From 65de89601977c8c02af843982e7b70edd1913a74 Mon Sep 17 00:00:00 2001 From: catvayor Date: Tue, 27 Aug 2024 10:57:31 +0200 Subject: [PATCH 01/55] feat(ci): build VM QEMU MIPS --- .forgejo/workflows/build.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .forgejo/workflows/build.yaml diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml new file mode 100644 index 0000000..dcb2ee4 --- /dev/null +++ b/.forgejo/workflows/build.yaml @@ -0,0 +1,20 @@ +name: build liminix +on: + pull_request: + types: [opened, synchronize, edited, reopened] + branches: + - main + push: + branches: + - main + +jobs: + build_vm_qemu_mips: + runs-on: nix + steps: + - uses: actions/checkout@v3 + + - name: Build VM QEMU MIPS + run: | + # Enter the shell + nix-build -I liminix-config=./examples/hello-from-qemu.nix --arg device "import ./devices/qemu" -A outputs.default -- 2.47.0 From 2d6414ea41811adead271b60483e89f338261362 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 26 Aug 2024 17:58:40 +0200 Subject: [PATCH 02/55] tftp: introduce the FIT enclosing boot.scr This simplify TFTP. Signed-off-by: Raito Bezarius --- modules/outputs/tftpboot-fit.its | 14 +++++++++++++ modules/outputs/tftpboot.nix | 36 ++++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 modules/outputs/tftpboot-fit.its diff --git a/modules/outputs/tftpboot-fit.its b/modules/outputs/tftpboot-fit.its new file mode 100644 index 0000000..fcb58ab --- /dev/null +++ b/modules/outputs/tftpboot-fit.its @@ -0,0 +1,14 @@ +/dts-v1/; + +/ { + description = "Liminix TFTP bootscript"; + #address-cells = <1>; + + images { + bootscript { + description = "Bootscript"; + data = /incbin/("boot.scr"); + type = "script"; + compression = "none"; + }; +}; diff --git a/modules/outputs/tftpboot.nix b/modules/outputs/tftpboot.nix index f8f0572..94d5ef4 100644 --- a/modules/outputs/tftpboot.nix +++ b/modules/outputs/tftpboot.nix @@ -51,11 +51,47 @@ in { It uses the Linux `phram `_ driver to emulate a flash device using a segment of physical RAM. ''; }; + + tftpboot-fit = mkOption { + type = types.package; + description = '' + tftpboot-fit + ************ + + This output is a variant that encloses the `boot.scr` in a FIT + if that's simpler to transfer for you. + ''; + }; }; config = { boot.ramdisk.enable = true; system.outputs = rec { + tftpboot-fit = + let + tftpboot-fit = pkgs.writeText "tftpboot.its" '' + /dts-v1/; + + / { + description = "Liminix TFTP bootscript"; + #address-cells = <1>; + + images { + bootscript { + description = "Bootscript"; + data = /incbin/("${tftpboot}/boot.scr"); + type = "script"; + compression = "none"; + }; + }; + }; + ''; + in + pkgs.runCommand "tftpboot-fit" { nativeBuildInputs = with pkgs.pkgsBuildBuild; [ ubootTools ]; } '' + mkdir -p $out/ + cp -rf ${tftpboot}/* $out/ + mkimage -f ${tftpboot-fit} $out/script.ub + ''; tftpboot = let inherit (pkgs.lib.trivial) toHexString; -- 2.47.0 From 86e81efbd6657a1f977d276d5926582e8e619395 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 26 Aug 2024 17:53:08 +0200 Subject: [PATCH 03/55] tftp: introduce an alternative command line for TFTP Normal command line and TFTP command line can be sometimes very different. e.g. We don't want to load UBI filesystems for a TFTP boot as it may interfere with our root device loading. Signed-off-by: Raito Bezarius --- modules/arch/mips.nix | 3 +++ modules/base.nix | 6 ++++++ modules/outputs/tftpboot.nix | 10 +++++++++- modules/outputs/ubivolume.nix | 7 +++++++ 4 files changed, 25 insertions(+), 1 deletion(-) diff --git a/modules/arch/mips.nix b/modules/arch/mips.nix index 155c147..359bb71 100644 --- a/modules/arch/mips.nix +++ b/modules/arch/mips.nix @@ -14,5 +14,8 @@ boot.commandLine = [ "console=ttyS0,115200" # true of all mips we've yet encountered ]; + boot.tftp.commandLine = [ + "console=ttyS0,115200" # true of all mips we've yet encountered + ]; }; } diff --git a/modules/base.nix b/modules/base.nix index 1c8b67c..4c179ec 100644 --- a/modules/base.nix +++ b/modules/base.nix @@ -111,6 +111,12 @@ in { ++ lib.optional (config.rootOptions != null) "rootflags=${config.rootOptions}" ++ lib.optional (config.hardware.alternativeRootDevice != null) "altroot=${config.hardware.alternativeRootDevice}"; + boot.tftp.commandLine = [ + "panic=10 oops=panic init=/bin/init loglevel=8" + "fw_devlink=off" + "rootfstype=${config.rootfsType}" + ]; + system.callService = path : parameters : let typeChecked = caller: type: value: diff --git a/modules/outputs/tftpboot.nix b/modules/outputs/tftpboot.nix index 94d5ef4..6d5bad9 100644 --- a/modules/outputs/tftpboot.nix +++ b/modules/outputs/tftpboot.nix @@ -28,6 +28,14 @@ in { type = types.bool; default = false; }; + commandLine = mkOption { + type = types.listOf types.str; + default = config.boot.commandLine; + description = '' + TFTP-specific command line. + Defaults to the classical one if unset. + ''; + }; }; options.system.outputs = { tftpboot = mkOption { @@ -105,7 +113,7 @@ in { zimage = "bootz"; }; in choices.${cfg.kernelFormat}; - cmdline = concatStringsSep " " config.boot.commandLine; + cmdline = concatStringsSep " " config.boot.tftp.commandLine; objcopy = "${pkgs.stdenv.cc.bintools.targetPrefix}objcopy"; stripAndZip = '' ${objcopy} -O binary -R .reginfo -R .notes -R .note -R .comment -R .mdebug -R .note.gnu.build-id -S vmlinux.elf vmlinux.bin diff --git a/modules/outputs/ubivolume.nix b/modules/outputs/ubivolume.nix index 45aa889..1b9decc 100644 --- a/modules/outputs/ubivolume.nix +++ b/modules/outputs/ubivolume.nix @@ -29,6 +29,13 @@ in }; boot.initramfs.enable = true; + # In TFTP, the device named "rootfs" is the UBI device. + # We tell the kernel to load it. + # This avoids interference from the other UBI volumes. + boot.tftp.commandLine = [ + "ubi.mtd=rootfs" + ]; + system.outputs.rootfs = let inherit (pkgs.pkgsBuildBuild) runCommand; -- 2.47.0 From 8f5ea94765fb8449ca72cefa2bb1fa2e17a03fb6 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 26 Aug 2024 18:24:44 +0200 Subject: [PATCH 04/55] chore(zyxel/nwa50ax): write flash erase block size as kb size Signed-off-by: Raito Bezarius --- devices/zyxel-nwa50ax/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/zyxel-nwa50ax/default.nix b/devices/zyxel-nwa50ax/default.nix index e58430f..73f9214 100644 --- a/devices/zyxel-nwa50ax/default.nix +++ b/devices/zyxel-nwa50ax/default.nix @@ -170,7 +170,7 @@ maxLEBcount = "256"; }; - flash.eraseBlockSize = 65536; + flash.eraseBlockSize = 64 * 1024; # This is a FIT containing a kernel padded and # a UBI volume rootfs. -- 2.47.0 From ea740bbfafd96448f1161e1807763b932e830fbd Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 26 Aug 2024 18:32:46 +0200 Subject: [PATCH 05/55] fix(zyxel/nwa50ax): make `altroot` useful Let's use `ubi1` if it exist, as it should be the second device containing a rootfs. Signed-off-by: Raito Bezarius --- devices/zyxel-nwa50ax/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/zyxel-nwa50ax/default.nix b/devices/zyxel-nwa50ax/default.nix index 73f9214..e53e28f 100644 --- a/devices/zyxel-nwa50ax/default.nix +++ b/devices/zyxel-nwa50ax/default.nix @@ -181,8 +181,8 @@ # Aligned on 2kb. alignment = 2048; - rootDevice = "ubi:rootfs"; - alternativeRootDevice = "ubi:rootfs"; + rootDevice = "ubi0:rootfs"; + alternativeRootDevice = "ubi1:rootfs"; # Auto-attach MTD devices: ubi_a then ubi_b. ubi.mtds = [ "ubi_a" "ubi_b" ]; -- 2.47.0 From 85bfe94429c4c3798e10e5513e75fccacb120460 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 26 Aug 2024 18:38:01 +0200 Subject: [PATCH 06/55] fix(zyxel/nwa50ax): ensure the DTB is in the FIT Signed-off-by: Raito Bezarius --- devices/zyxel-nwa50ax/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/devices/zyxel-nwa50ax/default.nix b/devices/zyxel-nwa50ax/default.nix index e53e28f..393dcac 100644 --- a/devices/zyxel-nwa50ax/default.nix +++ b/devices/zyxel-nwa50ax/default.nix @@ -224,6 +224,7 @@ tftp = { # 5MB is nice. freeSpaceBytes = 5 * 1024 * 1024; + appendDTB = true; loadAddress = lim.parseInt "0x2000000"; }; }; -- 2.47.0 From c1e61d6af5ee0b8529d0b9f77089bd34095f5277 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 26 Aug 2024 18:55:58 +0200 Subject: [PATCH 07/55] fix(zyxel/nwa50ax): ubi cannot run on phram Discovered the hard way. Signed-off-by: Raito Bezarius --- modules/outputs/jffs2.nix | 18 ++++++------------ modules/outputs/tftpboot.nix | 23 ++++++++++++++++++----- modules/outputs/ubivolume.nix | 7 ------- pkgs/default.nix | 1 + pkgs/liminix-tools/builders/jffs2.nix | 17 +++++++++++++++++ 5 files changed, 42 insertions(+), 24 deletions(-) create mode 100644 pkgs/liminix-tools/builders/jffs2.nix diff --git a/modules/outputs/jffs2.nix b/modules/outputs/jffs2.nix index 02c7c10..0a69a1f 100644 --- a/modules/outputs/jffs2.nix +++ b/modules/outputs/jffs2.nix @@ -5,7 +5,8 @@ , ... }: let - inherit (lib) mkIf mkOption types; + inherit (pkgs) liminix; + inherit (lib) mkIf; o = config.system.outputs; in { @@ -24,17 +25,10 @@ in }; boot.initramfs.enable = true; system.outputs = { - rootfs = - let - inherit (pkgs.pkgsBuildBuild) runCommand mtdutils; - endian = if pkgs.stdenv.isBigEndian - then "--big-endian" else "--little-endian"; - in runCommand "make-jffs2" { - depsBuildBuild = [ mtdutils ]; - } '' - tree=${o.bootablerootdir} - (cd $tree && mkfs.jffs2 --compression-mode=size ${endian} -e ${toString config.hardware.flash.eraseBlockSize} --enable-compressor=lzo --pad --root . --output $out --squash --faketime ) - ''; + rootfs = liminix.builders.jffs2 { + bootableRootDirectory = o.bootablerootdir; + inherit (config.hardware.flash) eraseBlockSize; + }; }; }; } diff --git a/modules/outputs/tftpboot.nix b/modules/outputs/tftpboot.nix index 6d5bad9..ca51d10 100644 --- a/modules/outputs/tftpboot.nix +++ b/modules/outputs/tftpboot.nix @@ -5,10 +5,18 @@ , ... }: let - inherit (lib) mkOption types concatStringsSep; + inherit (lib) mkOption mkIf types concatStringsSep; + inherit (pkgs) liminix; cfg = config.boot.tftp; hw = config.hardware; arch = pkgs.stdenv.hostPlatform.linuxArch; + + # UBI cannot run on the top of phram. + needsSquashfs = config.rootfsType == "ubifs"; + rootfstype = if needsSquashfs then "squashfs" else config.rootfsType; + rootfs = if needsSquashfs then + liminix.builders.squashfs config.filesystem.contents + else config.system.outputs.rootfs; in { imports = [ ../ramdisk.nix ]; options.boot.tftp = { @@ -74,6 +82,11 @@ in { config = { boot.ramdisk.enable = true; + kernel.config = mkIf needsSquashfs { + SQUASHFS = "y"; + SQUASHFS_XZ = "y"; + }; + system.outputs = rec { tftpboot-fit = let @@ -128,7 +141,7 @@ in { hex() { printf "0x%x" $1; } rootfsStart=${toString cfg.loadAddress} - rootfsSize=$(binsize64k ${o.rootfs} ) + rootfsSize=$(binsize64k ${rootfs} ) rootfsSize=$(($rootfsSize + ${toString cfg.freeSpaceBytes} )) ln -s ${o.manifest} manifest @@ -142,13 +155,13 @@ in { dtbStart=$(($rootfsStart + $rootfsSize)) ${if cfg.compressRoot then '' - lzma -z9cv ${o.rootfs} > rootfs.lz + lzma -z9cv ${rootfs} > rootfs.lz rootfsLzStart=$dtbStart rootfsLzSize=$(binsize rootfs.lz) dtbStart=$(($dtbStart + $rootfsLzSize)) '' else '' - ln -s ${o.rootfs} rootfs + ln -s ${rootfs} rootfs '' } @@ -165,7 +178,7 @@ in { fdtput -p -t s dtb /reserved-memory/$node compatible phram fdtput -p -t lx dtb /reserved-memory/$node reg $ac_prefix $(hex $rootfsStart) $sz_prefix $(hex $rootfsSize) - cmd="liminix ${cmdline} mtdparts=phram0:''${rootfsSize}(rootfs) phram.phram=phram0,''${rootfsStart},''${rootfsSize},${toString config.hardware.flash.eraseBlockSize} root=/dev/mtdblock0"; + cmd="liminix ${cmdline} mtdparts=phram0:''${rootfsSize}(rootfs) phram.phram=phram0,''${rootfsStart},''${rootfsSize},${toString config.hardware.flash.eraseBlockSize} rootfstype=${rootfstype} root=/dev/mtdblock0"; fdtput -t s dtb /chosen ${config.boot.commandLineDtbNode} "$cmd" dtbSize=$(binsize ./dtb ) diff --git a/modules/outputs/ubivolume.nix b/modules/outputs/ubivolume.nix index 1b9decc..45aa889 100644 --- a/modules/outputs/ubivolume.nix +++ b/modules/outputs/ubivolume.nix @@ -29,13 +29,6 @@ in }; boot.initramfs.enable = true; - # In TFTP, the device named "rootfs" is the UBI device. - # We tell the kernel to load it. - # This avoids interference from the other UBI volumes. - boot.tftp.commandLine = [ - "ubi.mtd=rootfs" - ]; - system.outputs.rootfs = let inherit (pkgs.pkgsBuildBuild) runCommand; diff --git a/pkgs/default.nix b/pkgs/default.nix index b63ab3a..7bb2470 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -13,6 +13,7 @@ in { liminix = { builders = { squashfs = callPackage ./liminix-tools/builders/squashfs.nix {}; + jffs2 = callPackage ./liminix-tools/builders/jffs2.nix {}; dtb = callPackage ./kernel/dtb.nix {}; uimage = callPackage ./kernel/uimage.nix {}; kernel = callPackage ./kernel {}; diff --git a/pkgs/liminix-tools/builders/jffs2.nix b/pkgs/liminix-tools/builders/jffs2.nix new file mode 100644 index 0000000..62378b4 --- /dev/null +++ b/pkgs/liminix-tools/builders/jffs2.nix @@ -0,0 +1,17 @@ +{ + stdenv +, busybox +, buildPackages +, callPackage +, pseudofile +, runCommand +, writeText +} : { eraseBlockSize, bootableRootDirectory }: +let + endian = if stdenv.isBigEndian then "--big-endian" else "--little-endian"; +in runCommand "frob-jffs2" { + depsBuildBuild = [ buildPackages.mtdutils ]; + } '' + tree=${bootableRootDirectory} + (cd $tree && mkfs.jffs2 --compression-mode=size ${endian} -e ${toString eraseBlockSize} --enable-compressor=lzo --pad --root . --output $out --squash --faketime) + '' -- 2.47.0 From 17355c3911836e76b4c113a74e70e681a4316c7a Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 26 Aug 2024 20:01:34 +0200 Subject: [PATCH 08/55] fix(preinit): scan multiple times the cmdline and rename altroot in rootalt The way the parsing works is examining one character at a time. First, if we had `rootfstype=... root=...`, the parsing would jump and ignore `root=...`, which sucks. To fix this, we scan multiple times a copy of the cmdline. Now, we have a new problem: `root=... altroot=...` lead to opts.device being equal to the altroot as we are looking one char at a time, so we will arrive at a moment looking at `root=...` for `altroot=...