||||
iso: Box::new(meta),
|
||||
})
|
||||
}
|
||||
|
||||
pub async fn abort(&self, upload_id: &str) -> Result<()> {
|
||||
let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
|
||||
return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
|
||||
};
|
||||
let mut session = session_lock.lock().await;
|
||||
if let Some(handle) = session.handle.take() {
|
||||
handle.abort().await?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
+20
-1278
File diff suppressed because it is too large
Load Diff
@@ -27,21 +27,6 @@ parking_lot.workspace = true
|
||||
bytes.workspace = true
|
||||
tempfile = "3.12"
|
||||
libc = "0.2"
|
||||
# v0.4.61: server-side compose of the operator's uploaded raster into a
|
||||
# fixed 1024x768 canvas so the PXE menu always gets a consistently-sized
|
||||
# PNG regardless of what the operator uploaded. We use the bare-bones
|
||||
# `image` crate (no default features) and explicitly enable only the
|
||||
# decoders we accept on upload (PNG/JPEG/WebP/GIF) plus the PNG
|
||||
# encoder. Keeps the build slim — no JPEG2000, TIFF, BMP, etc.
|
||||
image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif"] }
|
||||
|
||||
# v0.4.67: pure-Rust NFSv3 client for reading remote ISOs without a
|
||||
# kernel mount. See crates/iso-store/src/nfs_share.rs for usage.
|
||||
nfs3_client = { workspace = true }
|
||||
nfs3_types = { workspace = true }
|
||||
# Needed for the Stream trait that wraps the mpsc receiver feeding
|
||||
# NFS read-loop bytes into axum's Body::from_stream.
|
||||
futures = { workspace = true }
|
||||
|
||||
[dev-dependencies]
|
||||
tempfile = "3.12"
|
||||
|
||||
@@ -18,29 +18,16 @@
|
||||
|
||||
pub mod entry;
|
||||
pub mod introspect;
|
||||
pub mod nfs_share;
|
||||
pub mod pxe_logo;
|
||||
pub mod nfs;
|
||||
pub mod smb;
|
||||
pub mod smb_share;
|
||||
pub mod store;
|
||||
pub mod windows;
|
||||
|
||||
pub use entry::{BootEntry, BootKind, KernelArgs};
|
||||
pub use introspect::{DistroFamily, IntrospectionReport};
|
||||
// v0.4.65: kernel-mount NFS is gone. SMB shares via Samba's userspace
|
||||
// `smbclient` CLI replaced it — works in any container (no
|
||||
// CAP_SYS_ADMIN, no host kernel modules), matching how Bootimus and
|
||||
// every other PXE/imaging tool that supports network storage handles
|
||||
// it.
|
||||
pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
|
||||
pub use smb::{extract_windows_iso, SmbManager, SmbState};
|
||||
pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, SmbStream};
|
||||
// v0.4.67: NFS is back — this time as an in-process userspace NFSv3
|
||||
// client (the `nfs3_client` crate) rather than a kernel mount. Same
|
||||
// "works in any container" property as SMB, plus support for HTTP
|
||||
// Range requests because NFSv3 READ3 takes an explicit offset.
|
||||
pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
|
||||
pub use store::{
|
||||
generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
|
||||
UploadHandle,
|
||||
generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle,
|
||||
};
|
||||
pub use windows::{WimPatcher, WinPatchState};
|
||||
|
||||
@@ -0,0 +1,558 @@
|
||||
//! NFS share manager.
|
||||
//!
|
||||
//! Lets an operator mount a remote NFS export as an ISO source instead of
|
||||
//! uploading every ISO into the container's PVC. Supports NFSv3 and
|
||||
//! NFSv4.1 — the two versions the user explicitly asked for.
|
||||
//!
|
||||
//! ## How it works
|
||||
//!
|
||||
//! 1. Operator submits a mount spec via the Storage tab:
|
||||
//! `{ server: "10.0.0.20", export: "/srv/isos", version: "v41" }`.
|
||||
//! 2. We slugify a stable id, mkdir `<work_dir>/nfs/<id>/`, then shell out
|
||||
//! to `/bin/mount -t nfs -o vers=...,ro,nolock server:export local`.
|
||||
//! 3. On success we walk the mount point looking for `*.iso` files and
|
||||
//! register each one with the `IsoStore` as an external source — same
|
||||
//! introspection pipeline as a web upload, but no sha256 (the bytes
|
||||
//! live on a remote machine; hashing them would suck them through the
|
||||
//! network on every restart).
|
||||
//! 4. On failure we record `last_error` on the spec and persist anyway
|
||||
//! so the UI can show a row in red rather than silently dropping it.
|
||||
//!
|
||||
//! ## Operational notes
|
||||
//!
|
||||
//! - Mounting NFS inside a container needs `CAP_SYS_ADMIN` and the
|
||||
//! `nfs-common` package. The default image ships these (see Dockerfile).
|
||||
//! - On OpenShift, the SCC must allow `CAP_SYS_ADMIN`. The bundled SCC
|
||||
//! doesn't — operators have to opt in by switching to a more privileged
|
||||
//! SCC or running NFS mounts as a CSI driver outside the pod.
|
||||
//! - Mount commands are issued sequentially under a single mutex to avoid
|
||||
//! `mount` racing on the same target dir.
|
||||
//!
|
||||
//! ## Persistence
|
||||
//!
|
||||
//! Mount specs (without runtime state) live at `<work_dir>/nfs.json`,
|
||||
//! re-mounted on startup. Mounts that fail to come back online keep their
|
||||
//! spec and their `last_error` so the operator sees what happened.
|
||||
|
||||
use crate::introspect::{introspect, IntrospectionReport};
|
||||
use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
|
||||
use openpxe_core::{Error, Result};
|
||||
use parking_lot::Mutex;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::collections::HashMap;
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::sync::Arc;
|
||||
use time::OffsetDateTime;
|
||||
use tokio::process::Command;
|
||||
|
||||
/// Wire-protocol versions we support. Keep this enum closed — silently
|
||||
/// accepting "auto" or letting the kernel negotiate would mean operators
|
||||
/// could never confirm which version is in use.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "lowercase")]
|
||||
pub enum NfsVersion {
|
||||
/// NFSv3 — UDP/TCP, separate `mountd` protocol. Required for many
|
||||
/// older NAS appliances.
|
||||
V3,
|
||||
/// NFSv4.1 — single TCP port (2049), session-based. Modern default.
|
||||
V41,
|
||||
}
|
||||
|
||||
impl NfsVersion {
|
||||
fn vers_arg(self) -> &'static str {
|
||||
match self {
|
||||
Self::V3 => "vers=3",
|
||||
Self::V41 => "vers=4.1",
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// One configured mount. The id is generated from server+export so the
|
||||
/// operator can re-add the same export idempotently.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct NfsMount {
|
||||
pub id: String,
|
||||
pub server: String,
|
||||
pub export: String,
|
||||
pub version: NfsVersion,
|
||||
/// Read-only by default — most ISO libraries are. Operators that need
|
||||
/// write can flip this off but OpenPXE itself never writes.
|
||||
pub read_only: bool,
|
||||
/// Local mount point under `<work_dir>/nfs/`.
|
||||
pub local_path: PathBuf,
|
||||
/// Whether the mount is currently active.
|
||||
pub mounted: bool,
|
||||
/// Last error encountered on a `mount` or `umount` attempt; cleared on
|
||||
/// success.
|
||||
pub last_error: Option<String>,
|
||||
#[serde(with = "time::serde::rfc3339::option")]
|
||||
pub last_attempt: Option<OffsetDateTime>,
|
||||
/// Number of `.iso` files found on the share (re-counted on each scan).
|
||||
pub iso_count: u32,
|
||||
}
|
||||
|
||||
/// Spec submitted by the UI. Server and export are normalized before use.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct NfsAddRequest {
|
||||
pub server: String,
|
||||
pub export: String,
|
||||
#[serde(default = "default_version")]
|
||||
pub version: NfsVersion,
|
||||
#[serde(default = "default_ro")]
|
||||
pub read_only: bool,
|
||||
}
|
||||
|
||||
fn default_version() -> NfsVersion {
|
||||
NfsVersion::V41
|
||||
}
|
||||
fn default_ro() -> bool {
|
||||
true
|
||||
}
|
||||
|
||||
#[derive(Debug, Default)]
|
||||
struct Inner {
|
||||
mounts: HashMap<String, NfsMount>,
|
||||
}
|
||||
|
||||
/// Manages NFS mounts and surfaces them as ISO sources.
|
||||
///
|
||||
/// Cheap to clone — internal state is `Arc<Mutex<...>>`.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct NfsManager {
|
||||
work_root: Arc<PathBuf>,
|
||||
state_path: Arc<PathBuf>,
|
||||
inner: Arc<Mutex<Inner>>,
|
||||
iso_store: IsoStore,
|
||||
/// Single-writer lock around the actual `mount`/`umount` shell-outs;
|
||||
/// avoids racing on the same target directory.
|
||||
mount_lock: Arc<tokio::sync::Mutex<()>>,
|
||||
}
|
||||
|
||||
impl NfsManager {
|
||||
/// Construct a manager rooted at `work_dir`. Mount points live under
|
||||
/// `<work_dir>/nfs/<id>/`. State persists to `<work_dir>/nfs.json`.
|
||||
#[must_use]
|
||||
pub fn new(work_dir: &Path, iso_store: IsoStore) -> Self {
|
||||
let work_root = work_dir.join("nfs");
|
||||
let state_path = work_dir.join("nfs.json");
|
||||
Self {
|
||||
work_root: Arc::new(work_root),
|
||||
state_path: Arc::new(state_path),
|
||||
inner: Arc::new(Mutex::new(Inner::default())),
|
||||
iso_store,
|
||||
mount_lock: Arc::new(tokio::sync::Mutex::new(())),
|
||||
}
|
||||
}
|
||||
|
||||
/// Where this manager mounts shares. Used by `IsoStore` to resolve
|
||||
/// NFS-backed `IsoMeta`s to their on-disk path.
|
||||
#[must_use]
|
||||
pub fn mount_root(&self) -> PathBuf {
|
||||
self.work_root.as_ref().clone()
|
||||
}
|
||||
|
||||
/// Load persisted state and re-attempt every mount. Errors are logged
|
||||
/// per-mount but never fail the call — startup must not block on a
|
||||
/// remote NFS server being slow.
|
||||
pub async fn load_and_remount(&self) -> Result<()> {
|
||||
tokio::fs::create_dir_all(self.work_root.as_path()).await?;
|
||||
let mounts = match tokio::fs::read_to_string(self.state_path.as_path()).await {
|
||||
Ok(text) => serde_json::from_str::<Vec<NfsMount>>(&text).unwrap_or_default(),
|
||||
Err(_) => Vec::new(),
|
||||
};
|
||||
for mut m in mounts {
|
||||
// Always start from "not mounted" — the kernel state was lost
|
||||
// when the process died. We'll try to remount each one.
|
||||
m.mounted = false;
|
||||
m.last_error = None;
|
||||
self.inner.lock().mounts.insert(m.id.clone(), m.clone());
|
||||
if let Err(e) = self.try_mount(&m.id).await {
|
||||
tracing::warn!(
|
||||
target: "openpxe::nfs",
|
||||
id = %m.id, error = %e,
|
||||
"could not remount NFS share on startup"
|
||||
);
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Add a new mount. Returns the resulting `NfsMount` (with `mounted`
|
||||
/// reflecting reality) or an error if the spec was invalid.
|
||||
pub async fn add(&self, req: NfsAddRequest) -> Result<NfsMount> {
|
||||
let server = req.server.trim().to_string();
|
||||
let export = req.export.trim().to_string();
|
||||
if server.is_empty() {
|
||||
return Err(Error::Invalid("server is required".into()));
|
||||
}
|
||||
if !export.starts_with('/') {
|
||||
return Err(Error::Invalid("export path must start with '/'".into()));
|
||||
}
|
||||
|
||||
let id = mount_id(&server, &export);
|
||||
let local_path = self.work_root.join(&id);
|
||||
tokio::fs::create_dir_all(&local_path).await?;
|
||||
|
||||
let mount = NfsMount {
|
||||
id: id.clone(),
|
||||
server,
|
||||
export,
|
||||
version: req.version,
|
||||
read_only: req.read_only,
|
||||
local_path,
|
||||
mounted: false,
|
||||
last_error: None,
|
||||
last_attempt: None,
|
||||
iso_count: 0,
|
||||
};
|
||||
self.inner.lock().mounts.insert(id.clone(), mount);
|
||||
self.persist_locked();
|
||||
self.try_mount(&id).await?;
|
||||
Ok(self.get(&id).expect("mount just inserted"))
|
||||
}
|
||||
|
||||
/// Unmount and forget a share. Removes any ISOs it contributed from
|
||||
/// the IsoStore and deletes the local mount point. Idempotent.
|
||||
pub async fn remove(&self, id: &str) -> Result<()> {
|
||||
// Best-effort umount; even if it fails (e.g. server unreachable)
|
||||
// we still want to drop the in-memory record.
|
||||
let _ = self.umount_one(id).await;
|
||||
let local_path = {
|
||||
let mut g = self.inner.lock();
|
||||
g.mounts.remove(id).map(|m| m.local_path)
|
||||
};
|
||||
self.persist_locked();
|
||||
self.iso_store.drop_external_source(id);
|
||||
if let Some(p) = local_path {
|
||||
// rmdir only — never recurse, the mount could still be live
|
||||
// on some kernel error path and we don't want to nuke a
|
||||
// remote filesystem.
|
||||
let _ = tokio::fs::remove_dir(&p).await;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Re-scan a mounted share for ISOs, refreshing the IsoStore.
|
||||
pub async fn rescan(&self, id: &str) -> Result<u32> {
|
||||
let mount = self
|
||||
.get(id)
|
||||
.ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
|
||||
if !mount.mounted {
|
||||
return Err(Error::Invalid(format!("mount '{id}' is not active")));
|
||||
}
|
||||
let count = self.scan_and_register(&mount).await?;
|
||||
if let Some(m) = self.inner.lock().mounts.get_mut(id) {
|
||||
m.iso_count = count;
|
||||
}
|
||||
self.persist_locked();
|
||||
Ok(count)
|
||||
}
|
||||
|
||||
/// Snapshot of every configured mount.
|
||||
#[must_use]
|
||||
pub fn list(&self) -> Vec<NfsMount> {
|
||||
let g = self.inner.lock();
|
||||
let mut v: Vec<_> = g.mounts.values().cloned().collect();
|
||||
v.sort_by(|a, b| a.id.cmp(&b.id));
|
||||
v
|
||||
}
|
||||
|
||||
/// Look up a single mount by id.
|
||||
#[must_use]
|
||||
pub fn get(&self, id: &str) -> Option<NfsMount> {
|
||||
self.inner.lock().mounts.get(id).cloned()
|
||||
}
|
||||
|
||||
// ── internals ─────────────────────────────────────────────────────
|
||||
|
||||
async fn try_mount(&self, id: &str) -> Result<()> {
|
||||
let _g = self.mount_lock.lock().await;
|
||||
|
||||
let m = self
|
||||
.get(id)
|
||||
.ok_or_else(|| Error::Invalid(format!("no such mount '{id}'")))?;
|
||||
let now = OffsetDateTime::now_utc();
|
||||
|
||||
// Already mounted? Skip — `mount` would error on a busy target
|
||||
// and confuse the operator's UI status.
|
||||
if is_mountpoint(&m.local_path).await {
|
||||
self.update_status(id, true, None, now);
|
||||
// Even though already mounted, we still want a fresh ISO count.
|
||||
let count = self.scan_and_register(&m).await.unwrap_or(0);
|
||||
self.update_iso_count(id, count);
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
let opts = mount_options(&m);
|
||||
let target = format!("{}:{}", m.server, m.export);
|
||||
|
||||
let output = Command::new("mount")
|
||||
.arg("-t")
|
||||
.arg("nfs")
|
||||
.arg("-o")
|
||||
.arg(&opts)
|
||||
.arg(&target)
|
||||
.arg(&m.local_path)
|
||||
.output()
|
||||
.await;
|
||||
|
||||
match output {
|
||||
Ok(out) if out.status.success() => {
|
||||
tracing::info!(
|
||||
target: "openpxe::nfs",
|
||||
id = %id, server = %m.server, export = %m.export,
|
||||
version = ?m.version,
|
||||
"NFS mount succeeded"
|
||||
);
|
||||
self.update_status(id, true, None, now);
|
||||
let count = self.scan_and_register(&m).await.unwrap_or(0);
|
||||
self.update_iso_count(id, count);
|
||||
Ok(())
|
||||
}
|
||||
Ok(out) => {
|
||||
let err = format!(
|
||||
"mount exit {}: {}",
|
||||
out.status.code().unwrap_or(-1),
|
||||
String::from_utf8_lossy(&out.stderr).trim()
|
||||
);
|
||||
tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
|
||||
self.update_status(id, false, Some(err.clone()), now);
|
||||
Err(Error::Invalid(err))
|
||||
}
|
||||
Err(e) => {
|
||||
let err = format!("could not exec /bin/mount: {e}");
|
||||
tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
|
||||
self.update_status(id, false, Some(err.clone()), now);
|
||||
Err(Error::Invalid(err))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async fn umount_one(&self, id: &str) -> Result<()> {
|
||||
let _g = self.mount_lock.lock().await;
|
||||
let Some(m) = self.get(id) else { return Ok(()) };
|
||||
if !is_mountpoint(&m.local_path).await {
|
||||
self.update_status(id, false, None, OffsetDateTime::now_utc());
|
||||
return Ok(());
|
||||
}
|
||||
// -l = lazy: detach immediately, finish when no process has a
|
||||
// handle. Important if a stale ISO read is still in flight.
