rootfs.rs 85.7%

245 of 286 lines run, 40 of 49 functions · run #181 on main · run missed

//! What a rootfs image is for, read from its own files (OxygenFlow spec
//! §11.2): the ELF header of its shell. An image is an ext4 filesystem,
//! as `flow rootfs import` makes it; this reads just enough of one to
//! follow a path, symlinks included, to a file's first bytes. It needs no
//! mount and no privileges, so a runner can check an image it fetched and
//! a hub an image it keeps as chunks.
//!
//! Read only, and defensive: a malformed image answers `None`, never a
//! panic or an unbounded read.

use std::io::{Read, Seek, SeekFrom};
use std::path::Path;

/// The files whose architecture is the image's, in order: the shell's,
/// else the first program found.
const PROGRAMS: [&str; 5] = ["bin/sh", "bin/busybox", "usr/bin/env", "bin/bash", "usr/bin/sh"];

const MAGIC: u16 = 0xEF53;
const ROOT_INODE: u32 = 2;
const INCOMPAT_64BIT: u32 = 0x80;
const EXTENTS_FL: u32 = 0x80000;
const INLINE_DATA_FL: u32 = 0x1000_0000;
const EXTENT_MAGIC: u16 = 0xF30A;
/// More symlinks than this on one path is a loop.
const MAX_LINKS: u32 = 40;
/// The largest directory read, in bytes.
const MAX_DIR: u64 = 64 << 20;

/// The architecture an ELF header names (`x86_64`, `aarch64`, `riscv64`,
/// …), as `std::env::consts::ARCH` spells it; `None` for anything else.
pub fn elf_arch(header: &[u8]) -> Option<&'static str> {
    if header.len() < 20 || &header[..4] != b"\x7fELF" {
        return None;
    }
    let wide = header[4] == 2;
    let machine = if header[5] == 1 { u16::from_le_bytes([header[18], header[19]]) } else { u16::from_be_bytes([header[18], header[19]]) };
    Some(match machine {
        0x3E => "x86_64",
        0xB7 => "aarch64",
        0xF3 if wide => "riscv64",
        0xF3 => "riscv32",
        0x03 => "x86",
        0x28 => "arm",
        0x15 => "powerpc64",
        0x16 => "s390x",
        _ => return None,
    })
}

/// The architecture of the ext4 image read through `read` (fill the
/// buffer from that byte offset): its shell's, else the first program of
/// [`PROGRAMS`] it has. `None` when it is not ext4 or has none of them.
pub fn arch(read: &mut dyn FnMut(u64, &mut [u8]) -> std::io::Result<()>) -> Option<&'static str> {
    let fs = Fs::open(read)?;
    PROGRAMS.iter().find_map(|p| {
        let inode = fs.resolve(read, p)?;
        if inode.mode & 0xF000 != 0x8000 {
            return None;
        }
        let mut head = [0u8; 20];
        fs.read_file(read, &inode, &mut head)?;
        elf_arch(&head)
    })
}

/// The architecture of the ext4 image at `path` ([`arch`]).
pub fn arch_of_file(path: &Path) -> Option<&'static str> {
    let mut f = std::fs::File::open(path).ok()?;
    arch(&mut |at: u64, buf: &mut [u8]| {
        f.seek(SeekFrom::Start(at))?;
        f.read_exact(buf)
    })
}

struct Fs {
    block: u64,
    first_data_block: u64,
    inodes_per_group: u32,
    inode_size: u64,
    desc_size: u64,
    wide: bool,
    groups: u32,
}

struct Inode {
    mode: u16,
    size: u64,
    flags: u32,
    block: [u8; 60],
}

fn u16_at(b: &[u8], at: usize) -> u16 {
    u16::from_le_bytes([b[at], b[at + 1]])
}

fn u32_at(b: &[u8], at: usize) -> u32 {
    u32::from_le_bytes([b[at], b[at + 1], b[at + 2], b[at + 3]])
}

type ReadFn<'a> = dyn FnMut(u64, &mut [u8]) -> std::io::Result<()> + 'a;