`. To avoid this, we rename `altroot` in `rootalt`, cheap, I know. Signed-off-by: Raito Bezarius --- modules/base.nix | 2 +- pkgs/preinit/parseopts.c | 36 ++++++++++++++++++++++++++---------- 2 files changed, 27 insertions(+), 11 deletions(-) diff --git a/modules/base.nix b/modules/base.nix index 4c179ec..d2182c6 100644 --- a/modules/base.nix +++ b/modules/base.nix @@ -109,7 +109,7 @@ in { ] ++ (map (mtd: "ubi.mtd=${mtd}") config.hardware.ubi.mtds) ++ lib.optional (config.rootOptions != null) "rootflags=${config.rootOptions}" - ++ lib.optional (config.hardware.alternativeRootDevice != null) "altroot=${config.hardware.alternativeRootDevice}"; + ++ lib.optional (config.hardware.alternativeRootDevice != null) "rootalt=${config.hardware.alternativeRootDevice}"; boot.tftp.commandLine = [ "panic=10 oops=panic init=/bin/init loglevel=8" diff --git a/pkgs/preinit/parseopts.c b/pkgs/preinit/parseopts.c index 1803341..243f3b0 100644 --- a/pkgs/preinit/parseopts.c +++ b/pkgs/preinit/parseopts.c @@ -65,13 +65,18 @@ static char * eat_param(char *p, char *param_name, char **out) return p; } +#define SCAN_CMDLINE(cmdline, identifier, field) do { \ + for (char* p = strdup(cmdline); *p; p++) { \ + p = eat_param(p, identifier, &(opts->field)); \ + } \ +} while(0) + + void parseopts(char * cmdline, struct root_opts *opts) { - for(char *p = cmdline; *p; p++) { - p = eat_param(p, "root=", &(opts->device)); - p = eat_param(p, "rootfstype=", &(opts->fstype)); - p = eat_param(p, "rootflags=", &(opts->mount_opts)); - p = eat_param(p, "altroot=", &(opts->altdevice)); - }; + SCAN_CMDLINE(cmdline, "root=", device); + SCAN_CMDLINE(cmdline, "rootfstype=", fstype); + SCAN_CMDLINE(cmdline, "rootflags=", mount_opts); + SCAN_CMDLINE(cmdline, "rootalt=", altdevice); } #ifdef TESTS @@ -85,6 +90,8 @@ void parseopts(char * cmdline, struct root_opts *opts) { #define S(x) #x #define expect_equal(actual, expected) \ if(!actual || strcmp(actual, expected)) die("%d: expected \"%s\", got \"%s\"", __LINE__, expected, actual); +#define expect_null(actual) \ + if (actual) die("%d: expected null, got \"%s\"", __LINE__, actual); int main() @@ -92,6 +99,7 @@ int main() struct root_opts opts = { .device = "/dev/hda1", .fstype = "xiafs", + .altdevice = NULL, .mount_opts = NULL }; char *buf; @@ -103,14 +111,22 @@ int main() expect_equal(opts.fstype, "ubifs"); expect_equal(opts.mount_opts, "subvol=1"); - // finds altroot= options - buf = strdup("liminix console=ttyS0,115200 panic=10 oops=panic init=/bin/init loglevel=8 root=/dev/ubi0_4 rootfstype=ubifs rootflags=subvol=1 fw_devlink=off mtdparts=phram0:18M(rootfs) phram.phram=phram0,0x40400000,18874368,65536 root=/dev/mtdblock0 altroot=/dev/mtdblock6 foo"); + // finds rootalt= options + buf = strdup("liminix console=ttyS0,115200 panic=10 oops=panic init=/bin/init loglevel=8 root=/dev/ubi0_4 rootfstype=ubifs rootflags=subvol=1 fw_devlink=off mtdparts=phram0:18M(rootfs) phram.phram=phram0,0x40400000,18874368,65536 root=/dev/mtdblock0 rootalt=/dev/mtdblock6 foo"); memset(&opts, '\0', sizeof opts); parseopts(buf, &opts); expect_equal(opts.device, "/dev/mtdblock0"); expect_equal(opts.altdevice, "/dev/mtdblock6"); expect_equal(opts.fstype, "ubifs"); expect_equal(opts.mount_opts, "subvol=1"); + // Ensure that `altdevice` is NULL. + buf = strdup("liminix console=ttyS0,115200 panic=10 oops=panic init=/bin/init loglevel=8 fw_devlink=off rootfstype=ubifs mtdparts=phram0:19791872(rootfs) phram.phram=phram0,33554432,19791872,65536 rootfstype=jffs2 root=/dev/mtdblock0"); + memset(&opts, '\0', sizeof opts); parseopts(buf, &opts); + expect_equal(opts.device, "/dev/mtdblock0"); + expect_null(opts.altdevice); + expect_equal(opts.fstype, "jffs2"); + expect_null(opts.mount_opts); + // in case of duplicates, chooses the latter // also: works if the option is end of string buf = strdup("liminix console=ttyS0,115200 panic=10 oops=panic init=/bin/init loglevel=8 root=/dev/ubi0_4 rootfstype=ubifs fw_devlink=off mtdparts=phram0:18M(rootfs) phram.phram=phram0,0x40400000,18874368,65536 root=/dev/mtdblock0"); @@ -146,12 +162,12 @@ int main() if(opts.altdevice) die("expected null altdevice, got \"%s\"", opts.altdevice); // provides empty strings for empty options - buf = strdup("liminix rootfstype= fw_devlink=off root= altroot= /dev/hda1"); + buf = strdup("liminix rootfstype= fw_devlink=off root= rootalt= /dev/hda1"); memset(&opts, '\0', sizeof opts); parseopts(buf, &opts); if(strlen(opts.fstype)) die("expected empty rootfstype, got \"%s\"", opts.fstype); if(strlen(opts.device)) die("expected empty root, got \"%s\"", opts.device); - if(strlen(opts.altdevice)) die("expected empty altroot, got \"%s\"", opts.altdevice); + if(strlen(opts.altdevice)) die("expected empty rootalt, got \"%s\"", opts.altdevice); expect_equal("01", pr_u32(1)); expect_equal("ab", pr_u32(0xab)); -- 2.47.0 From 3d528a71e97e8b6d238e1a3317de82ccc82e811f Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 26 Aug 2024 21:40:09 +0200 Subject: [PATCH 09/55] feat(hostapd): make the package configurable to enable RADIUS The default hostapd disable too many things, we need a bit more for RADIUS. Signed-off-by: Raito Bezarius --- modules/hostapd/default.nix | 4 ++++ modules/hostapd/service.nix | 5 ++--- overlay.nix | 36 ++++++++++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+), 3 deletions(-) diff --git a/modules/hostapd/default.nix b/modules/hostapd/default.nix index 2bcf4d6..4338e74 100644 --- a/modules/hostapd/default.nix +++ b/modules/hostapd/default.nix @@ -26,6 +26,10 @@ in { interface = mkOption { type = liminix.lib.types.service; }; + package = mkOption { + type = types.package; + default = pkgs.hostapd; + }; params = mkOption { type = types.attrs; }; diff --git a/modules/hostapd/service.nix b/modules/hostapd/service.nix index 2bd5453..68e9754 100644 --- a/modules/hostapd/service.nix +++ b/modules/hostapd/service.nix @@ -1,10 +1,9 @@ { liminix -, hostapd , writeText , lib }: -{ interface, params} : +{ package, interface, params } : let inherit (liminix.services) longrun; inherit (lib) concatStringsSep mapAttrsToList; @@ -35,5 +34,5 @@ let in longrun { inherit name; dependencies = [ interface ]; - run = "${hostapd}/bin/hostapd -i $(output ${interface} ifname) -P /run/${name}.pid -S ${conf}"; + run = "${package}/bin/hostapd -i $(output ${interface} ifname) -P /run/${name}.pid -S ${conf}"; } diff --git a/overlay.nix b/overlay.nix index 09acaad..374c79a 100644 --- a/overlay.nix +++ b/overlay.nix @@ -143,6 +143,42 @@ extraPkgs // { }); in h.override { openssl = null; sqlite = null; }; + hostapd-radius = + let + config = [ + "CONFIG_DRIVER_NL80211=y" + "CONFIG_DRIVER_WIRED=y" + "CONFIG_EAP=y" + "CONFIG_EAP_PEAP=y" + "CONFIG_RADIUS_SERVER=y" + "CONFIG_FULL_DYNAMIC_VLAN=y" + "CONFIG_IAPP=y" + "CONFIG_IEEE80211AC=y" + "CONFIG_IEEE80211AX=y" + "CONFIG_IEEE80211N=y" + "CONFIG_IEEE80211W=y" + "CONFIG_INTERNAL_LIBTOMMATH=y" + "CONFIG_INTERNAL_LIBTOMMATH_FAST=y" + "CONFIG_IPV6=y" + "CONFIG_LIBNL32=y" + "CONFIG_PKCS12=y" + "CONFIG_RSN_PREAUTH=y" + # Required to read the key material for RADIUS. + "CONFIG_TLS=openssl" + ]; + h = prev.hostapd.overrideAttrs(o: { + extraConfig = ""; + configurePhase = '' + cat > hostapd/defconfig < Date: Sat, 31 Aug 2024 20:28:23 +0200 Subject: [PATCH 10/55] feat(mtd-utils): save more space Signed-off-by: Raito Bezarius --- overlay.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/overlay.nix b/overlay.nix index 374c79a..2b46089 100644 --- a/overlay.nix +++ b/overlay.nix @@ -204,6 +204,11 @@ extraPkgs // { patches = (if o ? patches then o.patches else []) ++ [ ./pkgs/mtdutils/0001-mkfs.jffs2-add-graft-option.patch ]; + + postInstall = '' + # Testing programs which we don't need. We save a lot of space! + rm -rf $out/libexec + ''; }); nftables = prev.nftables.overrideAttrs(o: { -- 2.47.0 From f34a63d1c8df2ec751760f0fd1636d74bc2f8757 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 31 Aug 2024 21:23:17 +0200 Subject: [PATCH 11/55] feat(pki): init TLS PKI module Signed-off-by: Raito Bezarius --- modules/pki/default.nix | 83 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 modules/pki/default.nix diff --git a/modules/pki/default.nix b/modules/pki/default.nix new file mode 100644 index 0000000..b328f4d --- /dev/null +++ b/modules/pki/default.nix @@ -0,0 +1,83 @@ +{ config, lib, pkgs, ... }: +# Inspired from nixpkgs/NixOS. + +with lib; + +let + inherit (pkgs.pseudofile) dir symlink; + cfg = config.security.pki; + + cacertPackage = pkgs.cacert.override { + blacklist = [ ]; + extraCertificateFiles = cfg.certificateFiles; + extraCertificateStrings = cfg.certificates; + }; + caBundleName = "ca-bundle.crt"; + caBundle = "${cacertPackage}/etc/ssl/certs/${caBundleName}"; + +in + +{ + + options = { + security.pki.installCACerts = mkEnableOption "installing CA certificates to the system" // { + default = false; + }; + + security.pki.certificateFiles = mkOption { + type = types.listOf types.path; + default = []; + example = literalExpression ''[ "''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ]''; + description = '' + A list of files containing trusted root certificates in PEM + format. These are concatenated to form + {file}`/etc/ssl/certs/ca-certificates.crt`, which is + used by many programs that use OpenSSL, such as + {command}`curl` and {command}`git`. + ''; + }; + + security.pki.certificates = mkOption { + type = types.listOf types.str; + default = []; + example = literalExpression '' + [ ''' + NixOS.org + ========= + -----BEGIN CERTIFICATE----- + MIIGUDCCBTigAwIBAgIDD8KWMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJ + TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0 + ... + -----END CERTIFICATE----- + ''' + ] + ''; + description = '' + A list of trusted root certificates in PEM format. + ''; + }; + }; + + config = mkIf cfg.installCACerts { + # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility. + filesystem = dir { + etc = dir { + ssl = dir { + certs = dir { + "ca-certificates.crt" = symlink caBundle; + "ca-bundle.crt" = symlink caBundle; + }; + }; + + # CentOS/Fedora compatibility. + pki = dir { + certs = dir { + "ca-bundle.crt" = symlink caBundle; + }; + }; + }; + }; + }; + +} + -- 2.47.0 From 664624a478ff0952f5b2f87769de43552d888896 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 31 Aug 2024 20:44:22 +0200 Subject: [PATCH 12/55] feat(jitterentropy): introduce a jitterentropy module Signed-off-by: Raito Bezarius --- modules/all-modules.nix | 1 + modules/jitter-rng/default.nix | 21 +++++++++++++++++++++ modules/jitter-rng/jitter-rng.nix | 18 ++++++++++++++++++ 3 files changed, 40 insertions(+) create mode 100644 modules/jitter-rng/default.nix create mode 100644 modules/jitter-rng/jitter-rng.nix diff --git a/modules/all-modules.nix b/modules/all-modules.nix index abce5db..98352c1 100644 --- a/modules/all-modules.nix +++ b/modules/all-modules.nix @@ -8,6 +8,7 @@ ./bridge ./busybox.nix ./dhcp6c + ./jitter-rng ./dnsmasq ./firewall ./hardware.nix diff --git a/modules/jitter-rng/default.nix b/modules/jitter-rng/default.nix new file mode 100644 index 0000000..aa6f9e5 --- /dev/null +++ b/modules/jitter-rng/default.nix @@ -0,0 +1,21 @@ +## CPU Jitter RNG +## ============== +## +## CPU Jitter RNG is a random number generator # providing non-physical true +## random generation # that works equally for kernel and user-land. It relies +## on the availability of a high-resolution timer. +{ lib, pkgs, ... }: +let + inherit (lib) mkOption types; + inherit (pkgs) liminix; +in { + options.system.service.jitter-rng = mkOption { + type = liminix.lib.types.serviceDefn; + }; + + config = { + system.service.jitter-rng = pkgs.liminix.callService ./jitter-rng.nix { + }; + }; +} + diff --git a/modules/jitter-rng/jitter-rng.nix b/modules/jitter-rng/jitter-rng.nix new file mode 100644 index 0000000..1072be1 --- /dev/null +++ b/modules/jitter-rng/jitter-rng.nix @@ -0,0 +1,18 @@ +{ + liminix +, lib +, jitterentropy-rngd +}: +{ }: +let + inherit (liminix.services) longrun; + name = "jitterentropy-rngd"; +in +longrun { + # Does it need to be unique? + inherit name; + run = '' + mkdir -p /run/jitterentropy-rngd + ${jitterentropy-rngd}/bin/jitterentropy-rngd -v -p /run/jitterentropy-rngd/${name}.pid + ''; +} -- 2.47.0 From 36f3015acdf58d37033e7d78fa6029b5fd2f0df5 Mon Sep 17 00:00:00 2001 From: Daniel Barlow Date: Sat, 15 Jun 2024 15:34:49 +0100 Subject: [PATCH 13/55] dhcpc handle case when env vars are missing the notify-script should continue and signal readiness even if one or more of the outputs it writes are mssing in the environment --- modules/network/dhcpc.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/network/dhcpc.nix b/modules/network/dhcpc.nix index ed665b3..cd652b2 100644 --- a/modules/network/dhcpc.nix +++ b/modules/network/dhcpc.nix @@ -17,7 +17,7 @@ let ip address replace $ip/$mask dev $interface (in_outputs ${name} for i in lease mask ip router siaddr dns serverid subnet opt53 interface ; do - printenv $i > $i + (printenv $i || true) > $i done) } case $action in @@ -40,7 +40,7 @@ let ''; in longrun { inherit name; - run = "/bin/udhcpc -f -i $(output ${interface} ifname) -x hostname:$(cat /proc/sys/kernel/hostname) -s ${script}"; + run = "exec /bin/udhcpc -f -i $(output ${interface} ifname) -x hostname:$(cat /proc/sys/kernel/hostname) -s ${script}"; notification-fd = 10; dependencies = [ interface ]; } -- 2.47.0 From 1d0fc24111cab325ea65e7de12b2e14ccb51e93c Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 1 Sep 2024 01:32:45 +0200 Subject: [PATCH 14/55] fix(bridge/members): log attach/detach Signed-off-by: Raito Bezarius --- modules/bridge/members.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/bridge/members.nix b/modules/bridge/members.nix index a278730..114bc2e 100644 --- a/modules/bridge/members.nix +++ b/modules/bridge/members.nix @@ -21,9 +21,13 @@ let service = oneshot { name = "${primary.name}.member.${member.name}"; up = '' + echo "attaching $(output ${member} ifname) to $(output ${primary} ifname) bridge" ip link set dev $(output ${member} ifname) master $(output ${primary} ifname) ''; - down = "ip link set dev $(output ${member} ifname) nomaster"; + down = '' + echo "detaching $(output ${member} ifname) from any bridge" + ip link set dev $(output ${member} ifname) nomaster + ''; }; }; in bundle { -- 2.47.0 From ca9642a61e87a00923df6801b4c3f0e366a72140 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 1 Sep 2024 02:05:33 +0200 Subject: [PATCH 15/55] fix(ifwait): return :present if newlink is up/yes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Urgh… Signed-off-by: Raito Bezarius --- pkgs/ifwait/ifwait.fnl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/ifwait/ifwait.fnl b/pkgs/ifwait/ifwait.fnl index cc5e76c..52122bd 100644 --- a/pkgs/ifwait/ifwait.fnl +++ b/pkgs/ifwait/ifwait.fnl @@ -23,7 +23,7 @@ {:present true :up true :running true} {:event "newlink" :name params.link :up :yes} - {:present :true :up true} + {:present true :up true} {:event "newlink" :name params.link} {:present true } -- 2.47.0 From f0b4e826cb32f5a66b67bc002b2753ffa8c285dc Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 1 Sep 2024 02:13:36 +0200 Subject: [PATCH 16/55] fix(ifwait): match over strings and not symbols Are they the same in Fennel? Signed-off-by: Raito Bezarius --- pkgs/ifwait/ifwait.fnl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/ifwait/ifwait.fnl b/pkgs/ifwait/ifwait.fnl index 52122bd..f835ebb 100644 --- a/pkgs/ifwait/ifwait.fnl +++ b/pkgs/ifwait/ifwait.fnl @@ -19,10 +19,10 @@ (match v ;; - up: Reflects the administrative state of the interface (IFF_UP) ;; - running: Reflects the operational state (IFF_RUNNING). - {:event "newlink" :name params.link :up :yes :running :yes} + {:event "newlink" :name params.link :up "yes" :running "yes"} {:present true :up true :running true} - {:event "newlink" :name params.link :up :yes} + {:event "newlink" :name params.link :up "yes"} {:present true :up true} {:event "newlink" :name params.link} -- 2.47.0 From 21ff11503eb283f52bc5abc47fbb05d80bae0d01 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 1 Sep 2024 14:56:08 +0200 Subject: [PATCH 17/55] fix(bridge): pick up MAC from another interface This avoids the OPERSTATE unknown when the bridge is brought up but the members are not ready yet. This will make OPERSTATE to down, enabling us to wait until we have brought up completely all the members. Signed-off-by: Raito Bezarius --- modules/bridge/default.nix | 6 ++++++ modules/bridge/primary.nix | 11 ++++++++--- pkgs/liminix-tools/networking/default.nix | 1 + 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/modules/bridge/default.nix b/modules/bridge/default.nix index 32df4a5..fd779f8 100644 --- a/modules/bridge/default.nix +++ b/modules/bridge/default.nix @@ -28,6 +28,12 @@ in type = types.str; description = "bridge interface name to create"; }; + + macAddressFromInterface = mkOption { + type = types.nullOr liminix.lib.types.service; + default = null; + description = "reuse mac address from an existing interface service"; + }; }; members = config.system.callService ./members.nix { primary = mkOption { diff --git a/modules/bridge/primary.nix b/modules/bridge/primary.nix index c25e5fe..aa7822c 100644 --- a/modules/bridge/primary.nix +++ b/modules/bridge/primary.nix @@ -3,15 +3,20 @@ , ifwait , lib }: -{ ifname } : +{ ifname, macAddressFromInterface ? null } : let inherit (liminix.services) bundle oneshot; - inherit (lib) mkOption types; + inherit (lib) mkOption types optional; in oneshot rec { name = "${ifname}.link"; up = '' - ip link add name ${ifname} type bridge + ${if macAddressFromInterface == null then + "ip link add name ${ifname} type bridge" + else + "ip link add name ${ifname} address $(output ${macAddressFromInterface} ether) type bridge"} ${liminix.networking.ifup name ifname} ''; down = "ip link set down dev ${ifname}"; + + dependencies = optional (macAddressFromInterface != null) macAddressFromInterface; } diff --git a/pkgs/liminix-tools/networking/default.nix b/pkgs/liminix-tools/networking/default.nix index aed7c4e..b51b367 100644 --- a/pkgs/liminix-tools/networking/default.nix +++ b/pkgs/liminix-tools/networking/default.nix @@ -9,6 +9,7 @@ ip link set up dev ${ifname} (in_outputs ${name} echo ${ifname} > ifname + cat /sys/class/net/${ifname}/address > ether ) ''; } -- 2.47.0 From 1bd9af1e9d38d8b241f1d838e4af98e1b13b958b Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 1 Sep 2024 15:42:26 +0200 Subject: [PATCH 18/55] fix(bridge): reorder initialization for bridge dependents Consider the scenario where you run DHCPv4 on the primary bridge interface. You have no real interface to "wait upon", so it's OK. Nonetheless, anything depending on successful completion of DHCPv4, e.g. adding a default route, will block `s6-rc -v2 up change default`. The way new interfaces are attached to the bridge is via `s6-rc -b -u change $attach-oneshot-service`, this introduce in turn a deadlock. At some point, DHCPv4 will timeout, unblocking the deadlock and attaching the members to the primary bridge interface, making it ready to send L2 broadcast packets for DHCP, unblocking DHCP in turn again. This is not satisfying because we really want to have a no-hiccups bring-up. To fix this, we proceed to multiple changes: - we remove `svc.ifwait.build` out of band `s6-rc -b -u $oneshot-attach` call, which is, by design, wrong here. - users can now depend on the members service to know when a bridge is fully operational (we could make it more granular and let them depend on the LAN member joining rather than WLAN, etc.) - users can also depend on the primary service being brought up rather than just being present, this is useful if you need to bring it up when it has AT LEAST one member to get link local address or MAC addresses (fixing DHCPv6 bring up as well because `ff02::1` is used there). One thing is not addressed yet, if you are running a WLAN service using RADIUS attached to the bridge, at bring up time, it will try to reach out the external RADIUS server and *fail*. To solve this, granular dependency on the DHCPv4 once LAN is joined. Then the hostapd can wait on defaultroute4 completion so that connectivity is available to reach RADIUS server. It can join the bridge later on without any hiccup as well. This is left as a TODO as hostapd can survive RADIUS authentication failure and retry later. Signed-off-by: Raito Bezarius --- modules/bridge/default.nix | 14 ++++++++++++++ modules/bridge/members.nix | 33 +++++++++++++-------------------- modules/bridge/primary.nix | 8 ++++++-- modules/bridge/ready.nix | 18 ++++++++++++++++++ 4 files changed, 51 insertions(+), 22 deletions(-) create mode 100644 modules/bridge/ready.nix diff --git a/modules/bridge/default.nix b/modules/bridge/default.nix index fd779f8..4c2911a 100644 --- a/modules/bridge/default.nix +++ b/modules/bridge/default.nix @@ -20,6 +20,7 @@ in system.service.bridge = { primary = mkOption { type = liminix.lib.types.serviceDefn; }; members = mkOption { type = liminix.lib.types.serviceDefn; }; + ready = mkOption { type = liminix.lib.types.serviceDefn; }; }; }; config.system.service.bridge = { @@ -46,6 +47,19 @@ in description = "interfaces to add to the bridge"; }; }; + + # TODO: generalize it outside + ready = config.system.callService ./ready.nix { + primary = mkOption { + type = liminix.lib.types.service; + description = "primary bridge interface"; + }; + + members = mkOption { + type = liminix.lib.types.service; + description = "members service"; + }; + }; }; config.kernel.config = { BRIDGE = "y"; diff --git a/modules/bridge/members.nix b/modules/bridge/members.nix index 114bc2e..2171eda 100644 --- a/modules/bridge/members.nix +++ b/modules/bridge/members.nix @@ -10,26 +10,19 @@ let inherit (liminix.networking) interface; inherit (liminix.services) bundle oneshot; inherit (lib) mkOption types; - addif = member : - # how do we get sight of services from here? maybe we need to - # implement ifwait as a regualr derivation instead of a - # servicedefinition - svc.ifwait.build { - state = "running"; - interface = member; - dependencies = [ primary member ]; - service = oneshot { - name = "${primary.name}.member.${member.name}"; - up = '' - echo "attaching $(output ${member} ifname) to $(output ${primary} ifname) bridge" - ip link set dev $(output ${member} ifname) master $(output ${primary} ifname) - ''; - down = '' - echo "detaching $(output ${member} ifname) from any bridge" - ip link set dev $(output ${member} ifname) nomaster - ''; - }; - }; + addif = member : oneshot { + name = "${primary.name}.member.${member.name}"; + up = '' + echo "attaching $(output ${member} ifname) to $(output ${primary} ifname) bridge" + ip link set dev $(output ${member} ifname) master $(output ${primary} ifname) + ''; + down = '' + echo "detaching $(output ${member} ifname) from any bridge" + ip link set dev $(output ${member} ifname) nomaster + ''; + + dependencies = [ primary member ]; + }; in bundle { name = "${primary.name}.members"; contents = map addif members; diff --git a/modules/bridge/primary.nix b/modules/bridge/primary.nix index aa7822c..f5e1219 100644 --- a/modules/bridge/primary.nix +++ b/modules/bridge/primary.nix @@ -14,9 +14,13 @@ in oneshot rec { "ip link add name ${ifname} type bridge" else "ip link add name ${ifname} address $(output ${macAddressFromInterface} ether) type bridge"} - ${liminix.networking.ifup name ifname} + + (in_outputs ${name} + echo ${ifname} > ifname + cat /sys/class/net/${ifname}/address > ether + ) ''; - down = "ip link set down dev ${ifname}"; + down = "ip link delete ${ifname}"; dependencies = optional (macAddressFromInterface != null) macAddressFromInterface; } diff --git a/modules/bridge/ready.nix b/modules/bridge/ready.nix new file mode 100644 index 0000000..f8c40b3 --- /dev/null +++ b/modules/bridge/ready.nix @@ -0,0 +1,18 @@ +{ + liminix +, ifwait +, lib +}: +{ primary, members } : +let + inherit (liminix.services) oneshot; +in oneshot { + name = "${primary.name}.oper"; + up = '' + ip link set up dev $(output ${primary} ifname) + ${ifwait}/bin/ifwait -v $(output ${primary} ifname) running + ''; + down = "ip link set down dev $(output ${primary} ifname)"; + + dependencies = [ members ]; +} -- 2.47.0 From eb083bee203f584542ecf79ce229e21b25cebb1b Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 4 Sep 2024 15:53:19 +0200 Subject: [PATCH 19/55] libubox: init at unstable-04-09-2024 Signed-off-by: Raito Bezarius --- pkgs/default.nix | 1 + pkgs/libubox/default.nix | 46 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 pkgs/libubox/default.nix diff --git a/pkgs/default.nix b/pkgs/default.nix index 7bb2470..3c372c7 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -110,6 +110,7 @@ in { swconfig = callPackage ./swconfig {}; systemconfig = callPackage ./systemconfig {}; tufted = callPackage ./tufted {}; + libubox = callPackage ./libubox {}; uevent-watch = callPackage ./uevent-watch {}; usb-modeswitch = callPackage ./usb-modeswitch {}; writeAshScript = callPackage ./write-ash-script {}; diff --git a/pkgs/libubox/default.nix b/pkgs/libubox/default.nix new file mode 100644 index 0000000..6c68e3e --- /dev/null +++ b/pkgs/libubox/default.nix @@ -0,0 +1,46 @@ +{ + lib, + stdenv, + fetchgit, + cmake, + lua5_1, + json_c +}: + +stdenv.mkDerivation rec { + pname = "libubox"; + version = "unstable-2024-04-09"; + + src = fetchgit { + url = "https://git.openwrt.org/project/libubox.git"; + rev = "eb9bcb64185ac155c02cc1a604692c4b00368324"; + hash = "sha256-5KO2E+4pcDp/pe2+vjoQDmyMwCc0yKm847U4J6HjxyA="; + }; + + nativeBuildInputs = [ + cmake + lua5_1 + ]; + + buildInputs = [ + lua5_1 + json_c + ]; + + # Otherwise, CMake cannot find jsoncpp? + env.NIX_CFLAGS_COMPILE = toString [ "-I${json_c.dev}/include/json-c" "-D JSONC" ]; + + cmakeFlags = [ + "-DBUILD_EXAMPLES=off" + # TODO: it explode at install phase. + "-DBUILD_LUA=off" + ]; + + meta = { + description = ""; + homepage = "https://git.openwrt.org/project/libubox.git"; + maintainers = with lib.maintainers; [ raitobezarius ]; + mainProgram = "libubox"; + platforms = lib.platforms.all; + }; +} -- 2.47.0 From 4287a051823e7444fcf997e2a685a9df5e968b28 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 4 Sep 2024 15:53:26 +0200 Subject: [PATCH 20/55] ubus: init at unstable-04-09-2024 Signed-off-by: Raito Bezarius --- pkgs/default.nix | 1 + pkgs/ubus/default.nix | 26 ++++++++++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 pkgs/ubus/default.nix diff --git a/pkgs/default.nix b/pkgs/default.nix index 3c372c7..e719d4e 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -111,6 +111,7 @@ in { systemconfig = callPackage ./systemconfig {}; tufted = callPackage ./tufted {}; libubox = callPackage ./libubox {}; + ubus = callPackage ./ubus {}; uevent-watch = callPackage ./uevent-watch {}; usb-modeswitch = callPackage ./usb-modeswitch {}; writeAshScript = callPackage ./write-ash-script {}; diff --git a/pkgs/ubus/default.nix b/pkgs/ubus/default.nix new file mode 100644 index 0000000..37bd457 --- /dev/null +++ b/pkgs/ubus/default.nix @@ -0,0 +1,26 @@ +{ stdenv, lib, fetchFromGitHub, cmake, libubox, json_c }: +stdenv.mkDerivation { + pname = "ubus"; + version = "unstable-04-09-2024"; + + src = fetchFromGitHub { + owner = "openwrt"; + repo = "ubus"; + rev = "65bb027054def3b94a977229fd6ad62ddd32345b"; + hash = "sha256-n82Ub0IiuvWbnlDCoN+0hjo/1PbplEbc56kuOYMrHxQ="; + }; + + nativeBuildInputs = [ + cmake + ]; + + buildInputs = [ + libubox + json_c + ]; + + cmakeFlags = [ + "-DBUILD_LUA=off" + "-DBUILD_EXAMPLES=off" + ]; +} -- 2.47.0 From c24c659ee18c4652ae17f25cb1657323f4cda14c Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 4 Sep 2024 16:07:49 +0200 Subject: [PATCH 21/55] modules/ubus: init Signed-off-by: Raito Bezarius --- modules/ubus/default.nix | 24 ++++++++++++++++++++++++ modules/ubus/service.nix | 13 +++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 modules/ubus/default.nix create mode 100644 modules/ubus/service.nix diff --git a/modules/ubus/default.nix b/modules/ubus/default.nix new file mode 100644 index 0000000..827f537 --- /dev/null +++ b/modules/ubus/default.nix @@ -0,0 +1,24 @@ +## ubus +## ==== +## +## ubus is a micro-bus à la D-Bus for all your needs. + +{ lib, pkgs, config, ...}: +let + inherit (lib) mkOption types; + inherit (pkgs) liminix; +in { + options = { + system.service.ubus = mkOption { + type = liminix.lib.types.serviceDefn; + }; + }; + config = { + system.service.ubus = liminix.callService ./service.nix { + package = mkOption { + type = types.package; + default = pkgs.ubus; + }; + }; + }; +} diff --git a/modules/ubus/service.nix b/modules/ubus/service.nix new file mode 100644 index 0000000..e1e297e --- /dev/null +++ b/modules/ubus/service.nix @@ -0,0 +1,13 @@ +{ + liminix +, writeText +, lib +}: +{ package } : +let + inherit (liminix.services) longrun; +in longrun { + # Long term: make it unique so that user can spawn multiple buses if they want. + name = "ubus"; + run = "${package}/bin/ubusd"; +} -- 2.47.0 From 6d4237ff87967209e6b53be8c57a622956fc9fee Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 4 Sep 2024 16:29:59 +0200 Subject: [PATCH 22/55] libubox: build with Lua Signed-off-by: Raito Bezarius --- pkgs/libubox/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/libubox/default.nix b/pkgs/libubox/default.nix index 6c68e3e..43b0377 100644 --- a/pkgs/libubox/default.nix +++ b/pkgs/libubox/default.nix @@ -33,7 +33,8 @@ stdenv.mkDerivation rec { cmakeFlags = [ "-DBUILD_EXAMPLES=off" # TODO: it explode at install phase. - "-DBUILD_LUA=off" + "-DBUILD_LUA=on" + "-DLUAPATH=${placeholder "out"}/lib/lua" ]; meta = { -- 2.47.0 From 78d0088b650926f70429d609095697f6a868d54c Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 4 Sep 2024 16:30:44 +0200 Subject: [PATCH 23/55] ubus: build with Lua Signed-off-by: Raito Bezarius --- pkgs/ubus/default.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/ubus/default.nix b/pkgs/ubus/default.nix index 37bd457..c5c78a1 100644 --- a/pkgs/ubus/default.nix +++ b/pkgs/ubus/default.nix @@ -1,4 +1,4 @@ -{ stdenv, lib, fetchFromGitHub, cmake, libubox, json_c }: +{ stdenv, fetchFromGitHub, cmake, libubox, json_c, lua5_1 }: stdenv.mkDerivation { pname = "ubus"; version = "unstable-04-09-2024"; @@ -15,12 +15,14 @@ stdenv.mkDerivation { ]; buildInputs = [ + lua5_1 libubox json_c ]; cmakeFlags = [ - "-DBUILD_LUA=off" + "-DBUILD_LUA=on" + "-DLUAPATH=${placeholder "out"}/lib/lua" "-DBUILD_EXAMPLES=off" ]; } -- 2.47.0 From ebcdbf76bcb41b3fd8ba5198ca9b61e33c5e9feb Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Thu, 5 Sep 2024 14:27:47 +0200 Subject: [PATCH 24/55] fix(bridge): members are now granular services They are still part of the bundle, but we can wait on each of them independently now. Signed-off-by: Raito Bezarius --- modules/bridge/default.nix | 16 ++++++++++++++-- modules/bridge/members.nix | 11 +++++------ 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/modules/bridge/default.nix b/modules/bridge/default.nix index 4c2911a..3a24d7c 100644 --- a/modules/bridge/default.nix +++ b/modules/bridge/default.nix @@ -43,8 +43,20 @@ in }; members = mkOption { - type = types.listOf liminix.lib.types.interface; - description = "interfaces to add to the bridge"; + type = types.attrsOf (types.submodule ({ ... }: { options = { + member = mkOption { + type = liminix.lib.types.interface; + description = "interface to add"; + }; + + dependencies = mkOption { + type = types.listOf liminix.lib.types.service; + default = []; + description = "extra dependencies before attaching this interface to the bridge"; + }; + }; })); + + description = "set of bridge members"; }; }; diff --git a/modules/bridge/members.nix b/modules/bridge/members.nix index 2171eda..78c64e2 100644 --- a/modules/bridge/members.nix +++ b/modules/bridge/members.nix @@ -7,11 +7,10 @@ { members, primary } : let - inherit (liminix.networking) interface; inherit (liminix.services) bundle oneshot; - inherit (lib) mkOption types; - addif = member : oneshot { - name = "${primary.name}.member.${member.name}"; + inherit (lib) mapAttrs; + addif = name: { dependencies ? [ ], member }: oneshot { + name = "${primary.name}.member.${name}"; up = '' echo "attaching $(output ${member} ifname) to $(output ${primary} ifname) bridge" ip link set dev $(output ${member} ifname) master $(output ${primary} ifname) @@ -21,9 +20,9 @@ let ip link set dev $(output ${member} ifname) nomaster ''; - dependencies = [ primary member ]; + dependencies = [ primary member ] ++ dependencies; }; in bundle { name = "${primary.name}.members"; - contents = map addif members; + contents = builtins.attrValues (mapAttrs addif members); } -- 2.47.0 From 0fb671023c0571d936a568721c67819a23cf63c0 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Thu, 5 Sep 2024 14:50:51 +0200 Subject: [PATCH 25/55] feat(services): introduce structured bundles Structured bundles keep their original contents as a `passthru` field named `components`. This enable users to depend on a specific piece of the bundle instead of the whole bundle. Signed-off-by: Raito Bezarius --- modules/bridge/members.nix | 6 +++--- pkgs/liminix-tools/services/default.nix | 16 +++++++++++++++- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/modules/bridge/members.nix b/modules/bridge/members.nix index 78c64e2..560ba14 100644 --- a/modules/bridge/members.nix +++ b/modules/bridge/members.nix @@ -7,7 +7,7 @@ { members, primary } : let - inherit (liminix.services) bundle oneshot; + inherit (liminix.services) structuredBundle oneshot; inherit (lib) mapAttrs; addif = name: { dependencies ? [ ], member }: oneshot { name = "${primary.name}.member.