|
||||
let out = Command::new("umount")
|
||||
.arg("-l")
|
||||
.arg(&m.local_path)
|
||||
.output()
|
||||
.await;
|
||||
match out {
|
||||
Ok(o) if o.status.success() => {
|
||||
self.update_status(id, false, None, OffsetDateTime::now_utc());
|
||||
Ok(())
|
||||
}
|
||||
Ok(o) => {
|
||||
let e = format!(
|
||||
"umount exit {}: {}",
|
||||
o.status.code().unwrap_or(-1),
|
||||
String::from_utf8_lossy(&o.stderr).trim()
|
||||
);
|
||||
self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
|
||||
Err(Error::Invalid(e))
|
||||
}
|
||||
Err(e) => {
|
||||
let e = format!("could not exec /bin/umount: {e}");
|
||||
self.update_status(id, false, Some(e.clone()), OffsetDateTime::now_utc());
|
||||
Err(Error::Invalid(e))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Walk the mount point for `*.iso` files, introspect each one, and
|
||||
/// register it with the IsoStore as an NFS-sourced entry. Returns the
|
||||
/// count of ISOs registered.
|
||||
async fn scan_and_register(&self, m: &NfsMount) -> Result<u32> {
|
||||
// Drop any prior entries from this mount before re-registering, so
|
||||
// a removed file disappears from the store.
|
||||
self.iso_store.drop_external_source(&m.id);
|
||||
|
||||
let mut walker = tokio::fs::read_dir(&m.local_path).await?;
|
||||
let mut count = 0u32;
|
||||
while let Some(entry) = walker.next_entry().await? {
|
||||
let p = entry.path();
|
||||
if p.extension()
|
||||
.and_then(|e| e.to_str())
|
||||
.map(str::to_ascii_lowercase)
|
||||
.as_deref()
|
||||
!= Some("iso")
|
||||
{
|
||||
continue;
|
||||
}
|
||||
let filename = match p.file_name().and_then(|s| s.to_str()) {
|
||||
Some(f) => f.to_string(),
|
||||
None => continue,
|
||||
};
|
||||
let size = tokio::fs::metadata(&p).await?.len();
|
||||
// Introspection is sync + IO-bound (reads ISO9660 PVD). Push
|
||||
// it to a blocking thread so the runtime stays responsive on
|
||||
// a slow share.
|
||||
let p_owned = p.clone();
|
||||
let report: IntrospectionReport =
|
||||
tokio::task::spawn_blocking(move || introspect(&p_owned))
|
||||
.await
|
||||
.map_err(|e| Error::Other(e.into()))?;
|
||||
let id = format!("nfs-{}-{}", m.id, slugify_str(&filename));
|
||||
let boot_entries = generate_boot_entries_for(&id, &filename, &report);
|
||||
let source = IsoSource::Nfs {
|
||||
mount_id: m.id.clone(),
|
||||
relative_path: filename.clone(),
|
||||
};
|
||||
self.iso_store
|
||||
.register_external(id, filename, size, report, boot_entries, source);
|
||||
count += 1;
|
||||
}
|
||||
Ok(count)
|
||||
}
|
||||
|
||||
fn update_status(&self, id: &str, mounted: bool, err: Option<String>, ts: OffsetDateTime) {
|
||||
if let Some(m) = self.inner.lock().mounts.get_mut(id) {
|
||||
m.mounted = mounted;
|
||||
m.last_error = err;
|
||||
m.last_attempt = Some(ts);
|
||||
}
|
||||
self.persist_locked();
|
||||
}
|
||||
|
||||
fn update_iso_count(&self, id: &str, count: u32) {
|
||||
if let Some(m) = self.inner.lock().mounts.get_mut(id) {
|
||||
m.iso_count = count;
|
||||
}
|
||||
self.persist_locked();
|
||||
}
|
||||
|
||||
/// Atomically replace the on-disk JSON with the current state.
|
||||
/// Persistence errors are logged, never propagated — settings live in
|
||||
/// memory authoritatively, matching the SettingsStore policy.
|
||||
fn persist_locked(&self) {
|
||||
let mounts: Vec<NfsMount> = self.inner.lock().mounts.values().cloned().collect();
|
||||
let path = self.state_path.as_path();
|
||||
let tmp = path.with_extension("json.tmp");
|
||||
let body = match serde_json::to_vec_pretty(&mounts) {
|
||||
Ok(b) => b,
|
||||
Err(e) => {
|
||||
tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Some(parent) = path.parent() {
|
||||
let _ = std::fs::create_dir_all(parent);
|
||||
}
|
||||
if let Err(e) = std::fs::write(&tmp, body) {
|
||||
tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
|
||||
return;
|
||||
}
|
||||
if let Err(e) = std::fs::rename(&tmp, path) {
|
||||
tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn mount_options(m: &NfsMount) -> String {
|
||||
let mut opts = vec![m.version.vers_arg().to_string()];
|
||||
if m.read_only {
|
||||
opts.push("ro".into());
|
||||
} else {
|
||||
opts.push("rw".into());
|
||||
}
|
||||
// `nolock` for v3 — many storage appliances disable lockd; we don't
|
||||
// need locking for read-only ISO access anyway.
|
||||
if matches!(m.version, NfsVersion::V3) {
|
||||
opts.push("nolock".into());
|
||||
}
|
||||
// Soft mount with a generous timeout — better to surface a hung share
|
||||
// as a user-visible error than to wedge the iPXE client forever on a
|
||||
// dead NFS server.
|
||||
opts.push("soft".into());
|
||||
opts.push("timeo=100".into());
|
||||
opts.push("retrans=3".into());
|
||||
opts.join(",")
|
||||
}
|
||||
|
||||
fn mount_id(server: &str, export: &str) -> String {
|
||||
let raw = format!("{server}{export}");
|
||||
slugify_str(&raw)
|
||||
}
|
||||
|
||||
/// Detect whether `path` is currently a mount point. We don't have
|
||||
/// `is_mountpoint(2)`, so compare the parent's device id to the dir's;
|
||||
/// if they differ the dir is a mount.
|
||||
async fn is_mountpoint(path: &Path) -> bool {
|
||||
let Some(parent) = path.parent() else {
|
||||
return false;
|
||||
};
|
||||
let Ok(m1) = tokio::fs::metadata(path).await else {
|
||||
return false;
|
||||
};
|
||||
let Ok(m2) = tokio::fs::metadata(parent).await else {
|
||||
return false;
|
||||
};
|
||||
use std::os::unix::fs::MetadataExt;
|
||||
m1.dev() != m2.dev()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn version_arg() {
|
||||
assert_eq!(NfsVersion::V3.vers_arg(), "vers=3");
|
||||
assert_eq!(NfsVersion::V41.vers_arg(), "vers=4.1");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mount_options_v3_includes_nolock() {
|
||||
let m = NfsMount {
|
||||
id: "x".into(),
|
||||
server: "s".into(),
|
||||
export: "/e".into(),
|
||||
version: NfsVersion::V3,
|
||||
read_only: true,
|
||||
local_path: PathBuf::from("/tmp/x"),
|
||||
mounted: false,
|
||||
last_error: None,
|
||||
last_attempt: None,
|
||||
iso_count: 0,
|
||||
};
|
||||
let opts = mount_options(&m);
|
||||
assert!(opts.contains("vers=3"));
|
||||
assert!(opts.contains("ro"));
|
||||
assert!(opts.contains("nolock"));
|
||||
assert!(opts.contains("soft"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mount_options_v41_no_nolock() {
|
||||
let m = NfsMount {
|
||||
id: "x".into(),
|
||||
server: "s".into(),
|
||||
export: "/e".into(),
|
||||
version: NfsVersion::V41,
|
||||
read_only: false,
|
||||
local_path: PathBuf::from("/tmp/x"),
|
||||
mounted: false,
|
||||
last_error: None,
|
||||
last_attempt: None,
|
||||
iso_count: 0,
|
||||
};
|
||||
let opts = mount_options(&m);
|
||||
assert!(opts.contains("vers=4.1"));
|
||||
assert!(opts.contains("rw"));
|
||||
assert!(!opts.contains("nolock"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mount_id_is_stable_and_safe() {
|
||||
let a = mount_id("10.0.0.5", "/srv/isos");
|
||||
let b = mount_id("10.0.0.5", "/srv/isos");
|
||||
assert_eq!(a, b);
|
||||
assert!(!a.contains('/'));
|
||||
assert!(!a.contains('.'));
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,264 +0,0 @@
|
||||
//! PXE boot-menu background compositor.
|
||||
//!
|
||||
//! The brief (v0.4.69): match iVentoy's polished graphical PXE screen.
|
||||
//! iPXE built with `CONSOLE_FRAMEBUFFER` + `IMAGE_PNG` paints a PNG to
|
||||
//! the framebuffer via `console --picture`, then draws the text menu on
|
||||
//! top (the console's default background colour is rendered transparent
|
||||
//! so the picture shows through the menu's blank cells). So what we
|
||||
//! produce here is a **full-screen 1024×768 background**, not just a
|
||||
//! floating logo:
|
||||
//!
|
||||
//! - a solid dark field (matches the WebUI dark theme so the product
|
||||
//! feels consistent from browser to bare metal), with
|
||||
//! - the operator's uploaded logo composited across the top, leaving
|
||||
//! the lower ~two-thirds clear for the iPXE menu text.
|
||||
//!
|
||||
//! When no custom logo is uploaded we still return a designed
|
||||
//! background — a dark field with a centered "rainbow-horizon" disc
|
||||
//! echoing the bundled OpenPXE mark — so the boot screen is graphical
|
||||
//! out of the box. This replaces the old ASCII wordmark entirely.
|
||||
//!
|
||||
//! iPXE does **not** scale pictures (confirmed against the decoder
|
||||
//! source): the image is painted at native pixel size and the firmware
|
||||
//! picks the smallest video mode that fits. 1024×768 is the universal
|
||||
//! safe mode, so we pin the canvas there. Operators uploading a 4K logo
|
||||
//! get it downscaled to fit the top band; tiny icons paint at native
|
||||
//! size, centered.
|
||||
//!
|
||||
//! Input formats: anything the `image` crate decodes with our enabled
|
||||
//! features — PNG, JPEG, WebP, GIF. iPXE itself only consumes PNG, so
|
||||
//! we always *emit* PNG regardless of what the operator uploaded; a
|
||||
//! WebP logo is transcoded here transparently.
|
||||
|
||||
use image::imageops::FilterType;
|
||||
use image::{DynamicImage, ImageError, ImageFormat, Rgba, RgbaImage};
|
||||
use std::io::Cursor;
|
||||
|
||||
/// Canvas dimensions. Pinned to 1024×768 — the universal framebuffer
|
||||
/// mode every BIOS/UEFI console supports, and iPXE doesn't scale.
|
||||
pub const CANVAS_W: u32 = 1024;
|
||||
pub const CANVAS_H: u32 = 768;
|
||||
|
||||
/// Bounding box for the operator's logo across the top band. Wider than
|
||||
/// the old floating-logo box because the logo now anchors a full
|
||||
/// background rather than sitting alone on transparency.
|
||||
const LOGO_MAX_W: u32 = 760;
|
||||
const LOGO_MAX_H: u32 = 200;
|
||||
|
||||
/// Top margin from the canvas top to the logo's top edge.
|
||||
const LOGO_TOP_MARGIN: u32 = 72;
|
||||
|
||||
/// Background fill — a near-black with a faint blue cast, matching the
|
||||
/// WebUI's dark theme surface so the product reads as one piece from
|
||||
/// browser to PXE screen.
|
||||
const BG: Rgba<u8> = Rgba([11, 14, 22, 255]);
|
||||
|
||||
/// Compose the operator's uploaded raster (`Some`) — or the default
|
||||
/// OpenPXE mark (`None`) — into a full-screen 1024×768 PNG background
|
||||
/// and return the encoded bytes.
|
||||
///
|
||||
/// Errors only when a provided `src_bytes` can't be decoded; the
|
||||
/// `None` path and the PNG encode are infallible for our fixed canvas.
|
||||
pub fn compose_pxe_background(src_bytes: Option<&[u8]>) -> Result<Vec<u8>, ImageError> {
|
||||
let mut canvas: RgbaImage = RgbaImage::from_pixel(CANVAS_W, CANVAS_H, BG);
|
||||
|
||||
match src_bytes {
|
||||
Some(bytes) => {
|
||||
let logo = image::load_from_memory(bytes)?;
|
||||
let logo = downscale_to_fit(logo, LOGO_MAX_W, LOGO_MAX_H);
|
||||
let logo_rgba = logo.to_rgba8();
|
||||
let off_x = CANVAS_W.saturating_sub(logo_rgba.width()) / 2;
|
||||
let off_y = LOGO_TOP_MARGIN.min(CANVAS_H.saturating_sub(logo_rgba.height()));
|
||||
// `overlay` alpha-composites, so a transparent-background
|
||||
// logo blends onto the dark field exactly as designed.
|
||||
image::imageops::overlay(&mut canvas, &logo_rgba, off_x.into(), off_y.into());
|
||||
}
|
||||
None => draw_default_mark(&mut canvas),
|
||||
}
|
||||
|
||||
let mut out = Vec::with_capacity(128 * 1024);
|
||||
DynamicImage::ImageRgba8(canvas).write_to(&mut Cursor::new(&mut out), ImageFormat::Png)?;
|
||||
Ok(out)
|
||||
}
|
||||
|
||||
/// Back-compat shim for the old name — callers that pass a raw logo and
|
||||
/// want it composited get the same result as `compose_pxe_background`
|
||||
/// with `Some`.
|
||||
pub fn compose_pxe_logo(src_bytes: &[u8]) -> Result<Vec<u8>, ImageError> {
|
||||
compose_pxe_background(Some(src_bytes))
|
||||
}
|
||||
|
||||
/// Paint a centered "rainbow-horizon" disc onto the dark canvas as the
|
||||
/// default brand mark when no operator logo is set. Pure pixel math —
|
||||
/// no font, no SVG rasterizer, no extra deps. A filled circle with a
|
||||
/// left-to-right hue sweep echoes the bundled `logo.svg` motif.
|
||||
// Casts here are all bounded small-range geometry (radius ≤ 90, canvas
|
||||
// ≤ 1024) — precision loss / wrap is structurally impossible.
|
||||
#[allow(clippy::cast_precision_loss, clippy::cast_possible_wrap)]
|
||||
fn draw_default_mark(canvas: &mut RgbaImage) {
|
||||
let radius: i32 = 90;
|
||||
let cx = (CANVAS_W / 2) as i32;
|
||||
let cy = (LOGO_TOP_MARGIN + 100) as i32;
|
||||
// Four-stop horizontal sweep across the disc (teal → blue → violet
|
||||
// → magenta) — the OpenPXE palette.
|
||||
let stops = [
|
||||
[0x22u8, 0xd3, 0xaa],
|
||||
[0x3b, 0x82, 0xf6],
|
||||
[0x8b, 0x5c, 0xf6],
|
||||
[0xec, 0x48, 0x99],
|
||||
];
|
||||
let r2 = radius * radius;
|
||||
for dy in -radius..=radius {
|
||||
for dx in -radius..=radius {
|
||||
if dx * dx + dy * dy > r2 {
|
||||
continue;
|
||||
}
|
||||
// Position across the disc in [0,1] left→right.
|
||||
let t = (f32::from(i16::try_from(dx + radius).unwrap_or(0)))
|
||||
/ (f32::from(i16::try_from(2 * radius).unwrap_or(1)));
|
||||
let color = gradient_at(&stops, t);
|
||||
// Soft edge: fade alpha in the outer 3px ring.
|
||||
let dist = ((dx * dx + dy * dy) as f32).sqrt();
|
||||
let alpha = if dist > (radius as f32 - 3.0) {
|
||||
let edge = (radius as f32 - dist).clamp(0.0, 3.0) / 3.0;
|
||||
(edge * 255.0) as u8
|
||||
} else {
|
||||
255
|
||||
};
|
||||
let px = cx + dx;
|
||||
let py = cy + dy;
|
||||
if px >= 0 && py >= 0 && (px as u32) < CANVAS_W && (py as u32) < CANVAS_H {
|
||||
blend_pixel(canvas, px as u32, py as u32, color, alpha);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Linear interpolate across an N-stop palette at position `t` in [0,1].
|
||||
// `segments`/`idx` are ≤ palette length (4) — f32 cast is exact.