impl Fs {
    fn open(read: &mut ReadFn) -> Option<Fs> {
        let mut sb = [0u8; 1024];
        read(1024, &mut sb).ok()?;
        if u16_at(&sb, 0x38) != MAGIC {
            return None;
        }
        let log = u32_at(&sb, 0x18);
        if log > 6 {
            return None;
        }
        let block = 1024u64 << log;
        let inode_size = if u32_at(&sb, 0x4C) == 0 { 128 } else { u16_at(&sb, 0x58) as u64 };
        let wide = u32_at(&sb, 0x60) & INCOMPAT_64BIT != 0;
        let desc_size = if wide { (u16_at(&sb, 0xFE) as u64).max(64) } else { 32 };
        let inodes_per_group = u32_at(&sb, 0x28);
        let inodes = u32_at(&sb, 0);
        if !(128..=1024).contains(&inode_size) || desc_size > 1024 || inodes_per_group == 0 {
            return None;
        }
        Some(Fs {
            block,
            first_data_block: u32_at(&sb, 0x14) as u64,
            inodes_per_group,
            inode_size,
            desc_size,
            wide,
            groups: inodes.div_ceil(inodes_per_group),
        })
    }

    fn inode(&self, read: &mut ReadFn, n: u32) -> Option<Inode> {
        let (group, index) = ((n.checked_sub(1)?) / self.inodes_per_group, (n - 1) % self.inodes_per_group);
        if group >= self.groups {
            return None;
        }
        let mut desc = [0u8; 64];
        let at = (self.first_data_block + 1) * self.block + group as u64 * self.desc_size;
        let len = if self.wide { 64 } else { 32 };
        read(at, &mut desc[..len]).ok()?;
        let hi = if self.wide { u32_at(&desc, 0x28) as u64 } else { 0 };
        let table = (hi << 32) | u32_at(&desc, 8) as u64;
        let mut raw = [0u8; 160];
        read(table * self.block + index as u64 * self.inode_size, &mut raw[..128]).ok()?;
        let mut block = [0u8; 60];
        block.copy_from_slice(&raw[0x28..0x28 + 60]);
        Some(Inode {
            mode: u16_at(&raw, 0),
            size: ((u32_at(&raw, 0x6C) as u64) << 32) | u32_at(&raw, 4) as u64,
            flags: u32_at(&raw, 0x20),
            block,
        })
    }

    /// The physical block holding logical block `n` of `inode`; `None` for
    /// a hole or an extent not yet written.
    fn map(&self, read: &mut ReadFn, inode: &Inode, n: u64) -> Option<u64> {
        if inode.flags & EXTENTS_FL != 0 {
            let mut node = inode.block.to_vec();
            for _ in 0..6 {
                if u16_at(&node, 0) != EXTENT_MAGIC {
                    return None;
                }
                let entries = (u16_at(&node, 2) as usize).min((node.len() - 12) / 12);
                let depth = u16_at(&node, 6);
                let entry = |i: usize| &node[12 + 12 * i..24 + 12 * i];
                if depth == 0 {
                    return (0..entries).map(entry).find_map(|e| {
                        let (first, len) = (u32_at(e, 0) as u64, u16_at(e, 4) as u64);
                        let start = ((u16_at(e, 6) as u64) << 32) | u32_at(e, 8) as u64;
                        (len <= 32768 && n >= first && n < first + len).then_some(start + (n - first))
                    });
                }
                let next = (0..entries).map(entry).take_while(|e| u32_at(e, 0) as u64 <= n).last()?;
                let child = ((u16_at(next, 8) as u64) << 32) | u32_at(next, 4) as u64;
                let mut buf = vec![0u8; self.block as usize];
                read(child * self.block, &mut buf).ok()?;
                node = buf;
            }
            return None;
        }
        // The old block map: twelve direct blocks, then one and two levels
        // of indirection.
        let per = self.block / 4;
        let ptr = |i: usize| u32_at(&inode.block, i * 4) as u64;
        let mut indirect = |table: u64, i: u64| -> Option<u64> {
            let mut b = [0u8; 4];
            read(table * self.block + i * 4, &mut b).ok()?;
            Some(u32::from_le_bytes(b) as u64).filter(|&p| p != 0)
        };
        let p = if n < 12 {
            ptr(n as usize)
        } else if n < 12 + per {
            indirect(ptr(12), n - 12)?
        } else if n < 12 + per + per * per {
            let k = n - 12 - per;
            let mid = indirect(ptr(13), k / per)?;
            indirect(mid, k % per)?
        } else {
            return None;
        };
        (p != 0).then_some(p)
    }