${name}"; @@ -22,7 +22,7 @@ let dependencies = [ primary member ] ++ dependencies; }; -in bundle { +in structuredBundle { name = "${primary.name}.members"; - contents = builtins.attrValues (mapAttrs addif members); + contents = mapAttrs addif members; } diff --git a/pkgs/liminix-tools/services/default.nix b/pkgs/liminix-tools/services/default.nix index c0dbaf0..466a978 100644 --- a/pkgs/liminix-tools/services/default.nix +++ b/pkgs/liminix-tools/services/default.nix @@ -39,6 +39,7 @@ let , contents ? [] , buildInputs ? [] , isTrigger ? false + , passthru ? {} } @ args: stdenvNoCC.mkDerivation { # we use stdenvNoCC to avoid generating derivations with names @@ -50,6 +51,8 @@ let dependencies = builtins.map (d: d.name) dependencies; contents = builtins.map (d: d.name) contents; builder = ./builder.sh; + + inherit passthru; }; longrun = { @@ -100,7 +103,18 @@ let serviceType = "bundle"; inherit contents dependencies; }); + structuredBundle = { + name + , contents ? {} + , dependencies ? [] + , ... + } @ args: service (args // { + serviceType = "bundle"; + contents = builtins.attrValues contents; + inherit dependencies; + passthru.components = contents; + }); target = bundle; in { - inherit target bundle oneshot longrun output; + inherit target bundle oneshot longrun output structuredBundle; } -- 2.47.0 From 032e57b34ced7e7ed5f65be60d1d1c6a47dd6aa6 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Thu, 5 Sep 2024 18:32:11 +0200 Subject: [PATCH 26/55] feat(hostapd): ubus support Signed-off-by: Raito Bezarius --- overlay.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/overlay.nix b/overlay.nix index 2b46089..4fd607c 100644 --- a/overlay.nix +++ b/overlay.nix @@ -130,9 +130,18 @@ extraPkgs // { "CONFIG_LIBNL32=y" "CONFIG_PKCS12=y" "CONFIG_RSN_PREAUTH=y" + "CONFIG_UBUS=y" "CONFIG_TLS=internal" ]; h = prev.hostapd.overrideAttrs(o: { + buildInputs = o.buildInputs ++ [ final.libubox final.ubus ]; + src = final.fetchFromGitea { + domain = "git.dgnum.eu"; + owner = "DGNum"; + repo = "hostapd"; + rev = "hostap-liminix-integration"; + hash = "sha256-qoCXx3raXCD51YX5izj30VG/HMgr6lv/288Yg9I4S7M="; + }; extraConfig = ""; configurePhase = '' cat > hostapd/defconfig < Date: Sat, 7 Sep 2024 17:03:50 +0200 Subject: [PATCH 27/55] feat(hostapd): disable openssl to save space Signed-off-by: Raito Bezarius --- overlay.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/overlay.nix b/overlay.nix index 4fd607c..dc6006a 100644 --- a/overlay.nix +++ b/overlay.nix @@ -172,8 +172,7 @@ extraPkgs // { "CONFIG_LIBNL32=y" "CONFIG_PKCS12=y" "CONFIG_RSN_PREAUTH=y" - # Required to read the key material for RADIUS. - "CONFIG_TLS=openssl" + "CONFIG_TLS=internal" ]; h = prev.hostapd.overrideAttrs(o: { extraConfig = ""; @@ -184,7 +183,7 @@ extraPkgs // { ${o.configurePhase} ''; }); - in h.override { sqlite = null; }; + in h.override { openssl = null; sqlite = null; }; -- 2.47.0 From ffc6492365951ae924e8a1baea344cc7f89f9b20 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 17:13:29 +0200 Subject: [PATCH 28/55] fix(ubus): set the socket path properly Signed-off-by: Raito Bezarius --- modules/ubus/service.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/ubus/service.nix b/modules/ubus/service.nix index e1e297e..80548c6 100644 --- a/modules/ubus/service.nix +++ b/modules/ubus/service.nix @@ -9,5 +9,8 @@ let in longrun { # Long term: make it unique so that user can spawn multiple buses if they want. name = "ubus"; - run = "${package}/bin/ubusd"; + run = '' + mkdir -p /run/ubus + ${package}/bin/ubusd -s /run/ubus/ubus.sock + ''; } -- 2.47.0 From 5444059b6324ba9ccea5a37926df95fa3d7fa055 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 17:18:59 +0200 Subject: [PATCH 29/55] feat(hostapd): enable ubus on RADIUS variant Signed-off-by: Raito Bezarius --- overlay.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/overlay.nix b/overlay.nix index dc6006a..6032257 100644 --- a/overlay.nix +++ b/overlay.nix @@ -172,9 +172,18 @@ extraPkgs // { "CONFIG_LIBNL32=y" "CONFIG_PKCS12=y" "CONFIG_RSN_PREAUTH=y" + "CONFIG_UBUS=y" "CONFIG_TLS=internal" ]; h = prev.hostapd.overrideAttrs(o: { + buildInputs = o.buildInputs ++ [ final.libubox final.ubus ]; + src = final.fetchFromGitea { + domain = "git.dgnum.eu"; + owner = "DGNum"; + repo = "hostapd"; + rev = "hostap-liminix-integration"; + hash = "sha256-qoCXx3raXCD51YX5izj30VG/HMgr6lv/288Yg9I4S7M="; + }; extraConfig = ""; configurePhase = '' cat > hostapd/defconfig < Date: Sat, 7 Sep 2024 17:35:09 +0200 Subject: [PATCH 30/55] fix(ubus): rendez vous URL for the unix socket Signed-off-by: Raito Bezarius --- pkgs/ubus/default.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/ubus/default.nix b/pkgs/ubus/default.nix index c5c78a1..88ea647 100644 --- a/pkgs/ubus/default.nix +++ b/pkgs/ubus/default.nix @@ -1,4 +1,4 @@ -{ stdenv, fetchFromGitHub, cmake, libubox, json_c, lua5_1 }: +{ stdenv, fetchFromGitHub, cmake, libubox, json_c, lua5_1, defaultSocketLocation ? "/run/ubus/ubus.sock" }: stdenv.mkDerivation { pname = "ubus"; version = "unstable-04-09-2024"; @@ -10,6 +10,12 @@ stdenv.mkDerivation { hash = "sha256-n82Ub0IiuvWbnlDCoN+0hjo/1PbplEbc56kuOYMrHxQ="; }; + # We don't use /var/run/ in Liminix by default. + postPatch = '' + substituteInPlace CMakeLists.txt \ + --replace-fail "/var/run/ubus/ubus.sock" "${defaultSocketLocation}" + ''; + nativeBuildInputs = [ cmake ]; -- 2.47.0 From 0d36000d9ff34a85a613e510e2d7ab1faaa31fd4 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 18:09:34 +0200 Subject: [PATCH 31/55] overlay: update hostapd with readiness support Signed-off-by: Raito Bezarius --- overlay.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/overlay.nix b/overlay.nix index 6032257..8ecfa5e 100644 --- a/overlay.nix +++ b/overlay.nix @@ -140,7 +140,7 @@ extraPkgs // { owner = "DGNum"; repo = "hostapd"; rev = "hostap-liminix-integration"; - hash = "sha256-qoCXx3raXCD51YX5izj30VG/HMgr6lv/288Yg9I4S7M="; + hash = "sha256-5Xi90keCHxvuKR5Q7STuZDzuM9h9ac6aWoXVQYvqkQI="; }; extraConfig = ""; configurePhase = '' @@ -182,7 +182,7 @@ extraPkgs // { owner = "DGNum"; repo = "hostapd"; rev = "hostap-liminix-integration"; - hash = "sha256-qoCXx3raXCD51YX5izj30VG/HMgr6lv/288Yg9I4S7M="; + hash = "sha256-5Xi90keCHxvuKR5Q7STuZDzuM9h9ac6aWoXVQYvqkQI="; }; extraConfig = ""; configurePhase = '' -- 2.47.0 From 4cf10c2e756dd293fbbd385c42bb8f658ee9286e Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 18:51:11 +0200 Subject: [PATCH 32/55] iwinfo: init at unstable-07-09-2024 Signed-off-by: Raito Bezarius --- pkgs/default.nix | 1 + pkgs/iwinfo/default.nix | 59 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) create mode 100644 pkgs/iwinfo/default.nix diff --git a/pkgs/default.nix b/pkgs/default.nix index e719d4e..75ecb28 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -112,6 +112,7 @@ in { tufted = callPackage ./tufted {}; libubox = callPackage ./libubox {}; ubus = callPackage ./ubus {}; + iwinfo = callPackage ./iwinfo {}; uevent-watch = callPackage ./uevent-watch {}; usb-modeswitch = callPackage ./usb-modeswitch {}; writeAshScript = callPackage ./write-ash-script {}; diff --git a/pkgs/iwinfo/default.nix b/pkgs/iwinfo/default.nix new file mode 100644 index 0000000..cb5f964 --- /dev/null +++ b/pkgs/iwinfo/default.nix @@ -0,0 +1,59 @@ +{ + lib, + stdenv, + fetchFromGitea, + ubus, + libubox, + lua5_1, + libnl-tiny, + backend ? "nl80211" +}: +let + lua = lua5_1; +in +stdenv.mkDerivation rec { + pname = "iwinfo"; + version = "unstable-07-09-2024"; + + src = fetchFromGitea { + domain = "git.dgnum.eu"; + owner = "DGNum"; + repo = "iwinfo"; + rev = "aaa40cc77a42683df3c32d1f693e9ab95f910f2a"; + hash = "sha256-ojBj0dbDgtnloe1MILIjYVPX3PVZeUbYnEdqeg6/4OM="; + }; + + BACKENDS = backend; + + buildInputs = [ + ubus + libubox + lua + libnl-tiny + ]; + + CFLAGS = "-I${libnl-tiny}/include/libnl-tiny -D_GNU_SOURCE"; + + installPhase = '' + runHook preInstall + + install -Dm755 iwinfo $out/bin/iwinfo + install -Dm755 iwinfo.so $out/lib/lua/${lua.luaversion}/iwinfo.so + install -Dm755 libiwinfo.so $out/lib/libiwinfo.so + install -Dm755 libiwinfo.so.0 $out/lib/libiwinfo.so.0 + + mkdir -p $out/include + cp -r include/* $out/include + + runHook postInstall + ''; + + meta = { + description = "Library to access wireless devices"; + homepage = "https://github.com/openwrt/iwinfo"; + license = lib.licenses.gpl2Only; + maintainers = with lib.maintainers; [ raitobezarius ]; + mainProgram = "iwinfo"; + platforms = lib.platforms.all; + }; +} -- 2.47.0 From b57df3f288069615691d6f1b9755637895dd5bd8 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 19:41:13 +0200 Subject: [PATCH 33/55] iwinfo: use Lua 5.3 port Signed-off-by: Raito Bezarius --- pkgs/iwinfo/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/iwinfo/default.nix b/pkgs/iwinfo/default.nix index cb5f964..91c8437 100644 --- a/pkgs/iwinfo/default.nix +++ b/pkgs/iwinfo/default.nix @@ -4,12 +4,12 @@ fetchFromGitea, ubus, libubox, - lua5_1, + lua5_3, libnl-tiny, backend ? "nl80211" }: let - lua = lua5_1; + lua = lua5_3; in stdenv.mkDerivation rec { pname = "iwinfo"; @@ -19,8 +19,8 @@ stdenv.mkDerivation rec { domain = "git.dgnum.eu"; owner = "DGNum"; repo = "iwinfo"; - rev = "aaa40cc77a42683df3c32d1f693e9ab95f910f2a"; - hash = "sha256-ojBj0dbDgtnloe1MILIjYVPX3PVZeUbYnEdqeg6/4OM="; + rev = "14685a26805155aa5c137993b9a4861a0bc585d5"; + hash = "sha256-lg4sBoYcFFLhcUv+wKR6u1OCartjtnAoF9M5FdfO6JE="; }; BACKENDS = backend; -- 2.47.0 From 26d2812aa4985d9b3f181ae678a5b2cfbf57074f Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 19:44:31 +0200 Subject: [PATCH 34/55] fennerepl: remove readline Signed-off-by: Raito Bezarius --- pkgs/fennelrepl/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/fennelrepl/default.nix b/pkgs/fennelrepl/default.nix index 152c605..f35abc9 100644 --- a/pkgs/fennelrepl/default.nix +++ b/pkgs/fennelrepl/default.nix @@ -20,7 +20,6 @@ let packages = [ lualinux netlink-lua iwinfo - lua.pkgs.readline ]; join = ps: builtins.concatStringsSep ";" ps; luapath = join (builtins.map (f: -- 2.47.0 From 0c363be423ad00af5dc1f9abe9779f75a59c3b04 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 19:41:06 +0200 Subject: [PATCH 35/55] fennelrepl: add iwinfo to it Signed-off-by: Raito Bezarius --- pkgs/fennelrepl/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/fennelrepl/default.nix b/pkgs/fennelrepl/default.nix index 28f47ca..152c605 100644 --- a/pkgs/fennelrepl/default.nix +++ b/pkgs/fennelrepl/default.nix @@ -10,6 +10,7 @@ , linotify , anoia , netlink-lua +, iwinfo , fennel }: let packages = [ @@ -18,6 +19,7 @@ let packages = [ fennel lualinux netlink-lua + iwinfo lua.pkgs.readline ]; join = ps: builtins.concatStringsSep ";" ps; -- 2.47.0 From c39bfc2bb56bbb7f4fb5b31d5e8fb9035b010709 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 20:59:51 +0200 Subject: [PATCH 36/55] fix(write-fennel): escape binary path for PATH otherwise, escapeShellArg might just do nothing! Signed-off-by: Raito Bezarius --- pkgs/write-fennel/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/write-fennel/default.nix b/pkgs/write-fennel/default.nix index 67d1908..e72762d 100644 --- a/pkgs/write-fennel/default.nix +++ b/pkgs/write-fennel/default.nix @@ -27,7 +27,7 @@ name : echo "#!${lua}/bin/lua ${luaFlags}" echo "package.path = ${lib.strings.escapeShellArg (builtins.concatStringsSep "" luapath)} .. package.path" echo "package.cpath = ${lib.strings.escapeShellArg (builtins.concatStringsSep "" luacpath)} .. package.cpath" - echo "local ok, stdlib = pcall(require,'posix.stdlib'); if ok then stdlib.setenv('PATH',${lib.escapeShellArg (lib.makeBinPath packages)} .. \":\" .. os.getenv('PATH')) end" + echo "local ok, stdlib = pcall(require,'posix.stdlib'); if ok then stdlib.setenv('PATH', \"${lib.makeBinPath packages}\" .. \":\" .. os.getenv('PATH')) end" fennel ${if correlate then "--correlate" else ""} --compile ${source} ) > ${name}.lua ''; -- 2.47.0 From 5590fea16e6e14de9084cdad7f0804d2bef74279 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 20:26:40 +0200 Subject: [PATCH 37/55] feat(ifwait): add ifbridgeable script This enable to wait for bridgeability of a WLAN interface via `iwinfo`. Signed-off-by: Raito Bezarius --- pkgs/anoia/Makefile | 2 +- pkgs/anoia/default.nix | 3 ++- pkgs/anoia/wlan.fnl | 8 ++++++++ pkgs/ifwait/default.nix | 5 ++++- pkgs/ifwait/ifbridgeable.fnl | 30 ++++++++++++++++++++++++++++++ 5 files changed, 45 insertions(+), 3 deletions(-) create mode 100644 pkgs/anoia/wlan.fnl create mode 100644 pkgs/ifwait/ifbridgeable.fnl diff --git a/pkgs/anoia/Makefile b/pkgs/anoia/Makefile index f68e596..1c1a406 100644 --- a/pkgs/anoia/Makefile +++ b/pkgs/anoia/Makefile @@ -1,5 +1,5 @@ -default: fs.lua init.lua nl.lua svc.lua net/constants.lua +default: wlan.lua fs.lua init.lua nl.lua svc.lua net/constants.lua test: ln -s . anoia diff --git a/pkgs/anoia/default.nix b/pkgs/anoia/default.nix index b981f48..3488e66 100644 --- a/pkgs/anoia/default.nix +++ b/pkgs/anoia/default.nix @@ -4,6 +4,7 @@ , linotify , lua , lualinux +, iwinfo , cpio }: let pname = "anoia"; @@ -12,7 +13,7 @@ in stdenv.mkDerivation { version = "0.1"; src = ./.; nativeBuildInputs = [ fennel cpio ]; - buildInputs = with lua.pkgs; [ linotify lualinux ]; + buildInputs = with lua.pkgs; [ linotify lualinux iwinfo ]; outputs = [ "out" "dev" ]; doCheck = true; diff --git a/pkgs/anoia/wlan.fnl b/pkgs/anoia/wlan.fnl new file mode 100644 index 0000000..39eeeb6 --- /dev/null +++ b/pkgs/anoia/wlan.fnl @@ -0,0 +1,8 @@ +(local { : nl80211 } (require :iwinfo)) + +(fn is-bridgeable [ifname] + (let [mode (nl80211.mode ifname)] + (or (= mode "Master") (= mode "Master (VLAN)")) +)) + +{ : is-bridgeable } diff --git a/pkgs/ifwait/default.nix b/pkgs/ifwait/default.nix index 19f76d0..b99eb54 100644 --- a/pkgs/ifwait/default.nix +++ b/pkgs/ifwait/default.nix @@ -1,11 +1,14 @@ { lua , netlink-lua +, lualinux +, iwinfo , writeFennelScript , runCommand , anoia }: runCommand "ifwait" {} '' mkdir -p $out/bin - cp -p ${writeFennelScript "ifwait" [anoia netlink-lua] ./ifwait.fnl} $out/bin/ifwait + cp -p ${writeFennelScript "ifwait" [ anoia netlink-lua ] ./ifwait.fnl} $out/bin/ifwait + cp -p ${writeFennelScript "ifbridgeable" [ anoia lualinux iwinfo ] ./ifbridgeable.fnl} $out/bin/ifbridgeable '' diff --git a/pkgs/ifwait/ifbridgeable.fnl b/pkgs/ifwait/ifbridgeable.fnl new file mode 100644 index 0000000..3ddfd4b --- /dev/null +++ b/pkgs/ifwait/ifbridgeable.fnl @@ -0,0 +1,30 @@ +(local wlan (require :anoia.wlan)) +(local { : assoc } (require :anoia)) +(local { : msleep } (require :lualinux)) + +(fn parse-args [args] + (match args + ["-v" & rest] (assoc (parse-args rest) :verbose true) + [linkname] {:link linkname} + _ nil)) + +(fn run [args poll-fn] + (let [parameters + (assert (parse-args args) + (.. "Usage: ifbridgeable [-v] ifname"))] + (when parameters.verbose + (print (.. "ifbridgeable: waiting for " + parameters.link " to be bridgeable"))) + + (while (not (poll-fn parameters.link)) + (when parameters.verbose + (print (.. "ifbridgeable: waiting for " parameters.link " to be bridgeable"))) + (msleep 500) + ) + ) +) + +(when (not (= (. arg 0) "test")) + (run arg wlan.is-bridgeable)) + +{ : run } -- 2.47.0 From 13069415fd5cc69ab71432b1bc588b150d13a500 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 21:12:36 +0200 Subject: [PATCH 38/55] feat(modules/hostapd): offer readiness oneshot WLAN oper wait until the WLAN interface is ready. Signed-off-by: Raito Bezarius --- modules/hostapd/default.nix | 11 +++++++++++ modules/hostapd/ready.nix | 16 ++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 modules/hostapd/ready.nix diff --git a/modules/hostapd/default.nix b/modules/hostapd/default.nix index 4338e74..67f4f72 100644 --- a/modules/hostapd/default.nix +++ b/modules/hostapd/default.nix @@ -20,6 +20,10 @@ in { system.service.hostapd = mkOption { type = liminix.lib.types.serviceDefn; }; + + system.service.hostapd-ready = mkOption { + type = liminix.lib.types.serviceDefn; + }; }; config = { system.service.hostapd = liminix.callService ./service.nix { @@ -34,5 +38,12 @@ in { type = types.attrs; }; }; + + system.service.hostapd-ready = liminix.callService ./ready.nix { + interface = mkOption { + type = liminix.lib.types.interface; + description = "Interface for which to wait that the oper state Master or Master (VLAN) has been reached."; + }; + }; }; } diff --git a/modules/hostapd/ready.nix b/modules/hostapd/ready.nix new file mode 100644 index 0000000..7c10c32 --- /dev/null +++ b/modules/hostapd/ready.nix @@ -0,0 +1,16 @@ +{ + liminix +, ifwait +, lib +}: +{ interface } : +let + inherit (liminix.services) oneshot; +in oneshot { + name = "${interface.name}.wlan-oper"; + up = '' + ${ifwait}/bin/ifbridgeable -v $(output ${interface} ifname) + ''; + + dependencies = [ interface ]; +} -- 2.47.0 From 94a5b19c77c8c5806b1cd3b030ffb9a024e5344a Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 21:52:06 +0200 Subject: [PATCH 39/55] fix(evalConfig): fix `pkgs` relation with `nixpkgs` Signed-off-by: Raito Bezarius --- lib/eval-config.