|
||||
#[allow(clippy::cast_precision_loss)]
|
||||
fn gradient_at(stops: &[[u8; 3]], t: f32) -> [u8; 3] {
|
||||
let t = t.clamp(0.0, 1.0);
|
||||
let segments = stops.len() - 1;
|
||||
let scaled = t * segments as f32;
|
||||
let idx = (scaled.floor() as usize).min(segments - 1);
|
||||
let frac = scaled - idx as f32;
|
||||
let a = stops[idx];
|
||||
let b = stops[idx + 1];
|
||||
[
|
||||
lerp(a[0], b[0], frac),
|
||||
lerp(a[1], b[1], frac),
|
||||
lerp(a[2], b[2], frac),
|
||||
]
|
||||
}
|
||||
|
||||
fn lerp(a: u8, b: u8, t: f32) -> u8 {
|
||||
(f32::from(a) + (f32::from(b) - f32::from(a)) * t).round() as u8
|
||||
}
|
||||
|
||||
/// Alpha-blend `color` at `alpha` over the existing canvas pixel.
|
||||
fn blend_pixel(canvas: &mut RgbaImage, x: u32, y: u32, color: [u8; 3], alpha: u8) {
|
||||
let bg = canvas.get_pixel(x, y).0;
|
||||
let a = f32::from(alpha) / 255.0;
|
||||
let out = Rgba([
|
||||
lerp(bg[0], color[0], a),
|
||||
lerp(bg[1], color[1], a),
|
||||
lerp(bg[2], color[2], a),
|
||||
255,
|
||||
]);
|
||||
canvas.put_pixel(x, y, out);
|
||||
}
|
||||
|
||||
fn downscale_to_fit(img: DynamicImage, max_w: u32, max_h: u32) -> DynamicImage {
|
||||
let (w, h) = (img.width(), img.height());
|
||||
if w <= max_w && h <= max_h {
|
||||
return img;
|
||||
}
|
||||
img.resize(max_w, max_h, FilterType::Lanczos3)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use image::{ImageBuffer, Rgb};
|
||||
|
||||
fn solid_png(w: u32, h: u32, rgb: [u8; 3]) -> Vec<u8> {
|
||||
let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(w, h, Rgb(rgb));
|
||||
let mut out = Vec::with_capacity(4096);
|
||||
DynamicImage::ImageRgb8(img)
|
||||
.write_to(&mut Cursor::new(&mut out), ImageFormat::Png)
|
||||
.unwrap();
|
||||
out
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn custom_logo_emits_canvas_sized_png_with_dark_field() {
|
||||
let src = solid_png(120, 60, [200, 50, 50]);
|
||||
let out = compose_pxe_background(Some(&src)).unwrap();
|
||||
let img = image::load_from_memory(&out).unwrap().to_rgba8();
|
||||
assert_eq!(img.width(), CANVAS_W);
|
||||
assert_eq!(img.height(), CANVAS_H);
|
||||
// A far corner should be the opaque dark background fill, not
|
||||
// transparent — this is a full background now, not a floating
|
||||
// logo on transparency.
|
||||
let corner = img.get_pixel(CANVAS_W - 1, CANVAS_H - 1);
|
||||
assert_eq!(corner.0, BG.0, "corner should be the dark fill");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn custom_logo_painted_in_top_band() {
|
||||
let src = solid_png(100, 40, [10, 200, 10]);
|
||||
let out = compose_pxe_background(Some(&src)).unwrap();
|
||||
let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
|
||||
let cx = (CANVAS_W - 100) / 2;
|
||||
let cy = LOGO_TOP_MARGIN;
|
||||
let inside = canvas.get_pixel(cx + 10, cy + 10);
|
||||
assert!(
|
||||
inside.0[1] > 100 && inside.0[0] < 100,
|
||||
"logo pixel color mismatch: {inside:?}"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn default_background_is_dark_with_a_painted_mark() {
|
||||
let out = compose_pxe_background(None).unwrap();
|
||||
let canvas = image::load_from_memory(&out).unwrap().to_rgba8();
|
||||
assert_eq!(canvas.width(), CANVAS_W);
|
||||
assert_eq!(canvas.height(), CANVAS_H);
|
||||
// Corner is dark fill.
|
||||
assert_eq!(canvas.get_pixel(2, CANVAS_H - 2).0, BG.0);
|
||||
// Center of the disc is not the background fill (something was
|
||||
// painted there).
|
||||
let center = canvas.get_pixel(CANVAS_W / 2, LOGO_TOP_MARGIN + 100);
|
||||
assert_ne!(center.0, BG.0, "default mark should paint over the field");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn webp_or_jpeg_input_is_accepted_and_transcoded_to_png() {
|
||||
// Encode a JPEG and confirm the compositor decodes it and emits
|
||||
// a valid PNG (iPXE only eats PNG, so transcoding is the point).
|
||||
let img: ImageBuffer<Rgb<u8>, Vec<u8>> = ImageBuffer::from_pixel(80, 80, Rgb([90, 90, 90]));
|
||||
let mut jpeg = Vec::new();
|
||||
DynamicImage::ImageRgb8(img)
|
||||
.write_to(&mut Cursor::new(&mut jpeg), ImageFormat::Jpeg)
|
||||
.unwrap();
|
||||
let out = compose_pxe_background(Some(&jpeg)).unwrap();
|
||||
// Output must be a PNG (magic bytes) of canvas size.
|
||||
assert_eq!(&out[..8], b"\x89PNG\r\n\x1a\n");
|
||||
let img = image::load_from_memory(&out).unwrap();
|
||||
assert_eq!(img.width(), CANVAS_W);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unsupported_bytes_returns_error_not_panic() {
|
||||
let r = compose_pxe_background(Some(b"\xde\xad\xbe\xef not an image"));
|
||||
assert!(r.is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn gradient_endpoints_match_stops() {
|
||||
let stops = [[0, 0, 0], [255, 255, 255]];
|
||||
assert_eq!(gradient_at(&stops, 0.0), [0, 0, 0]);
|
||||
assert_eq!(gradient_at(&stops, 1.0), [255, 255, 255]);
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
+50
-199
@@ -15,59 +15,22 @@ use tokio::io::AsyncWriteExt;
|
||||
|
||||
/// Where the bytes for an ISO actually live.
|
||||
///
|
||||
/// `Local` — uploaded ISO, sits at `<iso_dir>/<id>.iso`.
|
||||
/// `Smb` (v0.4.65) — remote SMB share, streamed via Samba's
|
||||
/// userspace `smbclient` CLI subprocess. No kernel mount, no local
|
||||
/// cache. Sequential whole-file streaming; HTTP Range requests
|
||||
/// return 416.
|
||||
/// `Nfs` (v0.4.67) — remote NFSv3 share, streamed via the pure-Rust
|
||||
/// `nfs3_client` crate (in-process, no subprocess). Same "works in
|
||||
/// any container" property as SMB, plus Range requests work because
|
||||
/// NFSv3 READ3 takes an explicit offset.
|
||||
/// The default is `Local` — uploaded ISOs sit in `<iso_dir>/<id>.iso`.
|
||||
/// `Nfs` entries point at a file inside a remote share that the
|
||||
/// `NfsManager` is keeping mounted. We resolve the on-disk path lazily
|
||||
/// in [`IsoStore::iso_path_for`] using the `nfs_root` set at startup.
|
||||
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
|
||||
#[serde(tag = "kind", rename_all = "snake_case")]
|
||||
pub enum IsoSource {
|
||||
#[default]
|
||||
Local,
|
||||
/// v0.4.65: SMB via userspace `smbclient` works in any container.
|
||||
Smb {
|
||||
share_id: String,
|
||||
/// Filename at the share root. We don't support nested paths
|
||||
/// in v0.4.65; ISOs live at the top of the share.
|
||||
relative_path: String,
|
||||
},
|
||||
/// v0.4.67: NFSv3 via the in-process `nfs3_client` crate.
|
||||
Nfs {
|
||||
share_id: String,
|
||||
/// Filename at the export root.
|
||||
mount_id: String,
|
||||
/// Path relative to the mount point — typically just the filename.
|
||||
relative_path: String,
|
||||
},
|
||||
}
|
||||
|
||||
/// Where the ISO lands in the PXE menu hierarchy.
|
||||
///
|
||||
/// Auto-detected family (Debian, Windows, …) still drives BIOS/UEFI
|
||||
/// behaviour and per-entry boot args, but the *menu placement* is
|
||||
/// operator-controlled — an operator who's uploaded a TinyCore live ISO
|
||||
/// to use as a recovery shim, or a SystemRescue image, can flip its
|
||||
/// category to `Tools` so it lands next to memtest/shell instead of
|
||||
/// under Linux Installers.
|
||||
///
|
||||
/// Old `meta.json` files without this field deserialize as `Os`, which
|
||||
/// matches v0.4.1 behaviour (everything goes under OS Installers).
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub enum IsoCategory {
|
||||
/// "OS Installer" — routed via the auto-detected family into the
|
||||
/// Linux / Windows installer submenus.
|
||||
#[default]
|
||||
Os,
|
||||
/// "Tool" — surfaced under the Tools menu next to memtest, shell,
|
||||
/// NIC info, etc. Family detection still decides BIOS/UEFI vs
|
||||
/// wimboot vs sanboot at boot time.
|
||||
Tools,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct IsoMeta {
|
||||
/// Stable slug used in URLs (derived from the uploaded filename).
|
||||
@@ -93,10 +56,6 @@ pub struct IsoMeta {
|
||||
/// the common no-password case.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub password_hash: Option<String>,
|
||||
/// Where the ISO sits in the PXE menu hierarchy — operator-controlled,
|
||||
/// not driven by family detection. Defaults to [`IsoCategory::Os`].
|
||||
#[serde(default)]
|
||||
pub category: IsoCategory,
|
||||
}
|
||||
|
||||
impl IsoMeta {
|
||||
@@ -155,7 +114,6 @@ impl UploadHandle {
|
||||
boot_entries,
|
||||
source: IsoSource::Local,
|
||||
password_hash: None,
|
||||
category: IsoCategory::default(),
|
||||
};
|
||||
store.persist_meta(&meta).await?;
|
||||
store.insert(meta.clone());
|
||||
@@ -177,6 +135,10 @@ struct Inner {
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct IsoStore {
|
||||
iso_dir: Arc<PathBuf>,
|
||||
/// Where NFS mounts land on disk. Set at startup via
|
||||
/// [`IsoStore::set_nfs_root`]; required for resolving any
|
||||
/// `IsoSource::Nfs` entry.
|
||||
nfs_root: Arc<RwLock<Option<PathBuf>>>,
|
||||
inner: Arc<RwLock<Inner>>,
|
||||
}
|
||||
|
||||
@@ -184,10 +146,17 @@ impl IsoStore {
|
||||
pub fn new(iso_dir: PathBuf) -> Self {
|
||||
Self {
|
||||
iso_dir: Arc::new(iso_dir),
|
||||
nfs_root: Arc::new(RwLock::new(None)),
|
||||
inner: Arc::new(RwLock::new(Inner::default())),
|
||||
}
|
||||
}
|
||||
|
||||
/// Tell the store where NFS mounts live. Without this set,
|
||||
/// `IsoSource::Nfs` entries cannot be resolved to a file path.
|
||||
pub fn set_nfs_root(&self, root: PathBuf) {
|
||||
*self.nfs_root.write() = Some(root);
|
||||
}
|
||||
|
||||
pub async fn ensure_dirs(&self) -> Result<()> {
|
||||
tokio::fs::create_dir_all(self.iso_dir.as_path()).await?;
|
||||
Ok(())
|
||||
@@ -247,9 +216,6 @@ impl IsoStore {
|
||||
return Err(Error::Invalid(format!("iso '{id}' already exists")));
|
||||
}
|
||||
let partial_path = self.iso_dir.join(format!("{id}.partial"));
|
||||
if partial_path.exists() {
|
||||
return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
|
||||
}
|
||||
let file = tokio::fs::File::create(&partial_path).await?;
|
||||
Ok(UploadHandle {
|
||||
id,
|
||||
@@ -283,33 +249,33 @@ impl IsoStore {
|
||||
self.inner.read().isos.get(id).cloned()
|
||||
}
|
||||
|
||||
/// Resolve an ISO id to its on-disk path, if any. For local
|
||||
/// (uploaded) ISOs this is `<iso_dir>/<id>.iso`. For SMB-sourced
|
||||
/// ISOs there is no on-disk path — the HTTP handler must stream
|
||||
/// via `SmbShareManager::stream_iso` instead. Returns `None` for
|
||||
/// SMB sources or when the file is missing.
|
||||
/// Resolve an ISO id to its on-disk path, if any. For local entries
|
||||
/// this is `<iso_dir>/<id>.iso`; for NFS entries it's
|
||||
/// `<nfs_root>/<mount_id>/<relative_path>`. Returns None if the file
|
||||
/// is missing or the source isn't resolvable (e.g. NFS share
|
||||
/// unmounted).
|
||||
pub fn iso_path_for(&self, id: &str) -> Option<PathBuf> {
|
||||
let meta = self.get(id)?;
|
||||
match &meta.source {
|
||||
IsoSource::Local => {
|
||||
let path = self.iso_path(id);
|
||||
if path.exists() {
|
||||
Some(path)
|
||||
} else {
|
||||
None
|
||||
}
|
||||
let path = match &meta.source {
|
||||
IsoSource::Local => self.iso_path(id),
|
||||
IsoSource::Nfs {
|
||||
mount_id,
|
||||
relative_path,
|
||||
} => {
|
||||
let root = self.nfs_root.read().clone()?;
|
||||
root.join(mount_id).join(relative_path)
|
||||
}
|
||||
// SMB and NFS sources have no local path — they're
|
||||
// streamed in-process. Callers must inspect the source
|
||||
// kind first and dispatch to the appropriate share
|
||||
// manager.
|
||||
IsoSource::Smb { .. } | IsoSource::Nfs { .. } => None,
|
||||
};
|
||||
if path.exists() {
|
||||
Some(path)
|
||||
} else {
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
/// Delete an ISO and its sidecar metadata. Only acts on local
|
||||
/// (uploaded) ISOs; for SMB-backed ISOs the operator must remove
|
||||
/// the file from the share or unregister the share entirely.
|
||||
/// Delete an ISO and its sidecar metadata. Only acts on local ISOs;
|
||||
/// for NFS-backed ISOs the operator must remove the file from the
|
||||
/// share or unmount the NFS share entirely.
|
||||
pub async fn delete(&self, id: &str) -> Result<()> {
|
||||
let meta = self.get(id);
|
||||
let is_local = matches!(
|
||||
@@ -326,10 +292,10 @@ impl IsoStore {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Register an externally-sourced ISO (SMB share, etc.). Used by
|
||||
/// `SmbShareManager` after listing a share. We do **not** persist
|
||||
/// a `meta.json` on disk for these — the source of truth is the
|
||||
/// share itself, and the manager re-scans on startup.
|
||||
/// Register an externally-sourced ISO (e.g. NFS-mounted). Used by
|
||||
/// `NfsManager` after walking a freshly-mounted share. We do **not**
|
||||
/// persist a `meta.json` on disk for these — the source of truth is
|
||||
/// the share itself, and the NFS manager re-scans on startup.
|
||||
pub fn register_external(
|
||||
&self,
|
||||
id: String,
|
||||
@@ -349,25 +315,18 @@ impl IsoStore {
|
||||
boot_entries,
|
||||
source,
|
||||
password_hash: None,
|
||||
category: IsoCategory::default(),
|
||||
};
|
||||
self.inner.write().isos.insert(id, meta);
|
||||
}
|
||||
|
||||
/// Drop every entry that belongs to `share_id`. Used by the SMB
|
||||
/// and NFS share managers when an operator removes a share, or
|
||||
/// before re-scanning to clean out stale entries. The same id
|
||||
/// space serves both protocols — share ids are slugified from
|
||||
/// `server+share` (SMB) or `server+export` (NFS) and the
|
||||
/// protocol-specific prefix prevents collisions.
|
||||
pub fn drop_external_source(&self, share_id: &str) {
|
||||
/// Drop every entry that belongs to `mount_id`. Used by the NFS
|
||||
/// manager when an operator removes a share, or before re-scanning
|
||||
/// to clean out stale entries.
|
||||
pub fn drop_external_source(&self, mount_id: &str) {
|
||||
let mut g = self.inner.write();
|
||||
g.isos.retain(|_, m| match &m.source {
|
||||
IsoSource::Smb { share_id: sid, .. } | IsoSource::Nfs { share_id: sid, .. } => {
|
||||
sid != share_id
|
||||
}
|
||||
IsoSource::Local => true,
|
||||
});
|
||||
g.isos.retain(
|
||||
|_, m| !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id),
|
||||
);
|
||||
}
|
||||
|
||||
/// Set or clear an ISO's boot password.
|
||||
@@ -415,47 +374,6 @@ impl IsoStore {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Flip an ISO's menu category. Persists to `meta.json` for local
|
||||
/// ISOs; NFS-sourced ISOs keep the change in memory only (the next
|
||||
/// re-scan would overwrite it anyway).