    /// Fill `buf` from the start of `inode`'s data.
    fn read_file(&self, read: &mut ReadFn, inode: &Inode, buf: &mut [u8]) -> Option<()> {
        if inode.flags & INLINE_DATA_FL != 0 || (buf.len() as u64) > inode.size.min(self.block) {
            return None;
        }
        let at = self.map(read, inode, 0)?;
        read(at * self.block, buf).ok()
    }

    /// Where a symlink points.
    fn link_target(&self, read: &mut ReadFn, inode: &Inode) -> Option<String> {
        if inode.size == 0 || inode.size > 4096 {
            return None;
        }
        let bytes = if inode.flags & (EXTENTS_FL | INLINE_DATA_FL) == 0 && inode.size < 60 {
            inode.block[..inode.size as usize].to_vec()
        } else {
            let mut b = vec![0u8; inode.size as usize];
            self.read_file(read, inode, &mut b)?;
            b
        };
        String::from_utf8(bytes).ok()
    }

    /// The inode named `name` in directory `dir`.
    fn lookup(&self, read: &mut ReadFn, dir: &Inode, name: &str) -> Option<u32> {
        if dir.mode & 0xF000 != 0x4000 || dir.flags & INLINE_DATA_FL != 0 || dir.size > MAX_DIR {
            return None;
        }
        let mut buf = vec![0u8; self.block as usize];
        for n in 0..dir.size.div_ceil(self.block) {
            let Some(at) = self.map(read, dir, n) else { continue };
            read(at * self.block, &mut buf).ok()?;
            let mut off = 0usize;
            while off + 8 <= buf.len() {
                let (ino, rec, len) = (u32_at(&buf, off), u16_at(&buf, off + 4) as usize, buf[off + 6] as usize);
                if rec < 8 || off + rec > buf.len() {
                    break;
                }
                if ino != 0 && off + 8 + len <= buf.len() && &buf[off + 8..off + 8 + len] == name.as_bytes() {
                    return Some(ino);
                }
                off += rec;
            }
        }
        None
    }

    /// The inode at `path` from the root, following every symlink.
    fn resolve(&self, read: &mut ReadFn, path: &str) -> Option<Inode> {
        let mut todo: Vec<String> = path.split('/').filter(|p| !p.is_empty()).rev().map(String::from).collect();
        let mut dirs = vec![ROOT_INODE];
        let mut links = 0;
        while let Some(name) = todo.pop() {
            match name.as_str() {
                "." => continue,
                ".." => {
                    if dirs.len() > 1 {
                        dirs.pop();
                    }
                    continue;
                }
                _ => {}
            }
            let dir = self.inode(read, *dirs.last()?)?;
            let n = self.lookup(read, &dir, &name)?;
            let inode = self.inode(read, n)?;
            if inode.mode & 0xF000 == 0xA000 {
                links += 1;
                if links > MAX_LINKS {
                    return None;
                }
                let target = self.link_target(read, &inode)?;
                if target.starts_with('/') {
                    dirs.truncate(1);
                }
                todo.extend(target.split('/').filter(|p| !p.is_empty()).rev().map(String::from));
                continue;
            }
            dirs.push(n);
        }
        self.inode(read, *dirs.last()?)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::process::Command;

    /// The first 64 bytes of an ELF program for `machine`, 64-bit little
    /// endian.
    fn elf(machine: u16) -> Vec<u8> {
        let mut h = vec![0u8; 64];
        h[..4].copy_from_slice(b"\x7fELF");
        h[4] = 2;
        h[5] = 1;
        h[6] = 1;
        h[16] = 3;
        h[18..20].copy_from_slice(&machine.to_le_bytes());
        h
    }

    /// An ext4 image of `tree`, as `flow rootfs import` makes one; `None`
    /// where mkfs.ext4 is missing.
    fn image(tree: &Path, out: &Path, size: &str, extra: &[&str]) -> Option<()> {
        let status = Command::new("mkfs.ext4")
            .args(["-q", "-F", "-L", "rootfs", "-E", "root_owner=0:0"])
            .args(extra)
            .arg("-d")
            .arg(tree)
            .arg(out)
            .arg(size)
            .status()
            .ok()?;
        assert!(status.success(), "mkfs.ext4 failed");
        Some(())
    }