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/eval-config.nix b/lib/eval-config.nix index 7befab1..4c3c009 100644 --- a/lib/eval-config.nix +++ b/lib/eval-config.nix @@ -1,4 +1,4 @@ -{ nixpkgs ? , pkgs ? (import {}), lib ? pkgs.lib }: +{ nixpkgs ? , pkgs ? (import nixpkgs {}), lib ? pkgs.lib }: args: let modulesPath = builtins.toString ../modules; -- 2.47.0 From 0ee2ce41830b4c1f4beb4edbcd4f60f335fee6a1 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 21:52:30 +0200 Subject: [PATCH 40/55] fix(overlay): adopt upstream fix for Lua readline https://github.com/telent/liminix/commit/9f58e7b926652dcdbea58694831f7dea58b882c6 ("maybe fix nixpkgs-unstable lua") Signed-off-by: Raito Bezarius --- overlay.nix | 33 ++++++++++++++++----------------- pkgs/run-liminix-vm/default.nix | 7 ++++--- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/overlay.nix b/overlay.nix index 8ecfa5e..dda4ddc 100644 --- a/overlay.nix +++ b/overlay.nix @@ -1,23 +1,24 @@ final: prev: let + isCross = final.stdenv.buildPlatform != final.stdenv.hostPlatform; + crossOnly = pkg : amendFn : if isCross then (amendFn pkg) else pkg; extraPkgs = import ./pkgs/default.nix { inherit (final) lib callPackage; }; inherit (final) fetchpatch; - lua_no_readline = prev.lua5_3; -# lua_no_readline = prev.lua5_3.overrideAttrs(o: { -# name = "lua-tty"; -# preBuild = '' -# makeFlagsArray+=(PLAT="posix" SYSLIBS="-Wl,-E -ldl" CFLAGS="-O2 -fPIC -DLUA_USE_POSIX -DLUA_USE_DLOPEN") -# ''; -# # lua in nixpkgs has a postInstall stanza that assumes only -# # one output, we need to override that if we're going to -# # convert to multi-output -# # outputs = ["bin" "man" "out"]; -# makeFlags = -# builtins.filter (x: (builtins.match "(PLAT|MYLIBS).*" x) == null) -# o.makeFlags; -# }); + luaHost = prev.lua5_3.overrideAttrs(o: { + name = "lua-tty"; + preBuild = '' + makeFlagsArray+=(PLAT="posix" SYSLIBS="-Wl,-E -ldl" CFLAGS="-O2 -fPIC -DLUA_USE_POSIX -DLUA_USE_DLOPEN") + ''; + # lua in nixpkgs has a postInstall stanza that assumes only + # one output, we need to override that if we're going to + # convert to multi-output + # outputs = ["bin" "man" "out"]; + makeFlags = + builtins.filter (x: (builtins.match "(PLAT|MYLIBS).*" x) == null) + o.makeFlags; + }); s6 = prev.s6.overrideAttrs(o: let @@ -42,7 +43,6 @@ let (if o ? patches then o.patches else []) ++ (if patch_needed then [ patch ] else []); }); - lua = let s = lua_no_readline.override { self = s; }; in s; in extraPkgs // { # liminix library functions @@ -214,8 +214,7 @@ extraPkgs // { ]; }); - luaFull = prev.lua; - inherit lua; + lua = crossOnly prev.lua5_3 (_: luaHost); mtdutils = prev.mtdutils.overrideAttrs(o: { patches = (if o ? patches then o.patches else []) ++ [ diff --git a/pkgs/run-liminix-vm/default.nix b/pkgs/run-liminix-vm/default.nix index 1bf0389..f3df1e1 100644 --- a/pkgs/run-liminix-vm/default.nix +++ b/pkgs/run-liminix-vm/default.nix @@ -2,14 +2,15 @@ qemuLim , socat , writeShellScript -, writeFennel , runCommand +, fennel , lib , lua , pkgsBuildBuild }: let - run-liminix-vm = pkgsBuildBuild.writeFennel "run-liminix-vm" { - packages = [ qemuLim pkgsBuildBuild.lua.pkgs.luaposix pkgsBuildBuild.lua.pkgs.fennel ]; + writeFennel = pkgsBuildBuild.writeFennel.override { inherit lua; }; + run-liminix-vm = writeFennel "run-liminix-vm" { + packages = [ qemuLim lua.pkgs.luaposix fennel ]; } ./run-liminix-vm.fnl; connect = writeShellScript "connect-vm" '' export PATH="${lib.makeBinPath [socat]}:$PATH" -- 2.47.0 From 95850a44c2fd911c2a7f86b82b8ad577e68a31f4 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 22:28:05 +0200 Subject: [PATCH 41/55] feat(recovery): implement failsafe boot for TFTP or anything, really. Signed-off-by: Raito Bezarius --- modules/outputs/initramfs.nix | 25 +++++++++++++++++++++++-- pkgs/preinit/preinit.c | 10 ++++++++++ 2 files changed, 33 insertions(+), 2 deletions(-) diff --git a/modules/outputs/initramfs.nix b/modules/outputs/initramfs.nix index 89d017f..c666c77 100644 --- a/modules/outputs/initramfs.nix +++ b/modules/outputs/initramfs.nix @@ -41,17 +41,38 @@ in system.outputs = { initramfs = - let inherit (pkgs.pkgsBuildBuild) gen_init_cpio; + let + inherit (pkgs.pkgsBuildBuild) gen_init_cpio cpio writeScript; + inherit (pkgs) busybox; + failsafe-init = writeScript "init" '' + #!/bin/sh + exec >/dev/console + echo Running in initramfs + PATH=${busybox}/bin:$PATH + export PATH + mount -t proc none /proc + mount -t sysfs none /sys + ${busybox}/bin/sh + ''; + refs = pkgs.writeReferencesToFile busybox; in runCommand "initramfs.cpio" {} '' - cat << SPECIALS | ${gen_init_cpio}/bin/gen_init_cpio /dev/stdin > $out + cat << SPECIALS | ${gen_init_cpio}/bin/gen_init_cpio /dev/stdin > out dir /proc 0755 0 0 dir /dev 0755 0 0 nod /dev/console 0600 0 0 c 5 1 dir /target 0755 0 0 dir /target/persist 0755 0 0 dir /target/nix 0755 0 0 + dir /nix 0755 0 0 + dir /nix/store 0755 0 0 + dir /bin 0755 0 0 + file /bin/sh ${busybox}/bin/sh 0755 0 0 file /init ${pkgs.preinit}/bin/preinit 0755 0 0 + file /failsafe-init ${failsafe-init} 0755 0 0 SPECIALS + + find $(cat ${refs}) | ${cpio}/bin/cpio -H newc -o -A -v -O out + mv out $out ''; systemConfiguration = pkgs.systemconfig config.filesystem.contents; diff --git a/pkgs/preinit/preinit.c b/pkgs/preinit/preinit.c index 7dd896b..4b5f3f1 100644 --- a/pkgs/preinit/preinit.c +++ b/pkgs/preinit/preinit.c @@ -98,6 +98,7 @@ int main(int argc, char *argv[], char *envp[]) AVER(mount(opts.device, "/target/persist", opts.fstype, 0, opts.mount_opts)); } else { if(mount(opts.device, "/target/persist", opts.fstype, 0, opts.mount_opts) < 0) { + ERR("failed to mount primary device, mount the alternative device\n"); AVER(mount(opts.altdevice, "/target/persist", opts.fstype, 0, opts.mount_opts)); } } @@ -118,5 +119,14 @@ int main(int argc, char *argv[], char *envp[]) AVER(execve("/persist/init", argv, envp)); } + + ERR("failed to mount the rootfs\n"); + ERR("final stand using the failsafe initialization method\n"); + ERR("the boot process is manual from now on\n"); + + argv[0] = "init"; + argv[1] = NULL; + AVER(execve("/failsafe-init", argv, envp)); + die(); } -- 2.47.0 From c942b2be09f3113411f8d07cbd63c7df9795602c Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 22:30:51 +0200 Subject: [PATCH 42/55] feat(initramfs): enable zstd compression Busybox is still 3MB. Signed-off-by: Raito Bezarius --- modules/outputs/initramfs.nix | 2 +- pkgs/kernel/default.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/outputs/initramfs.nix b/modules/outputs/initramfs.nix index c666c77..b1e0ea8 100644 --- a/modules/outputs/initramfs.nix +++ b/modules/outputs/initramfs.nix @@ -36,7 +36,7 @@ in kernel.config = { BLK_DEV_INITRD = "y"; INITRAMFS_SOURCE = builtins.toJSON "${config.system.outputs.initramfs}"; -# INITRAMFS_COMPRESSION_LZO = "y"; + INITRAMFS_COMPRESSION_ZSTD = "y"; }; system.outputs = { diff --git a/pkgs/kernel/default.nix b/pkgs/kernel/default.nix index 4ddf1dd..6891384 100644 --- a/pkgs/kernel/default.nix +++ b/pkgs/kernel/default.nix @@ -23,7 +23,7 @@ stdenv.mkDerivation rec { nativeBuildInputs = [buildPackages.stdenv.cc] ++ (with buildPackages.pkgs; [ rsync bc bison flex pkg-config - openssl ncurses.all perl + openssl ncurses.all perl zstd ]); CC = "${stdenv.cc.bintools.targetPrefix}gcc"; HOSTCC = with buildPackages.pkgs; -- 2.47.0 From 73ea02b982fc68d69759ec193219000fd1279caa Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 23:05:03 +0200 Subject: [PATCH 43/55] feat(modules/nixpkgs): introduce source parameter Signed-off-by: Raito Bezarius --- modules/nixpkgs.nix | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/modules/nixpkgs.nix b/modules/nixpkgs.nix index 15c9c0c..206d506 100644 --- a/modules/nixpkgs.nix +++ b/modules/nixpkgs.nix @@ -83,11 +83,11 @@ let localSystem = cfg.hostPlatform; }; in - import ({ + import cfg.source ({ inherit (cfg) config overlays; } // systemArgs) else - import { + import cfg.source { inherit (cfg) config overlays localSystem crossSystem; }; @@ -97,6 +97,14 @@ in { options.nixpkgs = { + source = mkOption { + type = types.package // { + description = "Source of a nixpkgs repository"; + }; + + default = ; + defaultText = ""; + }; pkgs = mkOption { defaultText = literalExpression '' -- 2.47.0 From 9fcfae3eae0e3343d50ef711567cfc233254a0cd Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 23:28:50 +0200 Subject: [PATCH 44/55] feat(recovery): strengthen debugging capabilities of preinit Signed-off-by: Raito Bezarius --- pkgs/preinit/preinit.c | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/pkgs/preinit/preinit.c b/pkgs/preinit/preinit.c index 4b5f3f1..c9a1821 100644 --- a/pkgs/preinit/preinit.c +++ b/pkgs/preinit/preinit.c @@ -4,9 +4,13 @@ #include #include #include +#include #include #include #include +#include + +#include #include /* for COMMAND_LINE_SIZE */ @@ -44,6 +48,25 @@ static int fork_exec(char * command, char *args[]) return execve(command, args, NULL); } +static void debug_listdir(const char * path) +{ + DIR *mydir; + struct dirent *myfile; + struct stat mystat; + + char buf[512]; + mydir = opendir(path); + while((myfile = readdir(mydir)) != NULL) + { + sprintf(buf, "%s/%s", path, myfile->d_name); + stat(buf, &mystat); + printf("%llu", mystat.st_size); + printf(" %s\n", myfile->d_name); + } + closedir(mydir); + +} + char banner[] = "Running pre-init...\n"; char buf[COMMAND_LINE_SIZE]; @@ -108,7 +131,12 @@ int main(int argc, char *argv[], char *envp[]) "bind", MS_BIND, NULL)); char *exec_args[] = { "activate", "/target", NULL }; - AVER(fork_exec("/target/persist/activate", exec_args)); + if (fork_exec("/target/persist/activate", exec_args) < 0) { + ERR("failed to activate the system\n"); + pr_u32(errno); ERR ( " - "); ERR(strerror(errno)); ERR("\n"); + goto failsafe; + } + AVER(chdir("/target")); AVER(mount("/target", "/", "bind", MS_BIND | MS_REC, NULL)); @@ -120,13 +148,22 @@ int main(int argc, char *argv[], char *envp[]) AVER(execve("/persist/init", argv, envp)); } +failsafe: + debug_listdir("/"); + debug_listdir("/target"); + ERR("failed to mount the rootfs\n"); ERR("final stand using the failsafe initialization method\n"); ERR("the boot process is manual from now on\n"); argv[0] = "init"; argv[1] = NULL; + // Attempt to unmount the /target mount-bind. + AVER(umount("/target")); AVER(execve("/failsafe-init", argv, envp)); + debug_listdir("/"); + debug_listdir("/target"); + die(); } -- 2.47.0 From 3ed1564235fd109941eb7ffb5e0b882a6bfa0a6b Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 23:38:18 +0200 Subject: [PATCH 45/55] feat(recovery): bump to 20MB the TFTP phram size Otherwise, this will fail to boot on a modern closure. Signed-off-by: Raito Bezarius --- devices/zyxel-nwa50ax/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/zyxel-nwa50ax/default.nix b/devices/zyxel-nwa50ax/default.nix index 393dcac..a7834dc 100644 --- a/devices/zyxel-nwa50ax/default.nix +++ b/devices/zyxel-nwa50ax/default.nix @@ -222,8 +222,8 @@ imageFormat = "fit"; tftp = { - # 5MB is nice. - freeSpaceBytes = 5 * 1024 * 1024; + # 20MB is pretty good on this device as we have plenty of RAM. + freeSpaceBytes = 20 * 1024 * 1024; appendDTB = true; loadAddress = lim.parseInt "0x2000000"; }; -- 2.47.0 From b468275f53bcb427e337413ace62bfa465e8020d Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 23:48:13 +0200 Subject: [PATCH 46/55] fix(tftpboot): revert squashfs use and go back to JFFS2 squashfs doesn't copy all the files we need. Signed-off-by: Raito Bezarius --- modules/outputs/tftpboot.nix | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/modules/outputs/tftpboot.nix b/modules/outputs/tftpboot.nix index ca51d10..a8fc4dc 100644 --- a/modules/outputs/tftpboot.nix +++ b/modules/outputs/tftpboot.nix @@ -12,10 +12,15 @@ let arch = pkgs.stdenv.hostPlatform.linuxArch; # UBI cannot run on the top of phram. - needsSquashfs = config.rootfsType == "ubifs"; - rootfstype = if needsSquashfs then "squashfs" else config.rootfsType; - rootfs = if needsSquashfs then - liminix.builders.squashfs config.filesystem.contents + needsJffs2 = config.rootfsType == "ubifs"; + # squashfs doesn't work out for us because only `bootablerootdir` + # contain what we need to boot, not `config.filesystem.contents` alas. + rootfstype = if needsJffs2 then "jffs2" else config.rootfsType; + rootfs = if needsJffs2 then + liminix.builders.jffs2 { + bootableRootDirectory = config.system.outputs.bootablerootdir; + inherit (config.hardware.flash) eraseBlockSize; + } else config.system.outputs.rootfs; in { imports = [ ../ramdisk.nix ]; @@ -82,9 +87,13 @@ in { config = { boot.ramdisk.enable = true; - kernel.config = mkIf needsSquashfs { - SQUASHFS = "y"; - SQUASHFS_XZ = "y"; + kernel.config = mkIf needsJffs2 { + JFFS2_FS = "y"; + JFFS2_LZO = "y"; + JFFS2_RTIME = "y"; + JFFS2_COMPRESSION_OPTIONS = "y"; + JFFS2_ZLIB = "y"; + JFFS2_CMODE_SIZE = "y"; }; system.outputs = rec { -- 2.47.0 From 6970d811e87a3a99a093705cb089a5a63961cfe7 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sat, 7 Sep 2024 23:59:29 +0200 Subject: [PATCH 47/55] chore(min-copy-closure): improve liminix-rebuild for maintenance Signed-off-by: Raito Bezarius --- pkgs/min-copy-closure/liminix-rebuild.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkgs/min-copy-closure/liminix-rebuild.sh b/pkgs/min-copy-closure/liminix-rebuild.sh index 16ec7f1..18f57f0 100755 --- a/pkgs/min-copy-closure/liminix-rebuild.sh +++ b/pkgs/min-copy-closure/liminix-rebuild.sh @@ -1,4 +1,5 @@ #!/usr/bin/env bash +set -Eeuo pipefail ssh_command=${SSH_COMMAND-ssh} @@ -13,19 +14,24 @@ case "$1" in reboot="soft" shift ;; + "--root") + root_prefix="$2" + shift + shift + ;; esac target_host=$1 shift if [ -z "$target_host" ] ; then - echo Usage: liminix-rebuild \[--no-reboot\] target-host params + echo Usage: liminix-rebuild \[--no-reboot\] \[--fast\] target-host params exit 1 fi if toplevel=$(nix-build "$@" -A outputs.systemConfiguration --no-out-link); then echo systemConfiguration $toplevel - min-copy-closure $target_host $toplevel + min-copy-closure --root "$root_prefix" $target_host $toplevel $ssh_command $target_host $toplevel/bin/install case "$reboot" in reboot) -- 2.47.0 From 8ac3e32b8b5503ed6c16ac9e81f3016c723f0c21 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 8 Sep 2024 00:31:15 +0200 Subject: [PATCH 48/55] fix(modules/hostname): hash the hostname to avoid duplicate services in the db Signed-off-by: Raito Bezarius --- modules/hostname.