|
||||
pub async fn set_category(&self, id: &str, category: IsoCategory) -> Result<IsoMeta> {
|
||||
let updated = {
|
||||
let mut g = self.inner.write();
|
||||
let m = g
|
||||
.isos
|
||||
.get_mut(id)
|
||||
.ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
|
||||
m.category = category;
|
||||
m.clone()
|
||||
};
|
||||
if matches!(updated.source, IsoSource::Local) {
|
||||
self.persist_meta(&updated).await?;
|
||||
}
|
||||
Ok(updated)
|
||||
}
|
||||
|
||||
/// Absolute path to the directory holding local ISO uploads. Used
|
||||
/// by the HTTP layer for the disk-space endpoint — the volume that
|
||||
/// hosts this directory is what runs out of room first.
|
||||
#[must_use]
|
||||
pub fn iso_dir(&self) -> PathBuf {
|
||||
self.iso_dir.as_path().to_path_buf()
|
||||
}
|
||||
|
||||
/// `(total_bytes, available_bytes)` for the filesystem hosting the
|
||||
/// ISO directory. Returns `None` if `statvfs` fails (read-only
|
||||
/// filesystem with no quota, mount disappeared, …) — callers
|
||||
/// should treat that as "unknown" rather than zero.
|
||||
///
|
||||
/// Lives here rather than the HTTP crate because `http-api`'s
|
||||
/// `#![forbid(unsafe_code)]` rules out the libc FFI directly, and
|
||||
/// because this is naturally an `IsoStore` question — the volume
|
||||
/// of interest is whatever's hosting the iso dir.
|
||||
#[must_use]
|
||||
pub fn disk_usage(&self) -> Option<(u64, u64)> {
|
||||
disk_usage_for(self.iso_dir.as_path())
|
||||
}
|
||||
|
||||
/// Verify a candidate password against the stored bcrypt hash.
|
||||
/// Returns:
|
||||
/// - `Ok(true)` — match (or the ISO has no password set; boot is open)
|
||||
@@ -472,33 +390,6 @@ impl IsoStore {
|
||||
}
|
||||
}
|
||||
|
||||
/// Resolve `(total, available)` bytes for the filesystem hosting `path`.
|
||||
/// Returns `None` if `statvfs` fails.
|
||||
#[allow(unsafe_code)]
|
||||
fn disk_usage_for(path: &std::path::Path) -> Option<(u64, u64)> {
|
||||
use std::ffi::CString;
|
||||
use std::os::unix::ffi::OsStrExt;
|
||||
let c = CString::new(path.as_os_str().as_bytes()).ok()?;
|
||||
// SAFETY: `statvfs` is repr(C); a zeroed value is a valid initial
|
||||
// state per POSIX. The FFI call writes every field we then read.
|
||||
let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
|
||||
// SAFETY: `c` is a NUL-terminated C string pointing into a stack
|
||||
// CString that outlives this call; `&mut stat` is a unique aligned
|
||||
// pointer to a stack-local `statvfs`. The kernel writes through
|
||||
// it but does not retain the pointer past return.
|
||||
let rc = unsafe { libc::statvfs(c.as_ptr(), &raw mut stat) };
|
||||
if rc != 0 {
|
||||
return None;
|
||||
}
|
||||
// Use f_frsize (fundamental block size). f_bsize is "preferred I/O
|
||||
// block" and doesn't always match the unit f_blocks is denominated
|
||||
// in — on some BSDs it would over-report by a factor of 8.
|
||||
let frsize = stat.f_frsize as u64;
|
||||
let total = stat.f_blocks as u64 * frsize;
|
||||
let avail = stat.f_bavail as u64 * frsize;
|
||||
Some((total, avail))
|
||||
}
|
||||
|
||||
fn slugify(filename: &str) -> String {
|
||||
let stem = Path::new(filename)
|
||||
.file_stem()
|
||||
@@ -604,17 +495,8 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
|
||||
// The HTTP layer resolves `${base-url}` at render time.
|
||||
let iso_url = format!("${{base-url}}/iso/{id}.iso");
|
||||
match family {
|
||||
// VMware-UEFI fix (v0.4.5, matching Bootimus v0.1.67's Casper
|
||||
// patch): drop `netboot=url url=… ---` in favour of the
|
||||
// canonical Casper option `iso-url=` and add `ds=nocloud` so
|
||||
// cloud-init / subiquity (live-server) doesn't stall waiting on
|
||||
// a metadata datasource that doesn't exist in PXE. Without
|
||||
// `ds=nocloud`, Ubuntu live-server / Mint / Pop!_OS / elementary
|
||||
// ISOs would boot fine on bare-metal UEFI but hang at "cloud-init
|
||||
// running" on VMware-UEFI guests because the vmxnet3 driver's
|
||||
// late-init upsets cloud-init's network probe.
|
||||
DistroFamily::DebianUbuntu => format!(
|
||||
"boot=casper initrd=initrd ds=nocloud ip=dhcp iso-url={iso_url}"
|
||||
"boot=casper netboot=url url={iso_url} ip=dhcp ---"
|
||||
),
|
||||
DistroFamily::RhelFedora => format!(
|
||||
"inst.repo={iso_url} inst.stage2={iso_url} ip=dhcp"
|
||||
@@ -649,23 +531,6 @@ mod tests {
|
||||
assert_eq!(slugify("/etc/passwd"), "passwd");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn casper_cmdline_vmware_uefi_safe() {
|
||||
// v0.4.5 regression guard: the Debian/Ubuntu cmdline must use
|
||||
// the canonical Casper `iso-url=` option and include
|
||||
// `ds=nocloud` so VMware-UEFI guests don't hang at "cloud-init
|
||||
// running" waiting on a metadata datasource that PXE can't
|
||||
// provide. The legacy `netboot=url url=… ---` form is gone for
|
||||
// good.
|
||||
let s = linux_cmdline(DistroFamily::DebianUbuntu, "ubuntu-24-04");
|
||||
assert!(s.contains("boot=casper"), "{s}");
|
||||
assert!(s.contains("iso-url=${base-url}/iso/ubuntu-24-04.iso"), "{s}");
|
||||
assert!(s.contains("ds=nocloud"), "{s}");
|
||||
assert!(s.contains("ip=dhcp"), "{s}");
|
||||
assert!(!s.contains("netboot=url"), "legacy option leaked: {s}");
|
||||
assert!(!s.contains(" --- "), "stray ---: {s}");
|
||||
}
|
||||
|
||||
fn fake_meta(id: &str) -> IsoMeta {
|
||||
IsoMeta {
|
||||
id: id.into(),
|
||||
@@ -683,7 +548,6 @@ mod tests {
|
||||
boot_entries: vec![],
|
||||
source: IsoSource::Local,
|
||||
password_hash: None,
|
||||
category: IsoCategory::default(),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -730,19 +594,6 @@ mod tests {
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn begin_upload_rejects_existing_partial_file() {
|
||||
let dir = tempdir().unwrap();
|
||||
let store = IsoStore::new(dir.path().to_path_buf());
|
||||
store.ensure_dirs().await.unwrap();
|
||||
tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let r = store.begin_upload("ubuntu.iso").await;
|
||||
assert!(matches!(r, Err(Error::Invalid(_))));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn password_persists_via_meta_json_for_local_isos() {
|
||||
// Hash makes it onto disk so it survives a restart.
|
||||
|
||||
+10
-40
@@ -9,7 +9,7 @@ use openpxe_core::{
|
||||
};
|
||||
use openpxe_dhcp_proxy::DhcpProxyServer;
|
||||
use openpxe_http_api::{build_router, AppState};
|
||||
use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
|
||||
use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
|
||||
use openpxe_tftp::TftpServer;
|
||||
use std::net::{Ipv4Addr, SocketAddr};
|
||||
use std::path::PathBuf;
|
||||
@@ -39,7 +39,7 @@ enum Command {
|
||||
/// docker run --rm \
|
||||
/// -v /my/isos:/seed:ro \
|
||||
/// -v openpxe-data:/var/lib/openpxe/isos \
|
||||
/// openpxe:0.4.1 seed --from /seed
|
||||
/// openpxe:0.3.2 seed --from /seed
|
||||
Seed {
|
||||
/// Source directory containing one or more `.iso` files.
|
||||
#[arg(long)]
|
||||
@@ -104,11 +104,6 @@ async fn main() -> anyhow::Result<()> {
|
||||
let settings = SettingsStore::load_or_default(&config.paths.work_dir);
|
||||
let hosts = HostBindings::load_or_default(&config.paths.work_dir);
|
||||
let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
|
||||
let branding = openpxe_core::BrandingStore::load_or_default(&config.paths.work_dir);
|
||||
let admin = openpxe_core::AdminStore::load_or_default(&config.paths.work_dir);
|
||||
let sso = openpxe_core::SsoStore::load_or_default(&config.paths.work_dir);
|
||||
let notify = openpxe_core::NotifyStore::load_or_default(&config.paths.work_dir);
|
||||
let sessions = openpxe_http_api::auth::SessionStore::default();
|
||||
let metrics = Metrics::new();
|
||||
|
||||
// Build the SMB manager unconditionally — it starts/stops on the
|
||||
@@ -120,30 +115,13 @@ async fn main() -> anyhow::Result<()> {
|
||||
let _ = smb.start();
|
||||
}
|
||||
|
||||
// v0.4.65: SMB share manager — Samba `smbclient` userspace
|
||||
// consumer. Replaces the kernel-mount NFS path that v0.4.64
|
||||
// shipped; that didn't work on hosts whose kernel lacked the nfs
|
||||
// client modules (Unraid is the dominant case). `smbclient` does
|
||||
// the SMB protocol entirely in userspace over TCP and works in
|
||||
// any container regardless of capabilities or kernel modules.
|
||||
let smb_shares = SmbShareManager::new(&config.paths.work_dir, iso_store.clone());
|
||||
if let Err(e) = smb_shares.load_and_rescan().await {
|
||||
tracing::warn!(
|
||||
target: "openpxe::smb",
|
||||
"could not reload SMB shares on startup: {e}"
|
||||
);
|
||||
}
|
||||
|
||||
// v0.4.67: NFSv3 share manager — pure-Rust in-process consumer
|
||||
// via the `nfs3_client` crate. Sits alongside the SMB manager;
|
||||
// operators pick whichever protocol their NAS prefers, or use
|
||||
// both. No subprocess, no kernel mount, works in any container.
|
||||
let nfs_shares = NfsShareManager::new(&config.paths.work_dir, iso_store.clone());
|
||||
if let Err(e) = nfs_shares.load_and_rescan().await {
|
||||
tracing::warn!(
|
||||
target: "openpxe::nfs",
|
||||
"could not reload NFS shares on startup: {e}"
|
||||
);
|
||||
// NFS manager. The mount root has to be set on the IsoStore *before*
|
||||
// we replay any persisted mounts, otherwise an in-memory IsoMeta
|
||||
// pointing at an NFS source can't resolve to a path.
|
||||
let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
|
||||
iso_store.set_nfs_root(nfs.mount_root());
|
||||
if let Err(e) = nfs.load_and_remount().await {
|
||||
tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
|
||||
}
|
||||
|
||||
// Sniff network details for the Network tab. None of these are
|
||||
@@ -164,17 +142,9 @@ async fn main() -> anyhow::Result<()> {
|
||||
queue: queue.clone(),
|
||||
hosts: hosts.clone(),
|
||||
boot_log: boot_log.clone(),
|
||||
branding: branding.clone(),
|
||||
admin: admin.clone(),
|
||||
sessions: sessions.clone(),
|
||||
sso: sso.clone(),
|
||||
saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
|
||||
notify: notify.clone(),
|
||||
metrics: metrics.clone(),
|
||||
smb: Some(smb.clone()),
|
||||
smb_shares: smb_shares.clone(),
|
||||
nfs_shares: nfs_shares.clone(),
|
||||
uploads: openpxe_http_api::uploads::UploadSessions::default(),
|
||||
nfs: nfs.clone(),
|
||||
log_bus: log_bus.clone(),
|
||||
started_at: time::OffsetDateTime::now_utc(),
|
||||
public_base_url: public_base_url.clone(),
|
||||
|
||||
+29
-384
@@ -9,10 +9,10 @@
|
||||
|
||||
:root {
|
||||
/* Jet-black dark palette (default). Modelled on Netbox Labs's
|
||||
near-black product chrome, with surfaces stepping subtly upward
|
||||
near-black product chrome — surfaces step from #000 → #0d → #16 → #1c
|
||||
rather than the previous blue-tinted ramp, so the UI reads as a
|
||||
genuine "dark" rather than "dim navy". */
|
||||
--bg: #030303;
|
||||
--bg: #000000;
|
||||
--bg-panel: #0a0a0a;
|
||||
--bg-panel-2: #141414;
|
||||
--bg-elev: #1c1c1c;
|
||||
@@ -26,7 +26,7 @@
|
||||
--ok: #4ade80;
|
||||
--border: #1f1f1f;
|
||||
--border-soft: #141414;
|
||||
--terminal-bg: #050505;
|
||||
--terminal-bg: #000000;
|
||||
--shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
|
||||
--radius: 6px;
|
||||
--radius-lg: 10px;
|
||||
@@ -34,23 +34,14 @@
|
||||
--topbar-h: 56px;
|
||||
--mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
|
||||
--sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, system-ui, sans-serif;
|
||||
/* v0.4.63: tie native form-control rendering (checkboxes, scroll bars,
|
||||
date pickers) to the active OpenPXE theme. Without this, the inline
|
||||
`<meta name="color-scheme" content="dark light">` in index.html forces
|
||||
dark form chrome in *both* themes — so the SSO "Enable single sign-on"
|
||||
checkbox renders as an opaque black square against the light-mode
|
||||
panel, ignoring our accent-color hint. CSS `color-scheme` overrides
|
||||
the meta and tracks `data-theme` correctly. */
|
||||
color-scheme: dark;
|
||||
}
|
||||
|
||||
:root[data-theme="light"] {
|
||||
color-scheme: light;
|
||||
/* Light palette — high-contrast neutral, accent unchanged for brand
|
||||
consistency. Designed against Netbox Labs's reference screenshot:
|
||||
near-white surfaces, soft grey dividers, dark text. */
|
||||
--bg: #f6f8fb;
|
||||
--bg-panel: #fbfcfe;
|
||||
--bg-panel: #ffffff;
|
||||
--bg-panel-2: #f0f3f8;
|
||||
--bg-elev: #e6ebf2;
|
||||
--fg: #1c2330;
|
||||
@@ -63,11 +54,7 @@
|
||||
--ok: #1f9b54;
|
||||
--border: #d8dde6;
|
||||
--border-soft: #e7eaf0;
|
||||
/* Light-mode terminal: the pane background and chrome track the rest
|
||||
of the light theme. Per-level text colours below recolour-on-light
|
||||
so log lines stay readable on a pale background — previously the
|
||||
terminal was locked to dark and looked like a stuck panel. */
|
||||
--terminal-bg: #ffffff;
|
||||
--terminal-bg: #0d1219; /* terminal stays dark even in light mode */
|
||||
--shadow-card: 0 1px 0 rgba(0,0,0,0.02), 0 6px 18px rgba(20,28,52,0.06);
|
||||
}
|
||||
|
||||
@@ -100,37 +87,14 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
|
||||
border-right: 1px solid var(--border);
|
||||
display: flex; flex-direction: column;
|
||||
}
|
||||
/* The brand block sits flush with the topbar so the sidebar+topbar reads
|
||||
as one continuous bar across the top of the app, rather than a chunky
|
||||
2-line logo block plus a separate (smaller-typeface) page title. The
|
||||
height/border-bottom match the topbar exactly so the divider runs
|
||||
straight across without a step. */
|
||||
.sidebar .brand {
|
||||
display: flex; align-items: center; gap: 12px;
|
||||
padding: 0 18px;
|
||||
height: var(--topbar-h);
|
||||
padding: 14px 18px;
|
||||
border-bottom: 1px solid var(--border);
|
||||
}
|
||||
.sidebar .brand img { width: 26px; height: 26px; flex: none; }
|
||||
.sidebar .brand strong {
|
||||
font-size: 15px; font-weight: 600;
|