    #[test]
    fn elf_headers_name_their_architecture() {
        assert_eq!(elf_arch(&elf(0x3E)), Some("x86_64"));
        assert_eq!(elf_arch(&elf(0xF3)), Some("riscv64"));
        assert_eq!(elf_arch(&elf(0xB7)), Some("aarch64"));
        assert_eq!(elf_arch(b"#!/bin/sh\necho hello\n"), None);
        assert_eq!(elf_arch(&elf(0x9999)), None);
    }

    #[test]
    fn an_images_shell_names_its_architecture_through_symlinks() {
        let dir = tempfile::tempdir().unwrap();
        // A merged /usr, as Debian and Ubuntu have it: bin -> usr/bin, and
        // sh -> dash; a riscv64 shell.
        let tree = dir.path().join("tree");
        std::fs::create_dir_all(tree.join("usr/bin")).unwrap();
        std::fs::write(tree.join("usr/bin/dash"), elf(0xF3)).unwrap();
        std::os::unix::fs::symlink("dash", tree.join("usr/bin/sh")).unwrap();
        std::os::unix::fs::symlink("usr/bin", tree.join("bin")).unwrap();
        // A full directory, so lookups cross blocks.
        for i in 0..400 {
            std::fs::write(tree.join(format!("usr/bin/tool-with-a-long-name-{i:04}")), b"#!/bin/sh\n").unwrap();
        }
        let img = dir.path().join("rootfs.ext4");
        if image(&tree, &img, "8M", &[]).is_none() {
            eprintln!("mkfs.ext4 not found: skipped");
            return;
        }
        assert_eq!(arch_of_file(&img), Some("riscv64"));
        // 1 KiB blocks, and an absolute link through a deeper directory.
        let tree2 = dir.path().join("tree2");
        std::fs::create_dir_all(tree2.join("bin")).unwrap();
        std::fs::create_dir_all(tree2.join("opt/busybox/bin")).unwrap();
        std::fs::write(tree2.join("opt/busybox/bin/busybox"), elf(0x3E)).unwrap();
        std::os::unix::fs::symlink("/opt/busybox/bin/../bin/busybox", tree2.join("bin/busybox")).unwrap();
        let img2 = dir.path().join("small.ext4");
        image(&tree2, &img2, "8M", &["-b", "1024"]).unwrap();
        assert_eq!(arch_of_file(&img2), Some("x86_64"), "no sh: busybox decides");
    }