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/hostname.nix b/modules/hostname.nix index d5cd962..5f18b04 100644 --- a/modules/hostname.nix +++ b/modules/hostname.nix @@ -15,7 +15,7 @@ in { }; config = { services.hostname = oneshot { - name = "hostname"; + name = "hostname-${builtins.substring 0 12 (builtins.hashString "sha256" config.hostname)}"; up = "echo ${config.hostname} > /proc/sys/kernel/hostname"; down = "true"; }; -- 2.47.0 From 54db2ad0061ffba046a678ba6a4e9683fbc22873 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 8 Sep 2024 01:08:54 +0200 Subject: [PATCH 49/55] feat(libubox): support for Lua 5.3 Signed-off-by: Raito Bezarius --- pkgs/libubox/default.nix | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/pkgs/libubox/default.nix b/pkgs/libubox/default.nix index 43b0377..3111ff2 100644 --- a/pkgs/libubox/default.nix +++ b/pkgs/libubox/default.nix @@ -1,9 +1,9 @@ { lib, stdenv, - fetchgit, + fetchFromGitea, cmake, - lua5_1, + lua, json_c }: @@ -11,30 +11,32 @@ stdenv.mkDerivation rec { pname = "libubox"; version = "unstable-2024-04-09"; - src = fetchgit { - url = "https://git.openwrt.org/project/libubox.git"; - rev = "eb9bcb64185ac155c02cc1a604692c4b00368324"; - hash = "sha256-5KO2E+4pcDp/pe2+vjoQDmyMwCc0yKm847U4J6HjxyA="; + src = fetchFromGitea { + domain = "git.dgnum.eu"; + owner = "DGNum"; + repo = "libubox"; + rev = "1c4b2dc4c12848e1b70b11e1cb2139ca8f19c860"; + hash = "sha256-aPhGJ7viXQmnoQRY8DuRvtwtxSy+S4qPj1fBsK066Yc="; }; nativeBuildInputs = [ cmake - lua5_1 + lua ]; buildInputs = [ - lua5_1 + lua json_c ]; # Otherwise, CMake cannot find jsoncpp? - env.NIX_CFLAGS_COMPILE = toString [ "-I${json_c.dev}/include/json-c" "-D JSONC" ]; + env.NIX_CFLAGS_COMPILE = toString [ "-I${json_c.dev}/include/json-c" "-D JSONC" "-D LUA_COMPAT_MODULE" ]; cmakeFlags = [ "-DBUILD_EXAMPLES=off" # TODO: it explode at install phase. "-DBUILD_LUA=on" - "-DLUAPATH=${placeholder "out"}/lib/lua" + "-DLUAPATH=${placeholder "out"}/lib/lua/${lua.luaversion}/" ]; meta = { -- 2.47.0 From 036f91d2f0990404dba2bb643da7642ad7f5673e Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Sun, 8 Sep 2024 01:08:59 +0200 Subject: [PATCH 50/55] feat(ubus): support for Lua 5.3 Signed-off-by: Raito Bezarius --- pkgs/ubus/default.nix | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/pkgs/ubus/default.nix b/pkgs/ubus/default.nix index 88ea647..fa063bf 100644 --- a/pkgs/ubus/default.nix +++ b/pkgs/ubus/default.nix @@ -1,13 +1,14 @@ -{ stdenv, fetchFromGitHub, cmake, libubox, json_c, lua5_1, defaultSocketLocation ? "/run/ubus/ubus.sock" }: +{ stdenv, fetchFromGitea, lib, cmake, libubox, json_c, lua, defaultSocketLocation ? "/run/ubus/ubus.sock" }: stdenv.mkDerivation { pname = "ubus"; version = "unstable-04-09-2024"; - src = fetchFromGitHub { - owner = "openwrt"; + src = fetchFromGitea { + domain = "git.dgnum.eu"; + owner = "DGNum"; repo = "ubus"; - rev = "65bb027054def3b94a977229fd6ad62ddd32345b"; - hash = "sha256-n82Ub0IiuvWbnlDCoN+0hjo/1PbplEbc56kuOYMrHxQ="; + rev = "ebb1dc92e4985538a8e18b7e926264118138f281"; + hash = "sha256-fo4zleC9R6uzlcOJ/jQ0t0nSBHUAq/uqPVd9xJdkAM0="; }; # We don't use /var/run/ in Liminix by default. @@ -21,14 +22,14 @@ stdenv.mkDerivation { ]; buildInputs = [ - lua5_1 + lua libubox json_c ]; cmakeFlags = [ "-DBUILD_LUA=on" - "-DLUAPATH=${placeholder "out"}/lib/lua" + "-DLUAPATH=${placeholder "out"}/lib/lua/${lua.luaversion}" "-DBUILD_EXAMPLES=off" ]; } -- 2.47.0 From 013e4c396c97767beed3051c51a6eb6780397b8f Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Mon, 16 Sep 2024 18:14:39 +0200 Subject: [PATCH 51/55] feat: repair CI and cleanup cross-compilation mechanism Signed-off-by: Raito Bezarius --- ci.nix | 22 ++++------------- devices/qemu/default.nix | 5 +++- devices/zyxel-nwa50ax/default.nix | 4 ++- lon.lock | 15 +++++++++++ lon.nix | 41 +++++++++++++++++++++++++++++++ modules/base.nix | 11 +++++++++ modules/outputs/tftpboot.nix | 8 ------ 7 files changed, 79 insertions(+), 27 deletions(-) create mode 100644 lon.lock create mode 100644 lon.nix diff --git a/ci.nix b/ci.nix index ec345dd..07d26f1 100644 --- a/ci.nix +++ b/ci.nix @@ -1,21 +1,15 @@ { - nixpkgs -, unstable -, liminix + sources ? import ./lon.nix +, nixpkgs ? sources.nixpkgs +, unstable ? nixpkgs +, liminix ? ./. , ... }: let - inherit (builtins) map; - pkgs = (import nixpkgs {}); + pkgs = (import nixpkgs { }); borderVmConf = ./bordervm.conf-example.nix; inherit (pkgs.lib.attrsets) genAttrs; devices = [ - "gl-ar750" - "gl-mt300a" - "gl-mt300n-v2" "qemu" - "qemu-aarch64" - "qemu-armv7l" - "tp-archer-ax23" "zyxel-nwa50ax" ]; vanilla = ./vanilla-configuration.nix; @@ -44,12 +38,6 @@ let imports = [ ./modules/all-modules.nix ]; }; }).outputs.optionsJson; - installers = map (f: "system.outputs.${f}") [ - "vmroot" - "mtdimage" - "ubimage" - ]; - inherit (pkgs.lib) concatStringsSep; in pkgs.stdenv.mkDerivation { name = "liminix-doc"; nativeBuildInputs = with pkgs; [ diff --git a/devices/qemu/default.nix b/devices/qemu/default.nix index b6e860d..fe98952 100644 --- a/devices/qemu/default.nix +++ b/devices/qemu/default.nix @@ -1,7 +1,7 @@ # This "device" generates images that can be used with the QEMU # emulator. The default output is a directory containing separate # kernel (uncompressed vmlinux) and initrd (squashfs) images -{ +rec { system = { crossSystem = { config = "mips-unknown-linux-musl"; @@ -41,6 +41,9 @@ ../../modules/arch/mipseb.nix ../families/qemu.nix ]; + + nixpkgs.hostPlatform = system.crossSystem; + kernel = { config = { MIPS_MALTA= "y"; diff --git a/devices/zyxel-nwa50ax/default.nix b/devices/zyxel-nwa50ax/default.nix index a7834dc..2b4813d 100644 --- a/devices/zyxel-nwa50ax/default.nix +++ b/devices/zyxel-nwa50ax/default.nix @@ -1,4 +1,4 @@ -{ +rec { system = { crossSystem = { config = "mipsel-unknown-linux-musl"; @@ -135,6 +135,8 @@ ../../modules/zyxel-dual-image ]; + nixpkgs.hostPlatform = system.crossSystem; + filesystem = dir { lib = dir { firmware = dir { diff --git a/lon.lock b/lon.lock new file mode 100644 index 0000000..50209e4 --- /dev/null +++ b/lon.lock @@ -0,0 +1,15 @@ +{ + "version": "1", + "sources": { + "nixpkgs": { + "type": "GitHub", + "fetchType": "tarball", + "owner": "nixos", + "repo": "nixpkgs", + "branch": "nixos-unstable-small", + "revision": "b6227cadb5123c7e4cb159bf6f9f5705ae081a47", + "url": "https://github.com/nixos/nixpkgs/archive/b6227cadb5123c7e4cb159bf6f9f5705ae081a47.tar.gz", + "hash": "sha256-KFR30GNFhjzXl0kVEn+KK4xrFr0gggb1NBroP8ukbxY=" + } + } +} diff --git a/lon.nix b/lon.nix new file mode 100644 index 0000000..5f320ea --- /dev/null +++ b/lon.nix @@ -0,0 +1,41 @@ +# Generated by lon. Do not modify! +let + + lock = builtins.fromJSON (builtins.readFile ./lon.lock); + + # Override with a path defined in an environment variable. If no variable is + # set, the original path is used. + overrideFromEnv = + name: path: + let + replacement = builtins.getEnv "LON_OVERRIDE_${name}"; + in + if replacement == "" then + path + else + # this turns the string into an actual Nix path (for both absolute and + # relative paths) + if builtins.substring 0 1 replacement == "/" then + /. + replacement + else + /. + builtins.getEnv "PWD" + "/${replacement}"; + + fetchSource = + args@{ fetchType, ... }: + if fetchType == "git" then + builtins.fetchGit { + url = args.url; + ref = args.branch; + rev = args.revision; + narHash = args.hash; + } + else if fetchType == "tarball" then + builtins.fetchTarball { + url = args.url; + sha256 = args.hash; + } + else + builtins.throw "Unsupported source type ${fetchType}"; + +in +builtins.mapAttrs (name: args: overrideFromEnv name (fetchSource args)) lock.sources diff --git a/modules/base.nix b/modules/base.nix index d2182c6..41550e6 100644 --- a/modules/base.nix +++ b/modules/base.nix @@ -69,6 +69,14 @@ in { default = "uimage"; }; tftp = { + commandLine = mkOption { + type = types.listOf types.str; + default = config.boot.commandLine; + description = '' + TFTP-specific command line. + Defaults to the classical one if unset. + ''; + }; loadAddress = mkOption { type = types.ints.unsigned; description = '' @@ -98,6 +106,9 @@ in { }; }; config = { + # By default, we enable cross-compilation support. + nixpkgs.buildPlatform = lib.mkDefault builtins.currentSystem; + defaultProfile.packages = with pkgs; [ s6 s6-init-bin execline s6-linux-init s6-rc ]; diff --git a/modules/outputs/tftpboot.nix b/modules/outputs/tftpboot.nix index a8fc4dc..4fd139d 100644 --- a/modules/outputs/tftpboot.nix +++ b/modules/outputs/tftpboot.nix @@ -41,14 +41,6 @@ in { type = types.bool; default = false; }; - commandLine = mkOption { - type = types.listOf types.str; - default = config.boot.commandLine; - description = '' - TFTP-specific command line. - Defaults to the classical one if unset. - ''; - }; }; options.system.outputs = { tftpboot = mkOption { -- 2.47.0 From 0dd72b31f4e7acb76f9b672214c253e92d4f1580 Mon Sep 17 00:00:00 2001 From: catvayor Date: Wed, 18 Sep 2024 09:10:07 +0200 Subject: [PATCH 52/55] feat(ci): use ci.nix --- .forgejo/workflows/build.yaml | 22 +++++++++++++++++++++- ci.nix | 4 ++-- default.nix | 9 ++++++--- tests/ext4/test.nix | 2 +- tests/fennel/test.nix | 2 +- tests/inout/test.nix | 2 +- tests/jffs2/configuration.nix | 1 - tests/jffs2/test.nix | 2 +- tests/min-copy-closure/configuration.nix | 1 - tests/min-copy-closure/test.nix | 2 +- tests/pppoe/test.nix | 2 +- tests/tftpboot/test.nix | 3 ++- tests/updown/test.nix | 2 +- tests/wlan/test.nix | 4 ++-- 14 files changed, 40 insertions(+), 18 deletions(-) diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml index dcb2ee4..3a29607 100644 --- a/.forgejo/workflows/build.yaml +++ b/.forgejo/workflows/build.yaml @@ -17,4 +17,24 @@ jobs: - name: Build VM QEMU MIPS run: | # Enter the shell - nix-build -I liminix-config=./examples/hello-from-qemu.nix --arg device "import ./devices/qemu" -A outputs.default + nix-build ci.nix -A qemu + + build_zyxel-nwa50ax_mips: + runs-on: nix + steps: + - uses: actions/checkout@v3 + + - name: Build VM QEMU MIPS + run: | + # Enter the shell + nix-build ci.nix -A qemu + + test_hostapd: + runs-on: nix + steps: + - uses: actions/checkout@v3 + + - name: Build VM QEMU MIPS + run: | + # Enter the shell + nix-build ci.nix -A wlan diff --git a/ci.nix b/ci.nix index 07d26f1..73d8c97 100644 --- a/ci.nix +++ b/ci.nix @@ -7,7 +7,7 @@ let pkgs = (import nixpkgs { }); borderVmConf = ./bordervm.conf-example.nix; - inherit (pkgs.lib.attrsets) genAttrs; + inherit (pkgs.lib.attrsets) genAttrs mapAttrs; devices = [ "qemu" "zyxel-nwa50ax" @@ -19,7 +19,7 @@ let device = import (liminix + "/devices/${name}"); liminix-config = vanilla; }).outputs.default; - tests = import ./tests/ci.nix; + tests = mapAttrs (_: v: v { inherit liminix nixpkgs; }) (import ./tests/ci.nix); jobs = (genAttrs devices for-device) // tests // diff --git a/default.nix b/default.nix index e372095..33593dc 100644 --- a/default.nix +++ b/default.nix @@ -26,9 +26,12 @@ let eval = evalModules { modules = [ { - nixpkgs.overlays = [ - overlay - ]; + nixpkgs = { + overlays = [ overlay ]; + config.permittedInsecurePackages = [ + "python-2.7.18.8" + ]; + }; } device.module liminix-config diff --git a/tests/ext4/test.nix b/tests/ext4/test.nix index f972583..5c5a582 100644 --- a/tests/ext4/test.nix +++ b/tests/ext4/test.nix @@ -6,7 +6,7 @@ let img = (import liminix { device = import "${liminix}/devices/qemu/"; liminix-config = ./configuration.nix; }).outputs.vmroot; - pkgs = import { overlays = [(import ../../overlay.nix)]; }; + pkgs = import nixpkgs { overlays = [(import ../../overlay.nix)]; }; in pkgs.runCommand "check" { nativeBuildInputs = with pkgs; [ expect diff --git a/tests/fennel/test.nix b/tests/fennel/test.nix index fda2a89..81206d9 100644 --- a/tests/fennel/test.nix +++ b/tests/fennel/test.nix @@ -4,7 +4,7 @@ }: let overlay = import "${liminix}/overlay.nix"; - pkgs = import { overlays = [overlay]; }; + pkgs = import nixpkgs { overlays = [overlay]; }; script = pkgs.writeFennelScript "foo" [] ./hello.fnl; inherit (pkgs.lua.pkgs) fifo; netlink = pkgs.netlink-lua; diff --git a/tests/inout/test.nix b/tests/inout/test.nix index 5f382e4..3f3b198 100644 --- a/tests/inout/test.nix +++ b/tests/inout/test.nix @@ -6,7 +6,7 @@ let img = (import liminix { device = import "${liminix}/devices/qemu/"; liminix-config = ./configuration.nix; }).outputs.vmroot; - pkgs = import { overlays = [(import ../../overlay.nix)]; }; + pkgs = import nixpkgs { overlays = [(import ../../overlay.nix)]; }; in pkgs.runCommand "check" { nativeBuildInputs = with pkgs; [ expect diff --git a/tests/jffs2/configuration.nix b/tests/jffs2/configuration.nix index 2515fbf..ea7670b 100644 --- a/tests/jffs2/configuration.nix +++ b/tests/jffs2/configuration.nix @@ -5,7 +5,6 @@ in { imports = [ ../../vanilla-configuration.nix ../../modules/squashfs.nix - ../../modules/outputs/jffs2.nix ]; config.rootfsType = "jffs2"; config.filesystem = dir { diff --git a/tests/jffs2/test.nix b/tests/jffs2/test.nix index f972583..5c5a582 100644 --- a/tests/jffs2/test.nix +++ b/tests/jffs2/test.nix @@ -6,7 +6,7 @@ let img = (import liminix { device = import "${liminix}/devices/qemu/"; liminix-config = ./configuration.nix; }).outputs.vmroot; - pkgs = import { overlays = [(import ../../overlay.nix)]; }; + pkgs = import nixpkgs { overlays = [(import ../../overlay.nix)]; }; in pkgs.runCommand "check" { nativeBuildInputs = with pkgs; [ expect diff --git a/tests/min-copy-closure/configuration.nix b/tests/min-copy-closure/configuration.nix index fe80bf2..0797341 100644 --- a/tests/min-copy-closure/configuration.nix +++ b/tests/min-copy-closure/configuration.nix @@ -13,7 +13,6 @@ let in { imports = [ ../../vanilla-configuration.nix - ../../modules/outputs/jffs2.nix ]; config = { services.sshd = longrun { diff --git a/tests/min-copy-closure/test.nix b/tests/min-copy-closure/test.nix index 14f0225..774b882 100644 --- a/tests/min-copy-closure/test.nix +++ b/tests/min-copy-closure/test.nix @@ -8,7 +8,7 @@ let lmx = (import liminix { }); rogue = lmx.pkgs.rogue; img = lmx.outputs.vmroot; - pkgs = import { overlays = [(import ../../overlay.nix)]; }; + pkgs = import nixpkgs { overlays = [(import ../../overlay.nix)]; }; in pkgs.runCommand "check" { nativeBuildInputs = with pkgs; [ expect diff --git a/tests/pppoe/test.nix b/tests/pppoe/test.nix index c8007a9..6972256 100644 --- a/tests/pppoe/test.nix +++ b/tests/pppoe/test.nix @@ -6,7 +6,7 @@ let img = (import liminix { device = import "${liminix}/devices/qemu"; liminix-config = ./configuration.nix; }).outputs.default; - pkgs = import { overlays = [(import ../../overlay.nix)]; }; + pkgs = import nixpkgs { overlays = [(import ../../overlay.nix)]; }; inherit (pkgs.pkgsBuildBuild) routeros; in pkgs.runCommand "check" { nativeBuildInputs = with pkgs; [ diff --git a/tests/tftpboot/test.nix b/tests/tftpboot/test.nix index b7a3e87..b6b9f1a 100644 --- a/tests/tftpboot/test.nix +++ b/tests/tftpboot/test.nix @@ -1,5 +1,6 @@ { - liminix + liminix, + ... }: let check = deviceName : config : let derivation = (import liminix { diff --git a/tests/updown/test.nix b/tests/updown/test.nix index 589e383..45f7c91 100644 --- a/tests/updown/test.nix +++ b/tests/updown/test.nix @@ -6,7 +6,7 @@ let img = (import liminix { device = import "${liminix}/devices/qemu/"; liminix-config = ./configuration.nix; }).outputs.vmroot; - pkgs = import { overlays = [(import ../../overlay.nix)]; }; + pkgs = import nixpkgs { overlays = [(import ../../overlay.nix)]; }; in pkgs.runCommand "check" { nativeBuildInputs = with pkgs; [ expect diff --git a/tests/wlan/test.nix b/tests/wlan/test.nix index fcc2715..f644fb9 100644 --- a/tests/wlan/test.nix +++ b/tests/wlan/test.nix @@ -3,10 +3,10 @@ , nixpkgs }: let img = (import liminix { - device = import "${liminix}/devices/qemu-armv7l/"; + device = import "${liminix}/devices/qemu/"; liminix-config = ./configuration.nix; }).outputs.default; - pkgs = import { overlays = [(import ../../overlay.nix)]; }; + pkgs = import nixpkgs { overlays = [(import ../../overlay.nix)]; }; in pkgs.runCommand "check" { nativeBuildInputs = with pkgs; [ expect socat -- 2.47.0 From c5e48f5c9fb38c721e6d186019269324ff5662d7 Mon Sep 17 00:00:00 2001 From: catvayor Date: Wed, 18 Sep 2024 17:04:51 +0200 Subject: [PATCH 53/55] feat(ci-wlan): use wpa_supplicant --- default.nix | 1 + overlay.nix | 6 +++++- tests/wlan/configuration.nix | 19 ++++++++++++++++++- tests/wlan/test.nix | 1 + tests/wlan/wait-for-wlan.expect | 4 ++-- tests/wlan/wpa_service.nix | 21 +++++++++++++++++++++ tests/wlan/wpa_supplicant.nix | 15 +++++++++++++++ 7 files changed, 63 insertions(+), 4 deletions(-) create mode 100644 tests/wlan/wpa_service.nix create mode 100644 tests/wlan/wpa_supplicant.nix diff --git a/default.nix b/default.nix index 33593dc..fd1c357 100644 --- a/default.nix +++ b/default.nix @@ -27,6 +27,7 @@ let modules = [ { nixpkgs = { + source = nixpkgs; overlays = [ overlay ]; config.permittedInsecurePackages = [ "python-2.7.18.8" diff --git a/overlay.nix b/overlay.nix index dda4ddc..891e9a0 100644 --- a/overlay.nix +++ b/overlay.nix @@ -194,7 +194,11 @@ extraPkgs // { }); in h.override { openssl = null; sqlite = null; }; - + wpa_supplicant = prev.wpa_supplicant.override { + dbusSupport = false; + withPcsclite = false; + wpa_supplicant_gui = null; + }; kexec-tools-static = prev.kexec-tools.overrideAttrs(o: { # For kexecboot we copy kexec into a ramdisk on the system being diff --git a/tests/wlan/configuration.nix b/tests/wlan/configuration.nix index 6dc4b44..ed1d948 100644 --- a/tests/wlan/configuration.nix +++ b/tests/wlan/configuration.nix @@ -7,6 +7,7 @@ in rec { ../../modules/wlan.nix ../../modules/hostapd ../../modules/network + ./wpa_supplicant.nix ]; services.hostap = config.system.service.hostapd.build { @@ -27,5 +28,21 @@ in rec { }; }; - defaultProfile.packages = with pkgs; [ tcpdump ] ; + services.wpa_supplicant = config.system.service.wpa_supplicant.build { + interface = "wlan1"; + driver = "nl80211"; + config-file = pkgs.writeText "wpa_supplicant.conf" '' + country=us + update_config=1 + ctrl_interface=/run/wpa_supplicant + + network={ + scan_ssid=1 + ssid="liminix" + psk="colourless green ideas" + } + ''; + }; + + defaultProfile.packages = with pkgs; [ tcpdump wpa_supplicant ]; } diff --git a/tests/wlan/test.nix b/tests/wlan/test.nix index f644fb9..f1f20c2 100644 --- a/tests/wlan/test.nix +++ b/tests/wlan/test.nix @@ -3,6 +3,7 @@ , nixpkgs }: let img = (import liminix { + inherit nixpkgs; device = import "${liminix}/devices/qemu/"; liminix-config = ./configuration.nix; }).outputs.default; diff --git a/tests/wlan/wait-for-wlan.expect b/tests/wlan/wait-for-wlan.expect index 1d42a4e..5e0f073 100644 --- a/tests/wlan/wait-for-wlan.expect +++ b/tests/wlan/wait-for-wlan.expect @@ -14,10 +14,10 @@ expect { } expect "#" while { $FINISHED < 10 } { - send "date && grep AP-ENABLED /run/uncaught-logs/* || echo \$NOT\r\n" + send "date && grep CTRL-EVENT-CONNECTED /run/uncaught-logs/* || echo \$NOT\r\n" expect { - "wlan0: AP-ENABLED" { set FINISHED 999; set EXIT 0; } + "wlan1: CTRL-EVENT-CONNECTED" { set FINISHED 999; set EXIT 0; } "not_present" { send_user "waiting ...\n" ; sleep 5 } } set FINISHED [ expr $FINISHED + 1 ] diff --git a/tests/wlan/wpa_service.nix b/tests/wlan/wpa_service.nix new file mode 100644 index 0000000..ae70db3 --- /dev/null +++ b/tests/wlan/wpa_service.nix @@ -0,0 +1,21 @@ +{ + liminix, + wpa_supplicant, + lib, +}: +{ + interface, + driver, + config-file, +}: +let + inherit (liminix.services) longrun; + inherit (lib.strings) escapeShellArg; +in +longrun { + name = "wpa_supplicant"; + run = + '' + ${wpa_supplicant}/bin/wpa_supplicant -D${driver} -i${interface} -c ${config-file} + ''; +} diff --git a/tests/wlan/wpa_supplicant.nix b/tests/wlan/wpa_supplicant.nix new file mode 100644 index 0000000..98f7f08 --- /dev/null +++ b/tests/wlan/wpa_supplicant.nix @@ -0,0 +1,15 @@ +{ config, lib, pkgs, ... }: +with lib; { + options.system.service.wpa_supplicant = mkOption { type = pkgs.liminix.lib.types.serviceDefn; }; + config.system.service.wpa_supplicant = config.system.callService ./wpa_service.nix { + interface = mkOption { + type = types.str; + }; + driver = mkOption { + type = types.str; + }; + config-file = mkOption { + type = types.package; + }; + }; +} -- 2.47.0 From 20ec5ee5e940fb6ba614e6e02128d8a10926e491 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Thu, 5 Sep 2024 14:16:38 +0200 Subject: [PATCH 54/55] seedrng: init at 2022.04 Signed-off-by: Raito Bezarius --- pkgs/default.nix | 1 + pkgs/seedrng/COPYING | 712 +++++++++++++++++++++++++++++++++++++++ pkgs/seedrng/Makefile | 18 + pkgs/seedrng/README.md | 72 ++++ pkgs/seedrng/default.nix | 13 + pkgs/seedrng/seedrng.c | 488 +++++++++++++++++++++++++++ 6 files changed, 1304 insertions(+) create mode 100644 pkgs/seedrng/COPYING create mode 100644 pkgs/seedrng/Makefile create mode 100644 pkgs/seedrng/README.md create mode 100644 pkgs/seedrng/default.nix create mode 100644 pkgs/seedrng/seedrng.c diff --git a/pkgs/default.nix b/pkgs/default.nix index 75ecb28..3cdc236 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -99,6 +99,7 @@ in { run-liminix-vm = callPackage ./run-liminix-vm {}; s6-init-bin = callPackage ./s6-init-bin {}; s6-rc-database = callPackage ./s6-rc-database {}; + seedrng = callPackage ./seedrng {}; # schnapps is written by Turris and provides a high-level interface # to btrfs snapshots. It may be useful on the Turris Omnia to diff --git a/pkgs/seedrng/COPYING b/pkgs/seedrng/COPYING new file mode 100644 index 0000000..0c5e554 --- /dev/null +++ b/pkgs/seedrng/COPYING @@ -0,0 +1,712 @@ +This project is licensed under any one of: + +- GPL-2.0 +- Apache-2.0 +- MIT +- BSD-1-Clause +- CC0-1.0 + +Choose which one works best for you. They are reproduced below. + +------------------------------------------------------------------------------- + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. +------------------------------------------------------------------------------- + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +------------------------------------------------------------------------------- +MIT License + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies +of the Software, and to permit persons to whom the Software is furnished to do +so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. +------------------------------------------------------------------------------- +BSD 1-Clause License + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +------------------------------------------------------------------------------- +Creative Commons Legal Code - CC0 1.0 Universal + + CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE + LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN + ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS + INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES + REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS + PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM + THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED + HEREUNDER. + +Statement of Purpose + +The laws of most jurisdictions throughout the world automatically confer +exclusive Copyright and Related Rights (defined below) upon the creator +and subsequent owner(s) (each and all, an "owner") of an original work of +authorship and/or a database (each, a "Work"). + +Certain owners wish to permanently relinquish those rights to a Work for +the purpose of contributing to a commons of creative, cultural and +scientific works ("Commons") that the public can reliably and without fear +of later claims of infringement build upon, modify, incorporate in other +works, reuse and redistribute as freely as possible in any form whatsoever +and for any purposes, including without limitation commercial purposes. +These owners may contribute to the Commons to promote the ideal of a free +culture and the further production of creative, cultural and scientific +works, or to gain reputation or greater distribution for their Work in +part through the use and efforts of others. + +For these and/or other purposes and motivations, and without any +expectation of additional consideration or compensation, the person +associating CC0 with a Work (the "Affirmer"), to the extent that he or she +is an owner of Copyright and Related Rights in the Work, voluntarily +elects to apply CC0 to the Work and publicly distribute the Work under its +terms, with knowledge of his or her Copyright and Related Rights in the +Work and the meaning and intended legal effect of CC0 on those rights. + +1. Copyright and Related Rights. A Work made available under CC0 may be +protected by copyright and related or neighboring rights ("Copyright and +Related Rights"). Copyright and Related Rights include, but are not +limited to, the following: + + i. the right to reproduce, adapt, distribute, perform, display, + communicate, and translate a Work; + ii. moral rights retained by the original author(s) and/or performer(s); +iii. publicity and privacy rights pertaining to a person's image or + likeness depicted in a Work; + iv. rights protecting against unfair competition in regards to a Work, + subject to the limitations in paragraph 4(a), below; + v. rights protecting the extraction, dissemination, use and reuse of data + in a Work; + vi. database rights (such as those arising under Directive 96/9/EC of the + European Parliament and of the Council of 11 March 1996 on the legal + protection of databases, and under any national implementation + thereof, including any amended or successor version of such + directive); and +vii. other similar, equivalent or corresponding rights throughout the + world based on applicable law or treaty, and any national + implementations thereof. + +2. Waiver. To the greatest extent permitted by, but not in contravention +of, applicable law, Affirmer hereby overtly, fully, permanently, +irrevocably and unconditionally waives, abandons, and surrenders all of +Affirmer's Copyright and Related Rights and associated claims and causes +of action, whether now known or unknown (including existing as well as +future claims and causes of action), in the Work (i) in all territories +worldwide, (ii) for the maximum duration provided by applicable law or +treaty (including future time extensions), (iii) in any current or future +medium and for any number of copies, and (iv) for any purpose whatsoever, +including without limitation commercial, advertising or promotional +purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each +member of the public at large and to the detriment of Affirmer's heirs and +successors, fully intending that such Waiver shall not be subject to +revocation, rescission, cancellation, termination, or any other legal or +equitable action to disrupt the quiet enjoyment of the Work by the public +as contemplated by Affirmer's express Statement of Purpose. + +3. Public License Fallback. Should any part of the Waiver for any reason +be judged legally invalid or ineffective under applicable law, then the +Waiver shall be preserved to the maximum extent permitted taking into +account Affirmer's express Statement of Purpose. In addition, to the +extent the Waiver is so judged Affirmer hereby grants to each affected +person a royalty-free, non transferable, non sublicensable, non exclusive, +irrevocable and unconditional license to exercise Affirmer's Copyright and +Related Rights in the Work (i) in all territories worldwide, (ii) for the +maximum duration provided by applicable law or treaty (including future +time extensions), (iii) in any current or future medium and for any number +of copies, and (iv) for any purpose whatsoever, including without +limitation commercial, advertising or promotional purposes (the +"License"). The License shall be deemed effective as of the date CC0 was +applied by Affirmer to the Work. Should any part of the License for any +reason be judged legally invalid or ineffective under applicable law, such +partial invalidity or ineffectiveness shall not invalidate the remainder +of the License, and in such case Affirmer hereby affirms that he or she +will not (i) exercise any of his or her remaining Copyright and Related +Rights in the Work or (ii) assert any associated claims and causes of +action with respect to the Work, in either case contrary to Affirmer's +express Statement of Purpose. + +4. Limitations and Disclaimers. + + a. No trademark or patent rights held by Affirmer are waived, abandoned, + surrendered, licensed or otherwise affected by this document. + b. Affirmer offers the Work as-is and makes no representations or + warranties of any kind concerning the Work, express, implied, + statutory or otherwise, including without limitation warranties of + title, merchantability, fitness for a particular purpose, non + infringement, or the absence of latent or other defects, accuracy, or + the present or absence of errors, whether or not discoverable, all to + the greatest extent permissible under applicable law. + c. Affirmer disclaims responsibility for clearing rights of other persons + that may apply to the Work or any use thereof, including without + limitation any person's Copyright and Related Rights in the Work. + Further, Affirmer disclaims responsibility for obtaining any necessary + consents, permissions or other rights required for any use of the + Work. + d. Affirmer understands and acknowledges that Creative Commons is not a + party to this document and has no duty or obligation with respect to + this CC0 or use of the Work. +------------------------------------------------------------------------------- diff --git a/pkgs/seedrng/Makefile b/pkgs/seedrng/Makefile new file mode 100644 index 0000000..35e783c --- /dev/null +++ b/pkgs/seedrng/Makefile @@ -0,0 +1,18 @@ +PREFIX ?= /usr +DESTDIR ?= +SBINDIR ?= $(PREFIX)/sbin +LOCALSTATEDIR ?= /var/lib +CFLAGS ?