||||
letter-spacing: 0.2px;
|
||||
color: var(--fg);
|
||||
}
|
||||
|
||||
/* v0.4.69: FleetDM-style full-width custom logo. When the operator has
|
||||
uploaded a custom brand mark, the sidebar header drops the bundled
|
||||
26px mark + "OpenPXE" wordmark and instead lets the uploaded image
|
||||
span the header — left-aligned, capped at 200x50, scaled to fit
|
||||
without distortion. The wordmark is hidden so the operator's logo is
|
||||
the sole brand element (their logo presumably already contains their
|
||||
name). The bundled-default case keeps the mark + wordmark. */
|
||||
.sidebar .brand.has-custom-logo { gap: 0; }
|
||||
.sidebar .brand.has-custom-logo img {
|
||||
width: auto; height: 50px; max-width: 200px;
|
||||
object-fit: contain; object-position: left center; flex: none;
|
||||
}
|
||||
.sidebar .brand.has-custom-logo strong { display: none; }
|
||||
.sidebar .brand img { width: 40px; height: auto; }
|
||||
.sidebar .brand strong { font-size: 16px; letter-spacing: 0.4px; }
|
||||
.sidebar .brand .sub { color: var(--fg-dim); font-size: 11px; }
|
||||
.sidebar nav { padding: 10px 0; flex: 1; overflow-y: auto; }
|
||||
.sidebar nav a {
|
||||
display: flex; align-items: center; gap: 10px;
|
||||
@@ -176,16 +140,6 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
|
||||
.sidebar .footer .status-value.err { color: var(--err); }
|
||||
.sidebar .footer .status-value.warn { color: var(--warn); }
|
||||
.sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }
|
||||
/* Persistent backend identity. Sits below the advertised URL so even
|
||||
when an operator has uploaded their own logo, "what is this" stays
|
||||
answerable from the bottom-left of every page. */
|
||||
.sidebar .footer .footer-version {
|
||||
margin-top: 8px; padding-top: 8px;
|
||||
border-top: 1px dashed var(--border-soft);
|
||||
color: var(--fg-dim);
|
||||
font-variant-numeric: tabular-nums;
|
||||
letter-spacing: 0.2px;
|
||||
}
|
||||
|
||||
/* ── Top bar ───────────────────────────────────────────────────────── */
|
||||
|
||||
@@ -299,7 +253,7 @@ button, .btn {
|
||||
cursor: pointer;
|
||||
transition: background 0.12s ease;
|
||||
}
|
||||
button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
|
||||
button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
|
||||
button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
|
||||
button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
|
||||
button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
|
||||
@@ -310,83 +264,23 @@ label.field {
|
||||
}
|
||||
label.field .name { color: var(--fg-dim); font-size: 12px; }
|
||||
label.field .hint { color: var(--fg-dimmer); font-size: 11px; }
|
||||
/* All single-line inputs share one chrome rule. Pre-v0.4.6 we only
|
||||
styled type=text/number, which left type=password fields rendering
|
||||
with the default browser look — visibly off vs adjacent text fields
|
||||
in the Account card. The negation list keeps `type=checkbox`,
|
||||
`type=file`, and `type=range` (none of which we use inside
|
||||
`label.field`) from picking up the padded-box look. */
|
||||
label.field input:not([type="checkbox"]):not([type="file"]):not([type="range"]),
|
||||
label.field input[type="text"],
|
||||
label.field input[type="number"],
|
||||
label.field select,
|
||||
label.field textarea {
|
||||
width: 100%; background: var(--bg); color: var(--fg);
|
||||
border: 1px solid var(--border); border-radius: var(--radius);
|
||||
padding: 7px 10px; font: inherit;
|
||||
/* iOS/Safari shrinks password-field text by default; clamp it so
|
||||
the password input matches the username input's metrics. */
|
||||
font-size: 14px; line-height: 1.4;
|
||||
box-shadow: none; -webkit-appearance: none; appearance: none;
|
||||
}
|
||||
/* v0.4.63: with `appearance: none`, the native <select> dropdown arrow
|
||||
disappears, which makes the "Metadata source" pick-list look like a
|
||||
plain (and slightly squished) text input. Paint our own chevron via
|
||||
background-image so the control still reads as a dropdown, and reserve
|
||||
right-padding for it. The data-URI SVG inherits currentColor via the
|
||||
`stroke` attribute so the arrow follows light/dark theme without a
|
||||
second declaration. */
|
||||
label.field select {
|
||||
background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%239aa0a6' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
|
||||
background-repeat: no-repeat;
|
||||
background-position: right 10px center;
|
||||
background-size: 11px 7px;
|
||||
padding-right: 30px;
|
||||
}
|
||||
:root[data-theme="light"] label.field select {
|
||||
background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 12 8' fill='none' stroke='%235a6377' stroke-width='1.6' stroke-linecap='round' stroke-linejoin='round'><polyline points='1.5,1.5 6,6 10.5,1.5'/></svg>");
|
||||
}
|
||||
label.field input:focus, label.field select:focus, label.field textarea:focus {
|
||||
outline: none; border-color: var(--accent);
|
||||
box-shadow: 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
|
||||
}
|
||||
label.check {
|
||||
display: flex; gap: 10px; align-items: center;
|
||||
padding: 8px 10px; margin-bottom: 6px;
|
||||
border: 1px solid var(--border-soft); border-radius: var(--radius);
|
||||
}
|
||||
/* v0.4.63: native checkboxes used to render as opaque black squares in
|
||||
light mode because the page meta declares `color-scheme: dark light`
|
||||
and `accent-color` alone only repaints the *check mark* (not the
|
||||
container). Take full control of the chrome so the box reads cleanly
|
||||
on both palettes and the checked state lights up in our accent. */
|
||||
label.check input[type="checkbox"] {
|
||||
appearance: none; -webkit-appearance: none;
|
||||
width: 16px; height: 16px; flex: none;
|
||||
background: var(--bg);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: 3px;
|
||||
display: inline-grid; place-content: center;
|
||||
cursor: pointer; margin: 0;
|
||||
transition: background 0.1s ease, border-color 0.1s ease;
|
||||
}
|
||||
label.check input[type="checkbox"]:hover { border-color: var(--accent); }
|
||||
label.check input[type="checkbox"]:checked {
|
||||
background: var(--accent);
|
||||
border-color: var(--accent);
|
||||
}
|
||||
label.check input[type="checkbox"]:checked::after {
|
||||
/* Classic ✓ glyph built from a rotated rectangle border. Colour is
|
||||
#002923 (the same near-black we use on solid-accent buttons) so the
|
||||
tick stays legible against the teal fill in both themes. */
|
||||
content: '';
|
||||
width: 4px; height: 8px;
|
||||
border: solid #002923;
|
||||
border-width: 0 2px 2px 0;
|
||||
transform: rotate(45deg) translate(-1px, -1px);
|
||||
}
|
||||
label.check input[type="checkbox"]:focus-visible {
|
||||
outline: none;
|
||||
box-shadow: 0 0 0 2px color-mix(in srgb, var(--accent) 35%, transparent);
|
||||
}
|
||||
label.check input { accent-color: var(--accent); }
|
||||
|
||||
/* ── Drop zone ────────────────────────────────────────────────────── */
|
||||
|
||||
@@ -504,21 +398,9 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
|
||||
.dot.err { background: var(--err); }
|
||||
.dot.warn { background: var(--warn); }
|
||||
|
||||
/* Inline form rows. The default is a 4-column grid sized for the
|
||||
Account card's "Current / New username / New password / Confirm"
|
||||
quartet; the `.cols-3` modifier swaps to a 3-column layout for the
|
||||
SSO header strip (display name / logo URL / metadata source). All
|
||||
`.form-row > label.field` children share the same baseline because
|
||||
their inner inputs share metrics via the global rule above. */
|
||||
.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; align-items: end; }
|
||||
.form-row.cols-3 { grid-template-columns: repeat(3, 1fr); }
|
||||
.form-row.cols-2 { grid-template-columns: repeat(2, 1fr); }
|
||||
.form-row label.field { margin-bottom: 0; }
|
||||
@media (max-width: 900px) {
|
||||
.form-row,
|
||||
.form-row.cols-3,
|
||||
.form-row.cols-2 { grid-template-columns: 1fr; }
|
||||
}
|
||||
/* Inline form rows. */
|
||||
.form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
|
||||
@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }
|
||||
|
||||
/* ── Queued deployment visual ────────────────────────────────────── */
|
||||
.queue-track {
|
||||
@@ -554,29 +436,26 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
|
||||
min-height: 480px;
|
||||
box-shadow: var(--shadow-card);
|
||||
}
|
||||
/* Terminal pane colours follow the active theme. Hard-coded hexes
|
||||
(#050505, #181818, #cfd6e2 etc.) were leaving the light-mode pane
|
||||
looking dark; we keep palette-aware vars instead so the toggle works. */
|
||||
.terminal .pane {
|
||||
flex: 1; overflow: auto;
|
||||
padding: 10px 14px;
|
||||
font-family: var(--mono); font-size: 12.5px; line-height: 1.5;
|
||||
color: var(--fg);
|
||||
color: #cfd6e2;
|
||||
white-space: pre-wrap; word-break: break-word;
|
||||
}
|
||||
.terminal .pane .lvl-error { color: var(--err); }
|
||||
.terminal .pane .lvl-warn { color: var(--warn); }
|
||||
.terminal .pane .lvl-info { color: var(--fg); }
|
||||
.terminal .pane .lvl-debug { color: var(--fg-dim); }
|
||||
.terminal .pane .lvl-trace { color: var(--fg-dimmer); }
|
||||
.terminal .pane .ts { color: var(--fg-dimmer); }
|
||||
.terminal .pane .tg { color: var(--accent); }
|
||||
.terminal .pane .lvl-info { color: #cfd6e2; }
|
||||
.terminal .pane .lvl-debug { color: #8b94a8; }
|
||||
.terminal .pane .lvl-trace { color: #5a6379; }
|
||||
.terminal .pane .ts { color: #5a6379; }
|
||||
.terminal .pane .tg { color: #7cd3ff; }
|
||||
.terminal .pane .echo { color: var(--accent); }
|
||||
.terminal .input-row {
|
||||
display: flex; align-items: center; gap: 8px;
|
||||
padding: 8px 14px;
|
||||
background: var(--bg-panel-2);
|
||||
border-top: 1px solid var(--border);
|
||||
background: #050505;
|
||||
border-top: 1px solid #181818;
|
||||
}
|
||||
.terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
|
||||
.terminal .input-row input {
|
||||
@@ -587,256 +466,22 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
|
||||
.terminal .toolbar {
|
||||
display: flex; gap: 8px; align-items: center;
|
||||
padding: 8px 14px;
|
||||
background: var(--bg-panel-2);
|
||||
border-bottom: 1px solid var(--border);
|
||||
background: #050505;
|
||||
border-bottom: 1px solid #181818;
|
||||
font-size: 12px; color: var(--fg-dim);
|
||||
}
|
||||
.terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
|
||||
.terminal .toolbar button {
|
||||
padding: 3px 9px; font-size: 11px;
|
||||
background: transparent; color: var(--fg-dim); border: 1px solid var(--border);
|
||||
background: transparent; color: var(--fg-dim); border: 1px solid #181818;
|
||||
font-weight: 500;
|
||||
}
|
||||
.terminal .toolbar button:hover { color: var(--fg); background: var(--bg-elev); }
|
||||
|
||||
/* ── Auth screen (first-run setup + login) ───────────────────────
|
||||
Used when /api/me reports setup_required or !authenticated. The
|
||||
regular .shell is hidden; this overlay takes the full viewport so
|
||||
the operator never sees half-loaded dashboard chrome while the auth
|
||||
state is unknown. Same palette as the rest of the UI — borrows the
|
||||
Sonarr/Radarr layout (centered narrow card on the page background).
|
||||
*/
|
||||
.auth-screen {
|
||||
position: fixed; inset: 0;
|
||||
display: flex; align-items: center; justify-content: center;
|
||||
background: var(--bg);
|
||||
padding: 24px;
|
||||
z-index: 100;
|
||||
}
|
||||
.auth-card {
|
||||
width: 100%; max-width: 380px;
|
||||
background: var(--bg-panel);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: var(--radius-lg);
|
||||
box-shadow: var(--shadow-card);
|
||||
padding: 28px 28px 22px;
|
||||
}
|
||||
.auth-card .brand-row {
|
||||
display: flex; align-items: center; gap: 12px;
|
||||
margin-bottom: 18px;
|
||||
}
|
||||
.auth-card .brand-row img { width: 32px; height: 32px; flex: none; }
|
||||
.auth-card .brand-row .name { font-size: 17px; font-weight: 600; letter-spacing: 0.2px; color: var(--fg); }
|
||||
/* v0.5.0: FleetDM-style custom logo on the login/setup card — the
|
||||
uploaded logo spans the card header and the "OpenPXE" wordmark is
|
||||
dropped (the logo is the brand). Matches the sidebar treatment. */
|
||||
.auth-card .brand-row.has-custom-logo { justify-content: center; gap: 0; margin-bottom: 22px; }
|
||||
.auth-card .brand-row.has-custom-logo img {
|
||||
width: auto; height: 52px; max-width: 240px;
|
||||
object-fit: contain; object-position: center;
|
||||
}
|
||||
.auth-card h2 {
|
||||
margin: 0 0 6px; font-size: 16px; font-weight: 600; color: var(--fg);
|
||||
}
|
||||
.auth-card .lede {
|
||||
color: var(--fg-dim); font-size: 13px; margin: 0 0 18px;
|
||||
line-height: 1.5;
|
||||
}
|
||||
.auth-card .field { margin-bottom: 12px; }
|
||||
.auth-card input[type="text"],
|
||||
.auth-card input[type="password"] {
|
||||
width: 100%; background: var(--bg); color: var(--fg);
|
||||
border: 1px solid var(--border); border-radius: var(--radius);
|
||||
padding: 9px 11px; font: inherit; font-size: 13.5px;
|
||||
}
|
||||
.auth-card input:focus { outline: none; border-color: var(--accent); }
|
||||
.auth-card .submit { width: 100%; padding: 9px 12px; margin-top: 6px; }
|
||||
.auth-card .auth-err {
|
||||
margin-top: 12px; color: var(--err); font-size: 12.5px;
|
||||
}
|
||||
.auth-card .auth-foot {
|
||||
margin-top: 14px; padding-top: 12px;
|
||||
border-top: 1px solid var(--border-soft);
|
||||
color: var(--fg-dimmer); font-size: 11.5px; text-align: center;
|
||||
}
|
||||
.auth-card .sso-btn {
|
||||
width: 100%; margin-top: 10px;
|
||||
background: transparent; color: var(--fg);
|
||||
border: 1px solid var(--border);
|
||||
padding: 9px 12px;
|
||||
}
|
||||
.auth-card .sso-btn:hover {
|
||||
background: var(--bg-panel-2); border-color: var(--accent); color: var(--fg);