    #[test]
    fn what_is_not_an_image_or_has_no_shell_answers_nothing() {
        let dir = tempfile::tempdir().unwrap();
        let junk = dir.path().join("junk");
        std::fs::write(&junk, vec![0x5Au8; 64 << 10]).unwrap();
        assert_eq!(arch_of_file(&junk), None);
        assert_eq!(arch_of_file(&dir.path().join("missing")), None);
        let tree = dir.path().join("tree");
        std::fs::create_dir_all(tree.join("bin")).unwrap();
        std::fs::write(tree.join("bin/sh"), b"#!/not/an/elf\n").unwrap();
        std::os::unix::fs::symlink("loop", tree.join("bin/loop")).unwrap();
        std::os::unix::fs::symlink("loop", tree.join("bin/busybox")).unwrap();
        let img = dir.path().join("rootfs.ext4");
        if image(&tree, &img, "8M", &[]).is_none() {
            return;
        }
        assert_eq!(arch_of_file(&img), None, "a script shell and a symlink loop name nothing");
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! What a rootfs image is for, read from its own files (OxygenFlow spec
2		//! §11.2): the ELF header of its shell. An image is an ext4 filesystem,
3		//! as `flow rootfs import` makes it; this reads just enough of one to
4		//! follow a path, symlinks included, to a file's first bytes. It needs no
5		//! mount and no privileges, so a runner can check an image it fetched and
6		//! a hub an image it keeps as chunks.
7		//!
8		//! Read only, and defensive: a malformed image answers `None`, never a
9		//! panic or an unbounded read.
10
11		use std::io::{Read, Seek, SeekFrom};
12		use std::path::Path;
13
14		/// The files whose architecture is the image's, in order: the shell's,
15		/// else the first program found.
16		const PROGRAMS: [&str; 5] = ["bin/sh", "bin/busybox", "usr/bin/env", "bin/bash", "usr/bin/sh"];
17
18		const MAGIC: u16 = 0xEF53;
19		const ROOT_INODE: u32 = 2;
20		const INCOMPAT_64BIT: u32 = 0x80;
21		const EXTENTS_FL: u32 = 0x80000;
22		const INLINE_DATA_FL: u32 = 0x1000_0000;
23		const EXTENT_MAGIC: u16 = 0xF30A;
24		/// More symlinks than this on one path is a loop.
25		const MAX_LINKS: u32 = 40;
26		/// The largest directory read, in bytes.
27		const MAX_DIR: u64 = 64 << 20;
28
29		/// The architecture an ELF header names (`x86_64`, `aarch64`, `riscv64`,
30		/// …), as `std::env::consts::ARCH` spells it; `None` for anything else.
31	8×	pub fn elf_arch(header: &[u8]) -> Option<&'static str> {
32	8×	if header.len() < 20 \|\| &header[..4] != b"\x7fELF" {
33	1×	return None;
34	7×	}
35	7×	let wide = header[4] == 2;
36	7×	let machine = if header[5] == 1 { u16::from_le_bytes([header[18], header[19]]) } else { u16::from_be_bytes([header[18], header[19]]) };
37	3×	Some(match machine {
38	2×	0x3E => "x86_64",
39	1×	0xB7 => "aarch64",
40	3×	0xF3 if wide => "riscv64",
41	0×	0xF3 => "riscv32",
42	0×	0x03 => "x86",
43	0×	0x28 => "arm",
44	0×	0x15 => "powerpc64",
45	0×	0x16 => "s390x",
46	1×	_ => return None,
47		})
48	8×	}
49
50		/// The architecture of the ext4 image read through `read` (fill the
51		/// buffer from that byte offset): its shell's, else the first program of
52		/// [`PROGRAMS`] it has. `None` when it is not ext4 or has none of them.
53	9×	pub fn arch(read: &mut dyn FnMut(u64, &mut [u8]) -> std::io::Result<()>) -> Option<&'static str> {
54	9×	let fs = Fs::open(read)?;
55	9×	PROGRAMS.iter().find_map(\|p\| {
56	9×	let inode = fs.resolve(read, p)?;
57	4×	if inode.mode & 0xF000 != 0x8000 {
58	0×	return None;
59	4×	}
60	4×	let mut head = [0u8; 20];
61	4×	fs.read_file(read, &inode, &mut head)?;
62	3×	elf_arch(&head)
63	9×	})
64	9×	}
65
66		/// The architecture of the ext4 image at `path` ([`arch`]).
67	10×	pub fn arch_of_file(path: &Path) -> Option<&'static str> {
68	10×	let mut f = std::fs::File::open(path).ok()?;
69	334×	arch(&mut \|at: u64, buf: &mut [u8]\| {