= -O2 -pipe + +CFLAGS += -Wall -Wextra -pedantic +CFLAGS += -DLOCALSTATEDIR="\"$(LOCALSTATEDIR)\"" + +seedrng: seedrng.c + +install: seedrng + install -v -d "$(DESTDIR)$(SBINDIR)" && install -v -m 0755 seedrng "$(DESTDIR)$(SBINDIR)/seedrng" + +clean: + rm -f seedrng + +.PHONY: clean diff --git a/pkgs/seedrng/README.md b/pkgs/seedrng/README.md new file mode 100644 index 0000000..a8ceacd --- /dev/null +++ b/pkgs/seedrng/README.md @@ -0,0 +1,72 @@ +## SeedRNG — `seedrng(8)` +##### by [Jason A. Donenfeld](mailto:Jason@zx2c4.com) + +SeedRNG is a simple program made for seeding the Linux kernel random number +generator from seed files. The program takes no arguments, must be run as root, +and always attempts to do something useful. + +This program is useful in light of the fact that the Linux kernel RNG cannot be +initialized from shell scripts, and new seeds cannot be safely generated from +boot time shell scripts either. + +It should be run once at init time and once at shutdown time. It can be run at +other times without detriment as well. Whenever it is run, it writes existing +seed files into the RNG pool, and then creates a new seed file. If the RNG is +initialized at the time of creating a new seed file, then that new seed file is +marked as "creditable", which means it can be used to initialize the RNG. +Otherwise, it is marked as "non-creditable", in which case it is still used to +seed the RNG's pool, but will not initialize the RNG. + +In order to ensure that entropy only ever stays the same or increases from one +seed file to the next, old seed values are hashed together with new seed values +when writing new seed files: + +``` +new_seed = new_seed[:-32] || HASH(fixed_prefix || real_time || boot_time || old_seed_len || old_seed || new_seed_len || new_seed) +``` + +The seed is stored in `LOCALSTATEDIR/seedrng/`, which can be adjusted at +compile time. If the `SEEDRNG_SKIP_CREDIT` environment variable is set to `1`, +`true`, `yes`, or `y`, then seeds never credit the RNG, even if the seed file +is creditable. + +Being a single C file, `seedrng.c`, SeedRNG is meant to be copy and pasted +verbatim into various minimal init system projects and tweaked as needed. +**Please do not package this repo as a standalone program**: it is intended as +utility code meant to be imported into existing projects instead. + +### Building & Installing + +``` +$ make +$ sudo make install +``` + +In addition to the usual compiler environment variables (`CFLAGS`, etc), the +following environment variable is respected during compilation: + + * `LOCALSTATEDIR` default: `/var/lib` + +The following environment variables are respected during installation: + + * `PREFIX` default: `/usr` + * `DESTDIR` default: + * `SBINDIR` default: `$(PREFIX)/sbin` + +### Usage + +``` +# seedrng +``` + +However, this invocation should generally come from init and shutdown scripts. + +### License + +This program is licensed under any one of the the following licenses, so that it can be incorporated into other software projects as needed: + + - GPL-2.0 + - Apache-2.0 + - MIT + - BSD-1-Clause + - CC0-1.0 diff --git a/pkgs/seedrng/default.nix b/pkgs/seedrng/default.nix new file mode 100644 index 0000000..973ed4a --- /dev/null +++ b/pkgs/seedrng/default.nix @@ -0,0 +1,13 @@ +{ stdenv }: +stdenv.mkDerivation { + pname = "seedrng"; + version = "2022.04"; + + src = ./.; + + makeFlags = [ + "PREFIX=${placeholder "out"}" + "SBINDIR=${placeholder "out"}/bin" + "LOCALSTATEDIR=/persist" + ]; +} diff --git a/pkgs/seedrng/seedrng.c b/pkgs/seedrng/seedrng.c new file mode 100644 index 0000000..9f93fe2 --- /dev/null +++ b/pkgs/seedrng/seedrng.c @@ -0,0 +1,488 @@ +// SPDX-License-Identifier: (GPL-2.0 OR Apache-2.0 OR MIT OR BSD-1-Clause OR CC0-1.0) +/* + * Copyright (C) 2022 Jason A. Donenfeld . All Rights Reserved. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#ifndef LOCALSTATEDIR +#define LOCALSTATEDIR "/var/lib" +#endif + +#define SEED_DIR LOCALSTATEDIR "/seedrng" +#define CREDITABLE_SEED "seed.credit" +#define NON_CREDITABLE_SEED "seed.no-credit" + +enum blake2s_lengths { + BLAKE2S_BLOCK_LEN = 64, + BLAKE2S_HASH_LEN = 32, + BLAKE2S_KEY_LEN = 32 +}; + +enum seedrng_lengths { + MAX_SEED_LEN = 512, + MIN_SEED_LEN = BLAKE2S_HASH_LEN +}; + +struct blake2s_state { + uint32_t h[8]; + uint32_t t[2]; + uint32_t f[2]; + uint8_t buf[BLAKE2S_BLOCK_LEN]; + unsigned int buflen; + unsigned int outlen; +}; + +#define le32_to_cpup(a) le32toh(*(a)) +#define cpu_to_le32(a) htole32(a) +#ifndef ARRAY_SIZE +#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) +#endif +#ifndef DIV_ROUND_UP +#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +#endif + +static inline void cpu_to_le32_array(uint32_t *buf, unsigned int words) +{ + while (words--) { + *buf = cpu_to_le32(*buf); + ++buf; + } +} + +static inline void le32_to_cpu_array(uint32_t *buf, unsigned int words) +{ + while (words--) { + *buf = le32_to_cpup(buf); + ++buf; + } +} + +static inline uint32_t ror32(uint32_t word, unsigned int shift) +{ + return (word >> (shift & 31)) | (word << ((-shift) & 31)); +} + +static const uint32_t blake2s_iv[8] = { + 0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL, + 0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL +}; + +static const uint8_t blake2s_sigma[10][16] = { + { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 }, + { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }, + { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 }, + { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 }, + { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 }, + { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 }, + { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 }, + { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 }, + { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 }, + { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }, +}; + +static void blake2s_set_lastblock(struct blake2s_state *state) +{ + state->f[0] = -1; +} + +static void blake2s_increment_counter(struct blake2s_state *state, const uint32_t inc) +{ + state->t[0] += inc; + state->t[1] += (state->t[0] < inc); +} + +static void blake2s_init_param(struct blake2s_state *state, const uint32_t param) +{ + int i; + + memset(state, 0, sizeof(*state)); + for (i = 0; i < 8; ++i) + state->h[i] = blake2s_iv[i]; + state->h[0] ^= param; +} + +static void blake2s_init(struct blake2s_state *state, const size_t outlen) +{ + blake2s_init_param(state, 0x01010000 | outlen); + state->outlen = outlen; +} + +static void blake2s_compress(struct blake2s_state *state, const uint8_t *block, size_t nblocks, const uint32_t inc) +{ + uint32_t m[16]; + uint32_t v[16]; + int i; + + while (nblocks > 0) { + blake2s_increment_counter(state, inc); + memcpy(m, block, BLAKE2S_BLOCK_LEN); + le32_to_cpu_array(m, ARRAY_SIZE(m)); + memcpy(v, state->h, 32); + v[ 8] = blake2s_iv[0]; + v[ 9] = blake2s_iv[1]; + v[10] = blake2s_iv[2]; + v[11] = blake2s_iv[3]; + v[12] = blake2s_iv[4] ^ state->t[0]; + v[13] = blake2s_iv[5] ^ state->t[1]; + v[14] = blake2s_iv[6] ^ state->f[0]; + v[15] = blake2s_iv[7] ^ state->f[1]; + +#define G(r, i, a, b, c, d) do { \ + a += b + m[blake2s_sigma[r][2 * i + 0]]; \ + d = ror32(d ^ a, 16); \ + c += d; \ + b = ror32(b ^ c, 12); \ + a += b + m[blake2s_sigma[r][2 * i + 1]]; \ + d = ror32(d ^ a, 8); \ + c += d; \ + b = ror32(b ^ c, 7); \ +} while (0) + +#define ROUND(r) do { \ + G(r, 0, v[0], v[ 4], v[ 8], v[12]); \ + G(r, 1, v[1], v[ 5], v[ 9], v[13]); \ + G(r, 2, v[2], v[ 6], v[10], v[14]); \ + G(r, 3, v[3], v[ 7], v[11], v[15]); \ + G(r, 4, v[0], v[ 5], v[10], v[15]); \ + G(r, 5, v[1], v[ 6], v[11], v[12]); \ + G(r, 6, v[2], v[ 7], v[ 8], v[13]); \ + G(r, 7, v[3], v[ 4], v[ 9], v[14]); \ +} while (0) + ROUND(0); + ROUND(1); + ROUND(2); + ROUND(3); + ROUND(4); + ROUND(5); + ROUND(6); + ROUND(7); + ROUND(8); + ROUND(9); + +#undef G +#undef ROUND + + for (i = 0; i < 8; ++i) + state->h[i] ^= v[i] ^ v[i + 8]; + + block += BLAKE2S_BLOCK_LEN; + --nblocks; + } +} + +static void blake2s_update(struct blake2s_state *state, const void *inp, size_t inlen) +{ + const size_t fill = BLAKE2S_BLOCK_LEN - state->buflen; + const uint8_t *in = inp; + + if (!inlen) + return; + if (inlen > fill) { + memcpy(state->buf + state->buflen, in, fill); + blake2s_compress(state, state->buf, 1, BLAKE2S_BLOCK_LEN); + state->buflen = 0; + in += fill; + inlen -= fill; + } + if (inlen > BLAKE2S_BLOCK_LEN) { + const size_t nblocks = DIV_ROUND_UP(inlen, BLAKE2S_BLOCK_LEN); + blake2s_compress(state, in, nblocks - 1, BLAKE2S_BLOCK_LEN); + in += BLAKE2S_BLOCK_LEN * (nblocks - 1); + inlen -= BLAKE2S_BLOCK_LEN * (nblocks - 1); + } + memcpy(state->buf + state->buflen, in, inlen); + state->buflen += inlen; +} + +static void blake2s_final(struct blake2s_state *state, uint8_t *out) +{ + blake2s_set_lastblock(state); + memset(state->buf + state->buflen, 0, BLAKE2S_BLOCK_LEN - state->buflen); + blake2s_compress(state, state->buf, 1, state->buflen); + cpu_to_le32_array(state->h, ARRAY_SIZE(state->h)); + memcpy(out, state->h, state->outlen); +} + +static ssize_t getrandom_full(void *buf, size_t count, unsigned int flags) +{ + ssize_t ret, total = 0; + uint8_t *p = buf; + + do { + ret = getrandom(p, count, flags); + if (ret < 0 && errno == EINTR) + continue; + else if (ret < 0) + return ret; + total += ret; + p += ret; + count -= ret; + } while (count); + return total; +} + +static ssize_t read_full(int fd, void *buf, size_t count) +{ + ssize_t ret, total = 0; + uint8_t *p = buf; + + do { + ret = read(fd, p, count); + if (ret < 0 && errno == EINTR) + continue; + else if (ret < 0) + return ret; + else if (ret == 0) + break; + total += ret; + p += ret; + count -= ret; + } while (count); + return total; +} + +static ssize_t write_full(int fd, const void *buf, size_t count) +{ + ssize_t ret, total = 0; + const uint8_t *p = buf; + + do { + ret = write(fd, p, count); + if (ret < 0 && errno == EINTR) + continue; + else if (ret < 0) + return ret; + total += ret; + p += ret; + count -= ret; + } while (count); + return total; +} + +static size_t determine_optimal_seed_len(void) +{ + size_t ret = 0; + char poolsize_str[11] = { 0 }; + int fd = open("/proc/sys/kernel/random/poolsize", O_RDONLY); + + if (fd < 0 || read_full(fd, poolsize_str, sizeof(poolsize_str) - 1) < 0) { + perror("Unable to determine pool size, falling back to 256 bits"); + ret = MIN_SEED_LEN; + } else + ret = DIV_ROUND_UP(strtoul(poolsize_str, NULL, 10), 8); + if (fd >= 0) + close(fd); + if (ret < MIN_SEED_LEN) + ret = MIN_SEED_LEN; + else if (ret > MAX_SEED_LEN) + ret = MAX_SEED_LEN; + return ret; +} + +static int read_new_seed(uint8_t *seed, size_t len, bool *is_creditable) +{ + ssize_t ret; + int urandom_fd; + + *is_creditable = false; + ret = getrandom_full(seed, len, GRND_NONBLOCK); + if (ret == (ssize_t)len) { + *is_creditable = true; + return 0; + } else if (ret < 0 && errno == ENOSYS) { + struct pollfd random_fd = { + .fd = open("/dev/random", O_RDONLY), + .events = POLLIN + }; + if (random_fd.fd < 0) + return -errno; + *is_creditable = poll(&random_fd, 1, 0) == 1; + close(random_fd.fd); + } else if (getrandom_full(seed, len, GRND_INSECURE) == (ssize_t)len) + return 0; + urandom_fd = open("/dev/urandom", O_RDONLY); + if (urandom_fd < 0) + return -1; + ret = read_full(urandom_fd, seed, len); + if (ret == (ssize_t)len) + ret = 0; + else + ret = -errno ? -errno : -EIO; + close(urandom_fd); + errno = -ret; + return ret ? -1 : 0; +} + +static int seed_rng(uint8_t *seed, size_t len, bool credit) +{ + struct { + int entropy_count; + int buf_size; + uint8_t buffer[MAX_SEED_LEN]; + } req = { + .entropy_count = credit ? len * 8 : 0, + .buf_size = len + }; + int random_fd, ret; + + if (len > sizeof(req.buffer)) { + errno = EFBIG; + return -1; + } + memcpy(req.buffer, seed, len); + + random_fd = open("/dev/urandom", O_RDONLY); + if (random_fd < 0) + return -1; + ret = ioctl(random_fd, RNDADDENTROPY, &req); + if (ret) + ret = -errno ? -errno : -EIO; + close(random_fd); + errno = -ret; + return ret ? -1 : 0; +} + +static int seed_from_file_if_exists(const char *filename, int dfd, bool credit, struct blake2s_state *hash) +{ + uint8_t seed[MAX_SEED_LEN]; + ssize_t seed_len; + int fd = -1, ret = 0; + + fd = openat(dfd, filename, O_RDONLY); + if (fd < 0 && errno == ENOENT) + return 0; + else if (fd < 0) { + ret = -errno; + perror("Unable to open seed file"); + goto out; + } + seed_len = read_full(fd, seed, sizeof(seed)); + if (seed_len < 0) { + ret = -errno; + perror("Unable to read seed file"); + goto out; + } + if ((unlinkat(dfd, filename, 0) < 0 || fsync(dfd) < 0) && seed_len) { + ret = -errno; + perror("Unable to remove seed after reading, so not seeding"); + goto out; + } + if (!seed_len) + goto out; + + blake2s_update(hash, &seed_len, sizeof(seed_len)); + blake2s_update(hash, seed, seed_len); + + printf("Seeding %zd bits %s crediting\n", seed_len * 8, credit ? "and" : "without"); + if (seed_rng(seed, seed_len, credit) < 0) { + ret = -errno; + perror("Unable to seed"); + } + +out: + if (fd >= 0) + close(fd); + errno = -ret; + return ret ? -1 : 0; +} + +static bool skip_credit(void) +{ + const char *skip = getenv("SEEDRNG_SKIP_CREDIT"); + return skip && (!strcmp(skip, "1") || !strcasecmp(skip, "true") || + !strcasecmp(skip, "yes") || !strcasecmp(skip, "y")); +} + +int main(int argc __attribute__((unused)), char *argv[] __attribute__((unused))) +{ + static const char seedrng_prefix[] = "SeedRNG v1 Old+New Prefix"; + static const char seedrng_failure[] = "SeedRNG v1 No New Seed Failure"; + int fd = -1, dfd = -1, program_ret = 0; + uint8_t new_seed[MAX_SEED_LEN]; + size_t new_seed_len; + bool new_seed_creditable; + struct timespec realtime = { 0 }, boottime = { 0 }; + struct blake2s_state hash; + + umask(0077); + if (getuid()) { + errno = EACCES; + perror("This program requires root"); + return 1; + } + + blake2s_init(&hash, BLAKE2S_HASH_LEN); + blake2s_update(&hash, seedrng_prefix, strlen(seedrng_prefix)); + clock_gettime(CLOCK_REALTIME, &realtime); + clock_gettime(CLOCK_BOOTTIME, &boottime); + blake2s_update(&hash, &realtime, sizeof(realtime)); + blake2s_update(&hash, &boottime, sizeof(boottime)); + + if (mkdir(SEED_DIR, 0700) < 0 && errno != EEXIST) { + perror("Unable to create seed directory"); + return 1; + } + + dfd = open(SEED_DIR, O_DIRECTORY | O_RDONLY); + if (dfd < 0 || flock(dfd, LOCK_EX) < 0) { + perror("Unable to lock seed directory"); + program_ret = 1; + goto out; + } + + if (seed_from_file_if_exists(NON_CREDITABLE_SEED, dfd, false, &hash) < 0) + program_ret |= 1 << 1; + if (seed_from_file_if_exists(CREDITABLE_SEED, dfd, !skip_credit(), &hash) < 0) + program_ret |= 1 << 2; + + new_seed_len = determine_optimal_seed_len(); + if (read_new_seed(new_seed, new_seed_len, &new_seed_creditable) < 0) { + perror("Unable to read new seed"); + new_seed_len = BLAKE2S_HASH_LEN; + strncpy((char *)new_seed, seedrng_failure, new_seed_len); + program_ret |= 1 << 3; + } + blake2s_update(&hash, &new_seed_len, sizeof(new_seed_len)); + blake2s_update(&hash, new_seed, new_seed_len); + blake2s_final(&hash, new_seed + new_seed_len - BLAKE2S_HASH_LEN); + + printf("Saving %zu bits of %s seed for next boot\n", new_seed_len * 8, new_seed_creditable ? "creditable" : "non-creditable"); + fd = openat(dfd, NON_CREDITABLE_SEED, O_WRONLY | O_CREAT | O_TRUNC, 0400); + if (fd < 0) { + perror("Unable to open seed file for writing"); + program_ret |= 1 << 4; + goto out; + } + if (write_full(fd, new_seed, new_seed_len) != (ssize_t)new_seed_len || fsync(fd) < 0) { + perror("Unable to write seed file"); + program_ret |= 1 << 5; + goto out; + } + if (new_seed_creditable && renameat(dfd, NON_CREDITABLE_SEED, dfd, CREDITABLE_SEED) < 0) { + perror("Unable to make new seed creditable"); + program_ret |= 1 << 6; + } +out: + if (fd >= 0) + close(fd); + if (dfd >= 0) + close(dfd); + return program_ret; +} -- 2.47.0 From 5b0df5aee24d664ef25f8ef2b091c0b71df5cc0c Mon Sep 17 00:00:00 2001 From: catvayor Date: Thu, 26 Sep 2024 17:38:59 +0200 Subject: [PATCH 55/55] feat(seedrng): use it --- modules/s6/default.nix | 4 +++- modules/s6/scripts/rc.init | 2 ++ modules/s6/scripts/rc.shutdown | 1 + 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/s6/default.nix b/modules/s6/default.nix index cd05de7..14de5ba 100644 --- a/modules/s6/default.nix +++ b/modules/s6/default.nix @@ -1,4 +1,4 @@ -{ config, pkgs, ... }: +{ config, pkgs, lib, ... }: let inherit (pkgs) execline @@ -31,6 +31,8 @@ let mkdir $out cp -r $src $out/scripts chmod -R +w $out + substituteInPlace $out/scripts/{rc.init,rc.shutdown} \ + --replace-warn 'pkgs.seedrng' "${lib.getExe' pkgs.seedrng "seedrng"}" ''; }; service = dir { diff --git a/modules/s6/scripts/rc.init b/modules/s6/scripts/rc.init index c098ffb..59ffc8c 100755 --- a/modules/s6/scripts/rc.init +++ b/modules/s6/scripts/rc.init @@ -32,6 +32,8 @@ else mkdir -m 0751 -p /run/services/state fi +pkgs.seedrng + ### If your services are managed by s6-rc: ### (replace /run/service with your scandir) s6-rc-init -d -c /etc/s6-rc/compiled /run/service diff --git a/modules/s6/scripts/rc.shutdown b/modules/s6/scripts/rc.shutdown index 81fac67..15e88ac 100755 --- a/modules/s6/scripts/rc.shutdown +++ b/modules/s6/scripts/rc.shutdown @@ -4,6 +4,7 @@ ### Things to do before hardware halt/reboot/poweroff. ### Ideally, it should be a single call to the service manager, ### telling it to bring all the services down. +pkgs.seedrng ### If your s6-linux-init-maker invocation was made with the -1 ### option, messages from rc.shutdown will appear on /dev/console -- 2.47.0