|
||||
}
|
||||
.auth-card .sso-btn .meta { color: var(--fg-dim); font-size: 11px; margin-top: 2px; }
|
||||
|
||||
/* ── Top-right user menu (v0.4.6) ────────────────────────────
|
||||
The "signed in as X" identity + sign-out moved out of the sidebar
|
||||
footer in v0.4.6 — the sidebar footer is now reserved for the
|
||||
service-state trio (Service status / Advertised URL / Backend
|
||||
version). The button matches the theme toggle's size + chrome so
|
||||
the top-right reads as a tidy two-icon strip. */
|
||||
.user-menu { position: relative; }
|
||||
.user-btn {
|
||||
display: inline-flex; align-items: center; justify-content: center;
|
||||
width: 36px; height: 32px;
|
||||
background: transparent; color: var(--fg);
|
||||
border: 1px solid var(--border); border-radius: 8px;
|
||||
cursor: pointer; padding: 0;
|
||||
transition: background 0.15s ease, border-color 0.15s ease;
|
||||
}
|
||||
.user-btn:hover { background: var(--bg-panel-2); border-color: var(--accent); }
|
||||
.user-pop {
|
||||
position: absolute; right: 0; top: 38px;
|
||||
min-width: 200px;
|
||||
background: var(--bg-panel);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: var(--radius-lg);
|
||||
box-shadow: var(--shadow-card);
|
||||
padding: 6px;
|
||||
z-index: 60;
|
||||
display: flex; flex-direction: column; gap: 2px;
|
||||
}
|
||||
.user-pop[hidden] { display: none; }
|
||||
.user-pop .user-pop-name {
|
||||
padding: 8px 10px 6px;
|
||||
border-bottom: 1px solid var(--border-soft);
|
||||
margin-bottom: 4px;
|
||||
color: var(--fg); font-weight: 600; font-size: 13px;
|
||||
overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
|
||||
}
|
||||
.user-pop .user-pop-item {
|
||||
text-align: left; width: 100%;
|
||||
background: transparent; color: var(--fg);
|
||||
border: 0; border-radius: var(--radius);
|
||||
padding: 7px 10px; font: inherit; font-size: 13px; font-weight: 500;
|
||||
cursor: pointer;
|
||||
}
|
||||
.user-pop .user-pop-item:hover {
|
||||
background: var(--bg-panel-2); color: var(--fg);
|
||||
}
|
||||
.user-pop .user-pop-danger { color: var(--err); }
|
||||
.user-pop .user-pop-danger:hover {
|
||||
background: color-mix(in srgb, var(--err) 12%, transparent);
|
||||
color: var(--err);
|
||||
}
|
||||
.terminal .toolbar button:hover { color: var(--fg); background: #181818; }
|
||||
|
||||
/* ── About card ─────────────────────────────────────────────────── */
|
||||
.about-hero { padding: 20px 24px; }
|
||||
.about-hero h2 { font-size: 22px; margin: 0 0 8px; color: var(--fg); }
|
||||
/* Span the full main column rather than capping at 60ch — the page is
|
||||
read at typical desktop widths and the cap was leaving the right two
|
||||
thirds of the panel awkwardly empty. */
|
||||
.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: none; }
|
||||
.about-hero .lead { color: var(--fg-dim); font-size: 14px; max-width: 60ch; }
|
||||
.about-hero .who { margin-top: 18px; font-size: 13px; }
|
||||
.about-hero .who span { color: var(--fg-dim); }
|
||||
.about-hero .who strong { color: var(--accent); }
|
||||
.about-hero a { color: var(--accent); }
|
||||
|
||||
/* ── API reference (Settings → bottom) ─────────────────────────── */
|
||||
.api-ref { display: grid; gap: 18px; padding: 16px; }
|
||||
.api-ref .group h3 {
|
||||
margin: 0 0 8px; font-size: 13px; color: var(--fg-dim);
|
||||
text-transform: uppercase; letter-spacing: 0.8px;
|
||||
}
|
||||
.api-ref .ep {
|
||||
display: grid; grid-template-columns: 64px minmax(200px, 1fr) 2fr;
|
||||
gap: 12px; align-items: baseline;
|
||||
padding: 6px 0; border-top: 1px solid var(--border-soft);
|
||||
font-size: 13px;
|
||||
}
|
||||
.api-ref .ep:first-child { border-top: 0; }
|
||||
.api-ref .ep .method {
|
||||
font-family: var(--mono); font-weight: 600; font-size: 11px;
|
||||
padding: 2px 6px; border-radius: 4px;
|
||||
text-align: center; letter-spacing: 0.6px;
|
||||
}
|
||||
.api-ref .ep .method.get { background: color-mix(in srgb, var(--ok) 22%, transparent); color: var(--ok); }
|
||||
.api-ref .ep .method.post { background: color-mix(in srgb, var(--accent) 22%, transparent); color: var(--accent); }
|
||||
.api-ref .ep .method.put { background: color-mix(in srgb, var(--warn) 22%, transparent); color: var(--warn); }
|
||||
.api-ref .ep .method.delete { background: color-mix(in srgb, var(--err) 22%, transparent); color: var(--err); }
|
||||
.api-ref .ep .path { font-family: var(--mono); color: var(--fg); word-break: break-all; }
|
||||
.api-ref .ep .desc { color: var(--fg-dim); }
|
||||
@media (max-width: 900px) {
|
||||
.api-ref .ep { grid-template-columns: 1fr; gap: 4px; }
|
||||
.api-ref .ep .method { justify-self: start; }
|
||||
}
|
||||
|
||||
/* ── Disk space card ───────────────────────────────────────────── */
|
||||
.diskbar {
|
||||
height: 10px; border-radius: 5px;
|
||||
background: var(--bg-elev);
|
||||
overflow: hidden; margin-top: 8px;
|
||||
}
|
||||
.diskbar .fill {
|
||||
height: 100%;
|
||||
background: linear-gradient(90deg, var(--accent-dim), var(--accent));
|
||||
transition: width 0.4s ease;
|
||||
}
|
||||
.diskbar.warn .fill { background: var(--warn); }
|
||||
.diskbar.full .fill { background: var(--err); }
|
||||
.disk-meta { display: flex; gap: 14px; font-size: 12px; color: var(--fg-dim); margin-top: 8px; flex-wrap: wrap; }
|
||||
.disk-meta strong { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
|
||||
|
||||
/* ── Logo upload (Settings) ────────────────────────────────────── */
|
||||
.logo-preview {
|
||||
display: flex; align-items: center; gap: 14px;
|
||||
padding: 12px;
|
||||
background: var(--bg-panel-2);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: var(--radius);
|
||||
}
|
||||
.logo-preview .swatch {
|
||||
width: 56px; height: 56px;
|
||||
display: flex; align-items: center; justify-content: center;
|
||||
background: var(--bg); border: 1px solid var(--border);
|
||||
border-radius: var(--radius);
|
||||
flex: none;
|
||||
}
|
||||
.logo-preview .swatch img { max-width: 48px; max-height: 48px; }
|
||||
.logo-preview .info { flex: 1; min-width: 0; }
|
||||
.logo-preview .info .name { color: var(--fg); font-weight: 600; }
|
||||
.logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }
|
||||
|
||||
/* v0.5.1: collapsible "Advanced" disclosure at the bottom of Settings
|
||||
(the former Advanced sidebar tab). A quiet, full-width toggle that
|
||||
expands to reveal the notification + API-reference cards. */
|
||||
.advanced-disclosure { width: 100%; }
|
||||
.advanced-summary {
|
||||
list-style: none;
|
||||
cursor: pointer;
|
||||
user-select: none;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 8px;
|
||||
padding: 10px 14px;
|
||||
color: var(--fg-dim);
|
||||
font-size: 13px;
|
||||
font-weight: 600;
|
||||
background: var(--bg-panel-2);
|
||||
border: 1px solid var(--border);
|
||||
border-radius: var(--radius);
|
||||
}
|
||||
.advanced-summary:hover { color: var(--fg); }
|
||||
.advanced-summary::-webkit-details-marker { display: none; }
|
||||
.advanced-summary::before {
|
||||
content: "▸";
|
||||
font-size: 11px;
|
||||
transition: transform 0.15s ease;
|
||||
}
|
||||
.advanced-disclosure[open] .advanced-summary::before { transform: rotate(90deg); }
|
||||
|
||||
/* v0.5.1: protocol tag on a unified Remote-shares row (SMB / NFS). */
|
||||
.proto-badge {
|
||||
display: inline-block;
|
||||
font-size: 10px;
|
||||
font-weight: 700;
|
||||
letter-spacing: 0.04em;
|
||||
padding: 1px 6px;
|
||||
margin-right: 8px;
|
||||
border-radius: 4px;
|
||||
vertical-align: middle;
|
||||
background: var(--bg-panel-2);
|
||||
border: 1px solid var(--border);
|
||||
color: var(--fg-dim);
|
||||
}
|
||||
|
||||
+141
-1275
File diff suppressed because it is too large
Load Diff
@@ -5,15 +5,8 @@
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
<meta name="color-scheme" content="dark light" />
|
||||
<title>OpenPXE</title>
|
||||
<!-- v0.4.61: the `?v=…` query string is replaced by the server at
|
||||
request time with the running OpenPXE version. That guarantees a
|
||||
fresh URL on every upgrade so browsers (and intermediary proxies)
|
||||
can't keep serving stale JS / CSS / branding from before the
|
||||
deploy. Combined with `Cache-Control: no-cache, must-revalidate`
|
||||
on the asset handlers, the practical caching window is one
|
||||
version. -->
|
||||
<link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
|
||||
<link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
|
||||
<link rel="stylesheet" href="/assets/app.css" />
|
||||
<link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
|
||||
<!-- Theme is read from localStorage *before* paint to avoid the
|
||||
dark→light flash on every navigation. Falls back to the OS
|
||||
preference and finally to dark. -->
|
||||
@@ -32,9 +25,12 @@
|
||||
<body>
|
||||
<div class="shell">
|
||||
<aside class="sidebar">
|
||||
<div class="{{BRAND_CLASS}}">
|
||||
<img src="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" alt="OpenPXE" />
|
||||
<strong>OpenPXE</strong>
|
||||
<div class="brand">
|
||||
<img src="/assets/logo.svg" alt="" />
|
||||
<div>
|
||||
<strong>OpenPXE</strong>
|
||||
<div class="sub">v<span data-bind="version">0.4.0</span></div>
|
||||
</div>
|
||||
</div>
|
||||
<nav>
|
||||
<a data-view="dashboard" class="active">Dashboard</a>
|
||||
@@ -52,7 +48,6 @@
|
||||
<span class="count" data-bind="host_count">0</span>
|
||||
</a>
|
||||
<a data-view="terminal">Terminal</a>
|
||||
<a data-view="settings">Settings</a>
|
||||
<a data-view="about">About</a>
|
||||
</nav>
|
||||
<div class="footer">
|
||||
@@ -63,10 +58,6 @@
|
||||
</div>
|
||||
<div class="footer-sub">Advertised to clients</div>
|
||||
<code>{{BASE_URL}}</code>
|
||||
<!-- The brand badge at the top can be overridden by operator-uploaded
|
||||
logos; keep "OpenPXE v…" pinned in the footer so the backend
|
||||
identity is always visible regardless of branding. -->
|
||||
<div class="footer-version">OpenPXE v<span data-bind="version">0.4.63</span></div>
|
||||
</div>
|
||||
</aside>
|
||||
|
||||
@@ -96,32 +87,11 @@
|
||||
<path d="M20.5 14A8 8 0 0 1 10 3.5 a8 8 0 1 0 10.5 10.5z"/>
|
||||
</svg>
|
||||
</button>
|
||||
|
||||
<!-- v0.4.6: signed-in operator menu. Sits next to the theme toggle
|
||||
in the top-right corner so the sidebar footer stays clean for
|
||||
the "Service status / Advertised URL / Backend version" trio.
|
||||
The whole block is hidden until /api/me confirms a session. -->
|
||||
<div class="user-menu" data-bind="user_menu_wrap" style="display:none">
|
||||
<button id="user-menu-btn" class="user-btn" type="button"
|
||||
aria-label="Account menu" aria-haspopup="true" aria-expanded="false"
|
||||
title="Account">
|
||||
<svg viewBox="0 0 24 24" width="18" height="18" fill="none"
|
||||
stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
|
||||
<circle cx="12" cy="8" r="3.6"/>
|
||||
<path d="M4.5 20a7.5 7.5 0 0 1 15 0"/>
|
||||
</svg>
|
||||
</button>
|
||||
<div id="user-menu-pop" class="user-pop" data-bind="user_menu_pop" hidden>
|
||||
<div class="user-pop-name" data-bind="user_pop_name">—</div>
|
||||
<button type="button" class="user-pop-item" data-bind="user_pop_edit">Edit account</button>
|
||||
<button type="button" class="user-pop-item user-pop-danger" data-bind="user_pop_logout">Sign out</button>
|
||||
</div>
|
||||
</div>
|
||||
</header>
|
||||
|
||||
<main class="main" id="view-root"></main>
|
||||
</div>
|
||||
|
||||
<script src="/assets/app.js?v={{ASSET_VERSION}}"></script>
|
||||
<script src="/assets/app.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
+4
-37
@@ -7,44 +7,11 @@
|
||||
//! nav, top bar with secondary tabs, card-dense content panels.
|
||||
#![forbid(unsafe_code)]
|
||||
|
||||
/// Render the top-level page.
|
||||
///
|
||||
/// * `base_url` is interpolated into the footer so operators can see at
|
||||
/// a glance what URL clients are PXE-booting from.
|
||||
/// * `asset_version` is appended as `?v=…` to every asset URL so each
|
||||
/// release ships with brand-new asset URLs — browsers (and any
|
||||
/// intermediary proxy) can't keep serving last release's `app.js`
|
||||
/// when we know the new one is incompatible. Combined with
|
||||
/// `Cache-Control: no-cache, must-revalidate` on the asset handlers,
|
||||
/// the worst-case caching window is one version.
|
||||
/// * `logo_rev` is appended to the brand-mark and favicon URLs as an
|
||||
/// extra `&r=…` token. Unlike `asset_version` it changes every time
|
||||
/// the operator swaps the custom logo, so the top-left mark updates
|
||||
/// immediately on the next page load instead of being pinned to the
|
||||
/// release version (which only changes on upgrade). `index.html`
|
||||
/// itself is served `no-cache`, so the fresh token lands as soon as
|
||||
/// the operator reloads after an upload.
|
||||
/// * `has_custom_logo` switches the sidebar brand block between the
|
||||
/// bundled mark + "OpenPXE" wordmark (false) and a FleetDM-style
|
||||
/// full-width custom logo with the wordmark hidden (true). Rendered
|
||||
/// server-side so there's no flash of the default mark before JS runs.
|
||||
/// Render the top-level page. `base_url` is interpolated into the footer
|
||||
/// so operators can see at a glance what URL clients are PXE-booting from.
|
||||
#[must_use]
|
||||
pub fn index_html(
|
||||
base_url: &str,
|
||||
asset_version: &str,
|
||||
logo_rev: u64,
|
||||
has_custom_logo: bool,
|
||||
) -> String {
|
||||
let brand_class = if has_custom_logo {
|
||||
"brand has-custom-logo"
|
||||
} else {
|
||||
"brand"
|
||||
};
|
||||
INDEX_HTML
|
||||
.replace("{{BASE_URL}}", base_url)
|
||||
.replace("{{ASSET_VERSION}}", asset_version)
|
||||
.replace("{{LOGO_REV}}", &logo_rev.to_string())
|
||||
.replace("{{BRAND_CLASS}}", brand_class)
|
||||
pub fn index_html(base_url: &str) -> String {
|
||||
INDEX_HTML.replace("{{BASE_URL}}", base_url)
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
|
||||
+23
-104
@@ -14,14 +14,9 @@
|
||||
# Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
|
||||
# spends most of its life idle.
|
||||
|
||||
ARG RUST_VERSION=1.95
|
||||
ARG RUST_VERSION=1.82
|
||||
|
||||
########## fetch iPXE binaries + wimboot ##########
|
||||
# Pulls the upstream boot.ipxe.org pre-builds (no PNG support) plus
|
||||
# wimboot. These cover the arches we don't build from source here:
|
||||
# BIOS undionly.kpxe and i386-efi (which need a 32-bit x86 toolchain),
|
||||
# and serve as the baseline that the PNG-enabled x86_64/arm64 UEFI
|
||||
# binaries from the `ipxe-build` stage overlay on top of.
|
||||
########## fetch iPXE binaries ##########
|
||||
FROM debian:12-slim AS fetch
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
@@ -29,85 +24,27 @@ WORKDIR /src
|
||||
COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
|
||||
RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh
|
||||
|
||||
########## build PNG-enabled iPXE from source ##########
|
||||
# v0.4.69: THE graphical-boot-menu unlock. iVentoy paints a PNG
|
||||
# background on the PXE screen using stock iPXE built with
|
||||
# CONSOLE_FRAMEBUFFER + IMAGE_PNG + CONSOLE_CMD; the public iPXE
|
||||
# binaries omit those, so `console --picture` is a no-op on them.
|
||||
# We build our own from upstream with that thin config delta.
|
||||
#
|
||||
# The historical blocker was cc1 segfaulting when an amd64 gcc ran
|
||||
# under QEMU emulation on an arm64 host. The fix: pin this stage to
|
||||
# $BUILDPLATFORM (the NATIVE builder arch — arm64 on an Apple-Silicon
|
||||
# Mac, amd64 in x86 CI) and cross-compile with a real cross toolchain
|
||||
# (CROSS_COMPILE=x86_64-linux-gnu-). The compiler runs native and
|
||||
# emits x86_64 — no emulation, no segfault. arm64-efi builds natively.
|
||||
FROM --platform=$BUILDPLATFORM debian:12-slim AS ipxe-build
|
||||
# libc6-dev is REQUIRED and easy to miss under --no-install-recommends:
|
||||
# iPXE's host utilities (elf2efi, zbin) compile with the native gcc and
|
||||
# pull <stdint.h>; without the native libc headers gcc's #include_next
|
||||
# falls through to iPXE's freestanding headers and dies on bits/stdint.h.
|
||||
# The target (iPXE firmware) code is -ffreestanding/-nostdinc, so the
|
||||
# x86_64 cross toolchain needs NO cross libc headers.
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
git make perl gcc binutils libc6-dev \
|
||||
gcc-x86-64-linux-gnu binutils-x86-64-linux-gnu \
|
||||
ca-certificates \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
WORKDIR /src
|
||||
COPY scripts/build-ipxe.sh scripts/build-ipxe.sh
|
||||
COPY deploy/ipxe/local/ deploy/ipxe/local/
|
||||
RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
|
||||
|
||||
########## build openpxe ##########
|
||||
FROM rust:${RUST_VERSION}-bookworm AS build
|
||||
WORKDIR /src
|
||||
|
||||
# v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
|
||||
# move). The resulting `/openpxe` has no glibc dependency at all, which:
|
||||
# - Lets the runtime stage be any Linux distro (we still ship Debian
|
||||
# slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
|
||||
# scratch/distroless variant becomes a one-line swap).
|
||||
# - Cuts a class of "GLIBC_2.39 not found" surprises when running on
|
||||
# older RHEL/Rocky hosts that don't match Debian 12's libc version.
|
||||
# - Sidesteps cross-compilation snags (the binary is its own world).
|
||||
#
|
||||
# x86_64-unknown-linux-musl is fully static by default (no extra
|
||||
# RUSTFLAGS needed). musl-tools provides the linker.
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends musl-tools \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& rustup target add x86_64-unknown-linux-musl
|
||||
|
||||
# Copy the whole workspace in one go. We used to do a two-pass "cache-prime
|
||||
# with stubs, then real build" dance for dep-compile reuse; that turned out
|
||||
# to silently serve stale stub binaries when cargo's fingerprint didn't
|
||||
# notice the source swap. A single build is ~1.5 min longer on cold cache
|
||||
# but guarantees the binary reflects the sources we copied.
|
||||
# Do not copy rust-toolchain.toml into the image. The local workspace pins
|
||||
# developer tooling, but inside Docker we intentionally use the Rust version
|
||||
# selected by the base image. Copying rust-toolchain.toml with
|
||||
# `channel = "stable"` makes rustup download a second full toolchain during
|
||||
# `cargo build`, which is slow and can exhaust small Colima/CI disks.
|
||||
COPY Cargo.toml Cargo.lock ./
|
||||
COPY Cargo.toml rust-toolchain.toml ./
|
||||
COPY crates/ crates/
|
||||
# Baseline binaries (BIOS / i386 / wimboot), then overlay the
|
||||
# PNG-enabled x86_64 + arm64 UEFI binaries built from source. The
|
||||
# overlay wins for snponly.efi / ipxe.efi / snponly-arm64.efi so the
|
||||
# common modern clients get the graphical background; the rest keep the
|
||||
# upstream no-PNG binaries and the menu's `|| console` text fallback.
|
||||
COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
|
||||
COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
|
||||
COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
|
||||
|
||||
# Cache cargo registry + target across builds. The mtime touch is
|
||||
# Cache cargo registry + target across builds. The `--no-edit` touch is
|
||||
# belt-and-suspenders: cargo occasionally misses mtime-only changes on
|
||||
# networked FS; this forces a fingerprint check.
|
||||
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
||||
--mount=type=cache,target=/src/target,sharing=locked \
|
||||
find crates -name '*.rs' -exec touch {} + && \
|
||||
cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
|
||||
cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
|
||||
cargo build --release --bin openpxe && \
|
||||
cp target/release/openpxe /openpxe && \
|
||||
ls -l /openpxe
|
||||
|
||||
########## runtime ##########
|
||||
@@ -115,45 +52,27 @@ FROM debian:12-slim AS runtime
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
ca-certificates libcap2-bin tini gosu iproute2 \
|
||||
wimtools samba smbclient \
|
||||
wimtools samba nfs-common \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
|
||||
&& mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
|
||||
&& chown -R openpxe:openpxe /var/lib/openpxe
|
||||
# v0.4.5: the openpxe binary itself is now built against musl and is
|
||||
# fully static — no glibc dependency. The runtime stage still ships
|
||||
# Debian slim because OpenPXE shells out to the packages below for
|
||||
# functionality we deliberately don't reimplement in-process:
|
||||
#
|
||||
# wimtools - `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
|
||||
# samba - `smbd` serves extracted Windows install media on :445 so
|
||||
# WinPE can `net use`. Guest read-only, scoped to
|
||||
# /var/lib/openpxe/smb. This package provides the SERVER
|
||||
# side only; the client CLI is a separate package below.
|
||||
# smbclient - v0.4.66: Samba's `smbclient` userspace CLI, used by
|
||||
# the Storage tab's SMB shares manager to list and stream
|
||||
# ISOs from remote SMB servers without ever mounting them
|
||||
# in the kernel. In Debian 12 `smbclient` is NOT pulled
|
||||
# in by the `samba` package — they're siblings, not
|
||||
# parent/child. v0.4.65 shipped without this line and
|
||||
# every "Add share" attempt surfaced
|
||||
# `could not exec smbclient: No such file or directory`
|
||||
# until this landed.
|
||||
# iproute2 - `ip addr` / `ip route` for the auto-detected Network
|
||||
# tab fields (NIC name, subnet mask, default gateway).
|
||||
# Tiny, always available; we don't pull in netlink crates
|
||||
# for this one-shot startup probe.
|
||||
# gosu - drops privileges cleanly from root after the entrypoint
|
||||
# fixes bind-mount ownership (common OpenShift/Docker UX
|
||||
# issue).
|
||||
#
|
||||
# v0.4.65 dropped `nfs-common` — kernel-mount NFS is gone. The SMB
|
||||
# shares replacement uses userspace `smbclient` and needs no kernel
|
||||
# helpers.
|
||||
#
|
||||
# A future "openpxe-static" variant could drop everything except the
|
||||
# binary onto distroless once we move the Windows + SMB legs to
|
||||
# in-process Rust crates.
|
||||
# Runtime deps explained:
|
||||
# wimtools - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
|
||||
# samba - `smbd` serves extracted Windows install media on :445 for WinPE
|
||||
# to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
|
||||
# nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
|
||||
# NFS share manager. Mount also requires the container to run
|
||||
# with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
|
||||
# the manager surfaces a clear error in the UI instead of
|
||||
# failing silently.
|
||||
# iproute2 - `ip addr` / `ip route` for the auto-detected Network tab
|
||||
# fields (NIC name, subnet mask, default gateway). Tiny,
|
||||
# always available; we don't pull in netlink crates for
|
||||
# this one-shot startup probe.
|
||||
# gosu - drops privileges cleanly from root after the entrypoint fixes
|
||||
# bind-mount ownership (common OpenShift/Docker UX issue).
|
||||
# Windows-specific tools only activate when the WebUI toggle is on.
|
||||
|
||||
COPY --from=build /openpxe /usr/local/bin/openpxe
|
||||
COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
/*
|
||||
* OpenPXE iPXE build override — console options.
|
||||
*
|
||||
* Included at the end of config/console.h. CONSOLE_FRAMEBUFFER is the
|
||||
* unified graphical framebuffer console (EFI GOP on UEFI, VESA on
|
||||
* BIOS); it's what `console --picture` paints into. This is the same
|
||||
* single flag iVentoy enables for its graphical PXE screen.
|
||||
*
|
||||
* We *add* the framebuffer console rather than replacing the default
|
||||
* EFI/BIOS text consoles, so text output still works before/after the
|
||||
* picture is set.
|
||||
*/
|
||||
|
||||
#define CONSOLE_FRAMEBUFFER
|
||||
@@ -1,23 +0,0 @@
|
||||
/*
|
||||
* OpenPXE iPXE build override — general options.
|
||||
*
|
||||
* iPXE includes <config/local/general.h> at the end of config/general.h,
|
||||
* so anything defined here is layered on top of the stock defaults
|
||||
* without editing upstream files. We enable exactly the features the
|
||||
* graphical PXE boot menu needs:
|
||||
*
|
||||
* IMAGE_PNG - PNG decoder, so `console --picture <png>` can paint
|
||||
* the operator's logo / OpenPXE background.
|
||||
* IMAGE_PNM - Netpbm decoder (cheap; harmless belt-and-suspenders).
|
||||
* CONSOLE_CMD - the `console` command itself. Without it you get
|
||||
* "console: command not found" even with a framebuffer.
|
||||
*
|
||||
* (CONSOLE_FRAMEBUFFER lives in config/local/console.h.)
|
||||
*
|
||||
* Everything else stays at upstream defaults — we are intentionally a
|
||||
* thin, auditable delta over stock iPXE so the UBDL/GPL story is simple.
|
||||
*/
|
||||
|
||||
#define IMAGE_PNG
|
||||
#define IMAGE_PNM
|
||||
#define CONSOLE_CMD
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
fsGroup: 10001
|
||||
containers:
|
||||
- name: openpxe
|
||||
image: gitea.milesward.dev/mward4/openpxe:0.4.1
|
||||
image: gitea.milesward.dev/mward4/openpxe:0.3.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: dhcp
|
||||
|
||||
@@ -6,7 +6,7 @@ boot from OpenPXE". Pick the one that matches what you have.
|
||||
## Path A — build on Unraid, push to Gitea registry, pull by tag
|
||||
|
||||
Recommended once you've done it once. Image is published to
|
||||
`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
|
||||
`gitea.milesward.dev/mward4/openpxe:0.3.2` (or your equivalent) and
|
||||
every Unraid template / docker-compose just references the tag.
|
||||
|
||||
Pre-flight:
|
||||
@@ -40,14 +40,14 @@ What it does:
|
||||
3. `docker build` against `deploy/docker/Dockerfile`.
|
||||
4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
|
||||
so the credential never lands in your real `~/.docker/config.json`.
|
||||
5. `docker push` both `:0.4.1` and `:latest`.
|
||||
5. `docker push` both `:0.3.2` and `:latest`.
|
||||
6. Logout, scrub the temp config, delete the workspace.
|
||||
|
||||
After it finishes, in Unraid → Docker → Add Container, set:
|
||||
|
||||
| Field | Value |
|
||||
|------------|-------------------------------------------------|
|
||||
| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1` |
|
||||
| Repository | `gitea.milesward.dev/mward4/openpxe:0.3.2` |
|
||||
| Network | `host` |
|
||||
| Extra args | `--cap-add=NET_BIND_SERVICE` |
|
||||
|
||||
@@ -88,14 +88,14 @@ then:
|
||||
|
||||
```bash
|
||||
# On the build host
|
||||
docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz
|
||||
docker save openpxe:0.3.2 | gzip > openpxe-0.3.2.tar.gz
|
||||
|
||||
# Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
|
||||
scp openpxe-0.4.1.tar.gz root@unraid:/tmp/
|
||||
scp openpxe-0.3.2.tar.gz root@unraid:/tmp/
|
||||
|
||||
# On Unraid
|
||||
gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
|
||||
docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
|
||||
gunzip -c /tmp/openpxe-0.3.2.tar.gz | docker load
|
||||
docker tag openpxe:0.3.2 gitea.milesward.dev/mward4/openpxe:0.3.2
|
||||
```
|
||||
|
||||
If you want it pullable by tag from other Unraid templates, push to
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
# Phase 6 — recommendations
|
||||
|
||||
The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
|
||||
The v0.3.2 cut leaves OpenPXE in a state where the entire protocol stack
|
||||
and operator UI are exercised by the automated test suite, the container is
|
||||
multi-arch buildable, and the image ships at ~97 MB. What's left before
|
||||
this looks and feels like a 1.0 product is mostly **real-hardware
|
||||
|
||||
@@ -265,9 +265,10 @@ tab is one click from the brand bar.
|
||||
- Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
|
||||
is authoritative — disk corruption falls back to empty rather than
|
||||
failing startup.
|
||||
- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
|
||||
substitutes the literal MAC client-side, so the HTTP layer can
|
||||
short-circuit past the menu when a binding exists.
|
||||
- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
|
||||
reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
|
||||
the literal MAC client-side, so the HTTP layer can short-circuit
|
||||
past the menu when a binding exists.
|
||||
- `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.
|
||||
|
||||
**Prometheus metrics** (`crates/core/src/metrics.rs`):
|
||||
|
||||
@@ -1,106 +0,0 @@
|
||||
# PXE menu theme — research for next-release follow-up
|
||||
|
||||
Status: queued. v0.4.63 keeps the ASCII-banner fallback + `console --picture`
|
||||
compositor wired; this note captures the design for the menu-theming work
|
||||
that lands once iPXE rebuilt with `IMAGE_PNG` is published.
|
||||
|
||||
## How iVentoy actually does it
|
||||
|
||||
iVentoy is closed-source for its menu, but the supporting bits are
|
||||
public at https://github.com/ventoy/PXE — a vanilla iPXE snapshot
|
||||
(`iPXE/ipxe-bd13697`) used to produce the loader binaries iVentoy
|
||||
serves over TFTP (`pxeboot.efi`, `iventoy_loader_16000`,
|
||||
`iventoy_loader_16000_uefi`).
|
||||
|
||||
The graphical menu itself is rendered by iPXE's framebuffer console
|
||||
with a baked-in PNG background via `console --picture` — same
|
||||
primitive OpenPXE already uses in `crates/http-api/src/ipxe_script.rs`.
|
||||
Evidence:
|
||||
|
||||
- The iPXE build in `ventoy/PXE` is configured with `CONSOLE_FRAMEBUFFER`
|
||||
+ `IMAGE_PNG` + `CONSOLE_CMD` (the three flags `console --picture`
|
||||
needs).
|
||||
- iVentoy issue #11 confirms "iventoy using default 1024x768"; users
|
||||
report 800x600 / 1024x768 / 1280x720 / 1280x1024 / 1920x1080 as
|
||||
selectable resolutions from the iVentoy web UI **Configuration tab**,
|
||||
not via EDID auto-detect. iPXE has no EDID parsing; the daemon writes
|
||||
a resolution-tagged script per boot and serves the matching PNG.
|
||||
- iVentoy docs explicitly state both Free and Pro editions **do not
|
||||
support** modifying the boot background/title — it's baked into the
|
||||
shipped PNG assets.
|
||||
- Chrome is iPXE's native `menu` / `item` / `choose` widgets (single
|
||||
highlight bar, no borders) painted on top of the PNG, with margins
|
||||
set via `console --left/--right/--top/--bottom` to keep the text off
|
||||
the logo. Not GRUB, not syslinux — UEFI iVentoy uses iPXE's
|
||||
`snponly.efi` / `pxeboot.efi`, and `--picture` does work under UEFI
|
||||
GOP despite older folklore.
|
||||
|
||||
Do not conflate this with Ventoy-USB, which is a separate codebase and
|
||||
uses GRUB2 themes (`theme.txt`, `background_ventoy.png`, `select_c.png`).
|
||||
|
||||
## Rust ingredients to replicate / surpass
|
||||
|
||||
Most of these already exist in the workspace.
|
||||
|
||||
1. **Compositor (extend, don't replace)** — extend
|
||||
`crates/iso-store/src/pxe_logo.rs` to emit per-resolution PNGs
|
||||
(1024x768, 1280x1024, 1920x1080 as the v1 set). `image` +
|
||||
`imageproc` crates handle scaling; `ab_glyph` / `fontdue` for raster
|
||||
text (subtitle, hostname, version). One source SVG/logo, three to
|
||||
five rendered PNGs cached on disk.
|
||||
2. **Script generator** — `ipxe_script.rs` already emits
|
||||
`console --picture … || console`. Add a `?res=` query param (or
|
||||
per-MAC client hint persisted in `hosts.json`) and serve the matching
|
||||
PNG plus matching `console --x --y` line. Keep the text-console
|
||||
fallback already in place.
|
||||
3. **Resolution selection** — iPXE exposes `${vesa-x}` / `${vesa-y}` on
|
||||
BIOS; UEFI side we can probe firmware vars at chain-time. The simpler
|
||||
v1 is a "low-res / hi-res" toggle in Settings plus a per-host
|
||||
override — mirrors iVentoy's UX, no kernel helper needed. True EDID
|
||||
parsing is overkill for the first cut.
|
||||
4. **Chrome upgrades over iVentoy** — iPXE menus are limited (single
|
||||
highlight, no borders). To look distinctly cooler without leaving
|
||||
iPXE: paint border / title / footer **into the PNG**, leave a window
|
||||
in the middle, then `console --left/--right/--top/--bottom` to inset
|
||||
the iPXE menu exactly into that window. ASCII box-drawing inside the
|
||||
menu remains fragile (iPXE mangles non-ASCII on some builds — already
|
||||
noted in `ipxe_script.rs`).
|
||||
|
||||
## Recommended architecture for the next OpenPXE release
|
||||
|
||||
- Build a `pxe_theme` module beside `pxe_logo.rs`: takes operator logo
|
||||
+ theme tokens (accent colour, title, footer) and renders a layered
|
||||
PNG (background gradient → framing chrome → logo → title bar → footer
|
||||
with `${hostname}` / `${version}` / `${ip}`) at the three target
|
||||
resolutions. Cache by hash of inputs.
|
||||
- Serve at `/branding/pxe-menu-{w}x{h}.png`. Default 1024x768; expose a
|
||||
Settings dropdown.
|
||||
- In `ipxe_script.rs`, emit
|
||||
`console --picture …/pxe-menu-1024x768.png --left 80 --right 80 --top 180 --bottom 60 || console`,
|
||||
then the existing `menu` / `item` / `choose` block — text now lands
|
||||
inside the framed window.
|
||||
- Compile iPXE with `CONSOLE_FRAMEBUFFER`, `IMAGE_PNG`, `CONSOLE_CMD`,
|
||||
`CONSOLE_VESAFB` (BIOS) and `CONSOLE_EFIFB` (UEFI). The v0.4.61 image
|
||||
attempted this in-Docker via QEMU emulation and hit `cc1` segfaults.
|
||||
The follow-up will use a Gitea Actions runner pinned to native
|
||||
`linux/amd64` (an Unraid host already exists for this).
|
||||
- Stretch goal: a second "theme pack" that ships a layered PNG with
|
||||
subtle scanlines / grid — iPXE can't animate, but a well-designed
|
||||
static composite beats iVentoy's plain centered logo handily.
|
||||
|
||||
## Source URLs
|
||||
|
||||
- https://github.com/ventoy/PXE
|
||||
- https://github.com/ventoy/PXE/tree/master/iPXE
|
||||
- https://github.com/ventoy/PXE/issues/11 — 1024x768 default
|
||||
- https://github.com/ventoy/PXE/issues/59 — iVentoy iPXE EFI loader
|
||||
- https://ipxe.org/cmd/console — `--picture` and compile flags
|
||||
- https://github.com/ipxe/ipxe/discussions/945 — background image how-to
|
||||
- https://github.com/ipxe/ipxe/discussions/802 — `CONSOLE_FRAMEBUFFER`
|
||||
requirement
|
||||
- https://github.com/ipxe/ipxe/discussions/1006 — picture resolution
|
||||
behaviour
|
||||
- https://www.iventoy.com/en/doc_edition.html — background / title not
|
||||
user-customisable
|
||||
- https://kingtam.win/archives/iventoy.html — third-party iPXE-based
|
||||
iVentoy alternative
|
||||
@@ -1,199 +0,0 @@
|
||||
# OpenPXE v0.5.1 — SAML SSO wiring + Settings/Storage UI consolidation
|
||||
|
||||
**Date:** 2026-05-31
|
||||
**Author:** Miles Ward (with Claude)
|
||||
**Status:** Approved design → implementation
|
||||
|
||||
## Summary
|
||||
|
||||
Three workstreams for v0.5.1:
|
||||
|
||||
1. **Wire SAML 2.0 SSO** end-to-end (currently config is persisted but no runtime
|
||||
sign-in exists). Pure-Rust implementation that preserves the static-musl /
|
||||
no-OpenSSL architecture, mirroring how FleetDM exposes and handles SAML.
|
||||
2. **Fold the Advanced sidebar tab into Settings** as a collapsible section.
|
||||
3. **Merge the Storage tab's SMB and NFS cards** into one "Remote shares" card
|
||||
with a protocol dropdown.
|
||||
|
||||
Then bump `0.5.0 → 0.5.1`, build the static musl image, push `:0.5.1` + `:latest`
|
||||
to Gitea, create the release, and scrub registry credentials.
|
||||
|
||||
## Decisions (locked with the user)
|
||||
|
||||
- **Crypto:** pure-Rust via `bergshamra` (XML-DSig + exclusive c14n, RustCrypto-based,
|
||||
`#![forbid(unsafe_code)]`, ~99% xmlsec interop). `samael` is rejected — it
|
||||
hard-requires OpenSSL/`xmlsec`/`libxml2` C deps, which would break the static
|
||||
musl binary and the project's pure-Rust / no-OpenSSL architecture.
|
||||
- **Access model:** any SAML assertion the IdP successfully authenticates and that
|
||||
we cryptographically verify mints a full operator session. No user table, no
|
||||
roles, no domain allowlist. The local admin account remains a guaranteed
|
||||
fallback owner regardless of SSO state.
|
||||
- **Flows:** SP-initiated (the "Sign in with <IdP>" button) is always on.
|
||||
IdP-initiated is supported but gated behind an `allow_idp_initiated` toggle
|
||||
(default off), mirroring FleetDM's "Allow SSO login initiated by identity
|
||||
provider."
|
||||
|
||||
## Scope boundaries (v0.5.1)
|
||||
|
||||
In scope: SP-initiated + (gated) IdP-initiated login, signature verification on the
|
||||
SAML Response/Assertion, full SP-side semantic validation, SP metadata endpoint,
|
||||
login-page button wiring.
|
||||
|
||||
Out of scope (note for later releases): EncryptedAssertion (assertions must be
|
||||
unencrypted), signed AuthnRequests (sent unsigned; Keycloak "client signature
|
||||
required" must be off), Single Logout (SLO), multi-user accounts / RBAC / JIT role
|
||||
mapping.
|
||||
|
||||
---
|
||||
|
||||
## Workstream 1 — SAML SP wiring (pure-Rust)
|
||||
|
||||
### New dependencies (workspace)
|
||||
|
||||
- `bergshamra` — XML-DSig verification + exclusive c14n (pure Rust).
|
||||
- `roxmltree` (read/navigate) and/or `quick-xml` (build/serialize) — parse IdP
|
||||
metadata + SAMLResponse, build AuthnRequest and SP metadata.
|
||||
- `x509-parser` — extract the IdP signing certificate / public key from metadata.
|
||||
- `flate2` — raw DEFLATE for the HTTP-Redirect binding.
|
||||
- `base64` — encode/decode SAMLRequest/SAMLResponse.
|
||||
|
||||
All pure-Rust → the `x86_64-unknown-linux-musl` static build stays OpenSSL-free.
|
||||
Exact `bergshamra` function signatures (`verify`, `DsigContext`, `KeysManager`,
|
||||
`Key`, `VerifiedReference`, `VerifyResult`) will be pinned against the installed
|
||||
crate source during implementation.
|
||||
|
||||
### Module boundaries
|
||||
|
||||
Pure protocol logic lives in `openpxe-core` (no axum dependency, unit-testable);
|
||||
HTTP wiring lives in `openpxe-http-api`.
|
||||
|
||||
- `crates/core/src/saml/mod.rs` — public surface + shared types
|
||||
(`VerifiedPrincipal { email, display_name, name_id, session_index }`, `SamlError`).
|
||||
- `crates/core/src/saml/metadata.rs` — parse IdP `EntityDescriptor`: IdP EntityID,
|
||||
`SingleSignOnService` locations + bindings, and one or more X.509 signing
|
||||
certificates. Also build **our** SP metadata XML.
|
||||
- `crates/core/src/saml/authn_request.rs` — build an AuthnRequest, return both the
|
||||
request ID (to track) and the encoded HTTP-Redirect query value
|
||||
(deflate → base64 → URL-encode).
|
||||
- `crates/core/src/saml/response.rs` — decode `SAMLResponse` (base64 → XML),
|
||||
**verify the signature via bergshamra** against the IdP cert, then enforce SP
|
||||
semantics, returning `VerifiedPrincipal` or a typed `SamlError`.
|
||||
|
||||
### SP-side validation (response.rs)
|
||||
|
||||
After a cryptographically valid signature over the Response and/or the Assertion:
|
||||
|
||||
1. `Status` is `Success`.
|
||||
2. `Destination` (if present) equals our ACS URL.
|
||||
3. `Conditions/AudienceRestriction/Audience` equals our SP EntityID.
|
||||
4. `NotBefore` / `NotOnOrAfter` within bounds (allow small clock skew, e.g. ±60s).
|
||||
5. `InResponseTo` matches an outstanding request we issued (SP-initiated). Absent
|
||||
for IdP-initiated, which is only accepted when `allow_idp_initiated` is true.
|
||||
6. Assertion-ID replay guard: reject a previously consumed assertion ID.
|
||||
7. NameID is the email (`nameid-format:emailAddress`). Display name read from
|
||||
common attributes (`name`, `displayname`, `cn`, `urn:oid:2.5.4.3`).
|
||||
|
||||
XML Signature Wrapping (XSW) defenses come from bergshamra (duplicate-ID rejection,
|
||||
strict positional verification); enable its strict verification options. We
|
||||
additionally confirm the verified `Reference` covers the element we read claims from.
|
||||
|
||||
### State (in `openpxe-http-api`)
|
||||
|
||||
Two small TTL-pruned in-memory stores (parking_lot `Mutex<HashMap<...>>`):
|
||||
|
||||
- **Outstanding requests:** `request_id → issued_at`, TTL ≈ 5 min, for `InResponseTo`.
|
||||
- **Consumed assertions:** `assertion_id → expires_at`, TTL = assertion validity,
|
||||
for replay protection.
|
||||
|
||||
(In-memory is acceptable: a single-container app; a restart simply invalidates
|
||||
in-flight logins.)
|
||||
|
||||
### Routes (all pre-auth; added to the public allowlist in the auth middleware)
|
||||
|
||||
- `GET /api/sso/login` → build AuthnRequest, record its ID, 302 to the IdP SSO URL
|
||||
(HTTP-Redirect binding) with `SAMLRequest` + `RelayState`.
|
||||
- `POST /api/sso/acs` → consume `SAMLResponse` (form-encoded). Verify + validate.
|
||||
On success: `SessionStore::create(email)`, set the `openpxe_session` cookie
|
||||
(same attributes as forms login), 302 to the dashboard. On failure: 302 back to
|
||||
the login page with an error indicator. (Mirrors FleetDM's `/sso/callback`.)
|
||||
- `GET /api/sso/metadata` → serve our SP `EntityDescriptor` XML for IdP import.
|
||||
|
||||
### Config changes (`crates/core/src/sso.rs`)
|
||||
|
||||
Add to `SsoConfig` (preserve existing fields + validation):
|
||||
|
||||
- `entity_id: String` — SP Entity ID (mirrors FleetDM's "Entity ID"); defaults to
|
||||
the configured public base URL. The ACS URL is derived as
|
||||
`<public_base_url>/api/sso/acs`.
|
||||
- `allow_idp_initiated: bool` — default `false`.
|
||||
|
||||
`GET /api/sso` returns the new fields; `PUT /api/sso` validates and persists them.
|
||||
|
||||
### Login page (`crates/webui/src/app.js`)
|
||||
|
||||
Replace the "configured · runtime pending" message: the existing
|
||||
"Sign in with <IdP>" button navigates to `GET /api/sso/login`. Render the IdP logo
|
||||
(if `idp_logo_url` set) and use `idp_name` as the label. Keep the existing
|
||||
FleetDM-style login layout.
|
||||
|
||||
### Testing
|
||||
|
||||
- `core/saml` unit tests using a self-signed test keypair we control:
|
||||
- Parse representative Keycloak IdP metadata → correct SSO URL + cert.
|
||||
- Build an AuthnRequest → well-formed, deflate/base64 round-trips, ID recorded.
|
||||
- A correctly signed Response → `VerifiedPrincipal { email, .. }`.
|
||||
- Reject: tampered signature, expired (`NotOnOrAfter`), wrong audience,
|
||||
replayed assertion ID, unsigned response, `Status != Success`.
|
||||
- `http-api` integration test: `GET /api/sso/login` returns a 302 with a
|
||||
`SAMLRequest` query param; a crafted signed `SAMLResponse` POSTed to
|
||||
`/api/sso/acs` (signed with the test key) sets an `openpxe_session` cookie.
|
||||
|
||||
---
|
||||
|
||||
## Workstream 2 — Advanced tab → Settings
|
||||
|
||||
- Remove the `Advanced` sidebar entry (`crates/webui/src/index.html`) and its
|
||||
`advanced` view route in `app.js`.
|
||||
- In the Settings view, append a **collapsible "Advanced" disclosure**
|
||||
(default-collapsed) at the bottom containing the existing **Webhook
|
||||
Notifications** card and the **API reference** block (moved out of the removed
|
||||
Advanced view).
|
||||
- No backend changes; `/api/notify*` and `/api/docs` endpoints are unchanged.
|
||||
|
||||
---
|
||||
|
||||
## Workstream 3 — Storage: merge SMB + NFS → "Remote shares"
|
||||
|
||||
- Replace the separate "SMB shares" and "NFS shares" cards with a single
|
||||
**"Remote shares"** card:
|
||||
- One add-form with a **protocol dropdown (SMB / NFS)**. Selecting the protocol
|
||||
swaps the fields: SMB → server, share, guest checkbox, username, password;
|
||||
NFS → server, export path.
|
||||
- One unified table with a leading **Protocol** column (SMB/NFS badge), then
|
||||
server/share-or-export, auth, ISO count, reachability, and Re-scan / Remove
|
||||
actions.
|
||||
- **No backend changes.** The form dispatches to the existing
|
||||
`POST /api/smb-shares` or `POST /api/nfs-shares`; the table merges
|
||||
`GET /api/smb-shares` + `GET /api/nfs-shares`, tagging each row with its
|
||||
protocol. Re-scan/Remove call the existing per-protocol endpoints.
|
||||
- Leaves the card pattern open for a future "Config files" card.
|
||||
|
||||
---
|
||||
|
||||
## Release
|
||||
|
||||
1. Bump workspace version `0.5.0 → 0.5.1` (`Cargo.toml`).
|
||||
2. `cargo fmt`, `cargo clippy`, `cargo test` (all crates) green.
|
||||
3. Build the static musl binary + Docker image; verify SAML deps compile clean
|
||||
under musl (no OpenSSL/C linkage).
|
||||
4. Push `openpxe:0.5.1` + `openpxe:latest` to Gitea via the established
|
||||
temp-DOCKER_CONFIG pipeline; scrub credentials (logout + verify no token traces).
|
||||
5. Create the Gitea release `v0.5.1` with notes.
|
||||
|
||||
## Risks
|
||||
|
||||
- `bergshamra` is pre-1.0 and unaudited. Mitigation: pin the version, enable strict
|
||||
verification, keep the local-admin fallback, and own the SP-semantic checks
|
||||
carefully (audience/Conditions/replay/InResponseTo — where SP vulns usually live).
|
||||
- SAML is security-sensitive; negative tests (tamper/expiry/audience/replay/unsigned)
|
||||
are part of the definition of done, not optional.
|
||||
@@ -1,74 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Build PNG-enabled iPXE binaries from source.
|
||||
#
|
||||
# Why from source: the official boot.ipxe.org binaries (and the
|
||||
# Debian-packaged ones) are NOT built with CONSOLE_FRAMEBUFFER +
|
||||
# IMAGE_PNG + CONSOLE_CMD, so `console --picture` is a no-op on them —
|
||||
# you can't paint a graphical boot-menu background. iVentoy solves this
|
||||
# by shipping its own iPXE build with exactly those three flags; we do
|
||||
# the same, from upstream iPXE, with a thin auditable config delta
|
||||
# (deploy/ipxe/local/{general,console}.h).
|
||||
#
|
||||
# Why a real cross-compiler instead of QEMU: building amd64 iPXE by
|
||||
# emulating an amd64 gcc under QEMU on an arm64 host intermittently
|
||||
# segfaults cc1 (the reason this was stuck for ~8 releases). Running a
|
||||
# NATIVE arm64 gcc that cross-targets x86_64 (CROSS_COMPILE=
|
||||
# x86_64-linux-gnu-) sidesteps emulation entirely — the compiler is a
|
||||
# native binary, it just emits x86_64 objects. This stage is meant to
|
||||
# run on $BUILDPLATFORM (the native builder arch), NOT the emulated
|
||||
# target platform.
|
||||
#
|
||||
# Outputs (into $DEST), using the filenames OpenPXE's arch mapping
|
||||
# expects:
|
||||
# snponly.efi x86_64 UEFI, PNG-enabled
|
||||
# ipxe.efi x86_64 UEFI, PNG-enabled (bundled drivers)
|
||||
#
|
||||
# We build ONLY x86_64 UEFI, always via the x86_64 cross toolchain
|
||||
# (`x86_64-linux-gnu-gcc`). That's deliberately host-arch-agnostic: it
|
||||
# works whether this stage runs on an arm64 Mac builder or an amd64 CI
|
||||
# runner, because the cross compiler runs native and emits x86_64
|
||||
# either way. Building arm64-efi or BIOS here would re-introduce a
|
||||
# dependency on the host arch (native arm64 build) or a 32-bit multilib
|
||||
# toolchain — so those arches keep their upstream-fetched (no-PNG)
|
||||
# binaries and fall back to the menu's clean `|| console` text screen.
|
||||
# Modern PXE clients are overwhelmingly x86_64 UEFI, which get the full
|
||||
# graphical background.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
DEST="${1:-$ROOT/assets/ipxe}"
|
||||
WORK="$(mktemp -d)"
|
||||
trap 'rm -rf "$WORK"' EXIT
|
||||
|
||||
# Pinned upstream iPXE. Rolling master is fine functionally, but a pin
|
||||
# keeps builds reproducible and protects against a transient master
|
||||
# breakage. Bump deliberately.
|
||||
IPXE_REPO="https://github.com/ipxe/ipxe.git"
|
||||
IPXE_REF="${IPXE_REF:-master}"
|
||||
|
||||
echo ">> cloning iPXE ($IPXE_REF)"
|
||||
git clone --depth 1 --branch "$IPXE_REF" "$IPXE_REPO" "$WORK/ipxe" 2>/dev/null \
|
||||
|| git clone "$IPXE_REPO" "$WORK/ipxe"
|
||||
SRC="$WORK/ipxe/src"
|
||||
|
||||
echo ">> applying OpenPXE config overrides (PNG + framebuffer + console cmd)"
|
||||
mkdir -p "$SRC/config/local"
|
||||
cp "$ROOT/deploy/ipxe/local/general.h" "$SRC/config/local/general.h"
|
||||
cp "$ROOT/deploy/ipxe/local/console.h" "$SRC/config/local/console.h"
|
||||
|
||||
mkdir -p "$DEST"
|
||||
|
||||
# x86_64 UEFI — cross-compiled with the native arm64 gcc targeting
|
||||
# x86_64. HOST_CC stays the native cc for iPXE's build-time utilities
|
||||
# (elf2efi, zbin, …); only the target objects use the cross compiler.
|
||||
echo ">> building x86_64 UEFI (snponly.efi, ipxe.efi)"
|
||||
make -C "$SRC" -j"$(nproc)" \
|
||||
CROSS_COMPILE=x86_64-linux-gnu- \
|
||||
bin-x86_64-efi/snponly.efi \
|
||||
bin-x86_64-efi/ipxe.efi
|
||||
cp "$SRC/bin-x86_64-efi/snponly.efi" "$DEST/snponly.efi"
|
||||
cp "$SRC/bin-x86_64-efi/ipxe.efi" "$DEST/ipxe.efi"
|
||||
|
||||
echo ">> iPXE build complete:"
|
||||
ls -l "$DEST"/snponly.efi "$DEST"/ipxe.efi
|
||||
Reference in New Issue
Block a user