70	334×	f.seek(SeekFrom::Start(at))?;
71	334×	f.read_exact(buf)
72	334×	})
73	10×	}
74
75		struct Fs {
76		block: u64,
77		first_data_block: u64,
78		inodes_per_group: u32,
79		inode_size: u64,
80		desc_size: u64,
81		wide: bool,
82		groups: u32,
83		}
84
85		struct Inode {
86		mode: u16,
87		size: u64,
88		flags: u32,
89		block: [u8; 60],
90		}
91
92	740×	fn u16_at(b: &[u8], at: usize) -> u16 {
93	740×	u16::from_le_bytes([b[at], b[at + 1]])
94	740×	}
95
96	1056×	fn u32_at(b: &[u8], at: usize) -> u32 {
97	1056×	u32::from_le_bytes([b[at], b[at + 1], b[at + 2], b[at + 3]])
98	1056×	}
99
100		type ReadFn<'a> = dyn FnMut(u64, &mut [u8]) -> std::io::Result<()> + 'a;
101
102		impl Fs {
103	9×	fn open(read: &mut ReadFn) -> Option<Fs> {
104	9×	let mut sb = [0u8; 1024];
105	9×	read(1024, &mut sb).ok()?;
106	7×	if u16_at(&sb, 0x38) != MAGIC {
107	3×	return None;
108	4×	}
109	4×	let log = u32_at(&sb, 0x18);
110	4×	if log > 6 {
111	0×	return None;
112	4×	}
113	4×	let block = 1024u64 << log;
114	4×	let inode_size = if u32_at(&sb, 0x4C) == 0 { 128 } else { u16_at(&sb, 0x58) as u64 };
115	4×	let wide = u32_at(&sb, 0x60) & INCOMPAT_64BIT != 0;
116	4×	let desc_size = if wide { (u16_at(&sb, 0xFE) as u64).max(64) } else { 32 };
117	4×	let inodes_per_group = u32_at(&sb, 0x28);
118	4×	let inodes = u32_at(&sb, 0);
119	4×	if !(128..=1024).contains(&inode_size) \|\| desc_size > 1024 \|\| inodes_per_group == 0 {
120	0×	return None;
121	4×	}
122	4×	Some(Fs {
123	4×	block,
124	4×	first_data_block: u32_at(&sb, 0x14) as u64,
125	4×	inodes_per_group,
126	4×	inode_size,
127	4×	desc_size,
128	4×	wide,
129	4×	groups: inodes.div_ceil(inodes_per_group),
130	4×	})
131	9×	}
132
133	128×	fn inode(&self, read: &mut ReadFn, n: u32) -> Option<Inode> {
134	128×	let (group, index) = ((n.checked_sub(1)?) / self.inodes_per_group, (n - 1) % self.inodes_per_group);
135	128×	if group >= self.groups {
136	0×	return None;
137	128×	}
138	128×	let mut desc = [0u8; 64];
139	128×	let at = (self.first_data_block + 1) * self.block + group as u64 * self.desc_size;
140	128×	let len = if self.wide { 64 } else { 32 };
141	128×	read(at, &mut desc[..len]).ok()?;
142	128×	let hi = if self.wide { u32_at(&desc, 0x28) as u64 } else { 0 };
143	128×	let table = (hi << 32) \| u32_at(&desc, 8) as u64;
144	128×	let mut raw = [0u8; 160];
145	128×	read(table * self.block + index as u64 * self.inode_size, &mut raw[..128]).ok()?;
146	128×	let mut block = [0u8; 60];
147	128×	block.copy_from_slice(&raw[0x28..0x28 + 60]);
148	128×	Some(Inode {
149	128×	mode: u16_at(&raw, 0),
150	128×	size: ((u32_at(&raw, 0x6C) as u64) << 32) \| u32_at(&raw, 4) as u64,
151	128×	flags: u32_at(&raw, 0x20),
152	128×	block,
153	128×	})
154	128×	}
155
156		/// The physical block holding logical block `n` of `inode`; `None` for
157		/// a hole or an extent not yet written.
158	67×	fn map(&self, read: &mut ReadFn, inode: &Inode, n: u64) -> Option<u64> {
159	67×	if inode.flags & EXTENTS_FL != 0 {
160	67×	let mut node = inode.block.to_vec();
161	67×	for _ in 0..6 {
162	69×	if u16_at(&node, 0) != EXTENT_MAGIC {
163	0×	return None;
164	69×	}
165	69×	let entries = (u16_at(&node, 2) as usize).min((node.len() - 12) / 12);
166	69×	let depth = u16_at(&node, 6);
167	69×	let entry = \|i: usize\| &node[12 + 12 * i..24 + 12 * i];
168	69×	if depth == 0 {
169	67×	return (0..entries).map(entry).find_map(\|e\| {
170	67×	let (first, len) = (u32_at(e, 0) as u64, u16_at(e, 4) as u64);
171	67×	let start = ((u16_at(e, 6) as u64) << 32) \| u32_at(e, 8) as u64;
172	67×	(len <= 32768 && n >= first && n < first + len).then_some(start + (n - first))
173	67×	});
174	2×	}
175	2×	let next = (0..entries).map(entry).take_while(\|e\| u32_at(e, 0) as u64 <= n).last()?;
176	2×	let child = ((u16_at(next, 8) as u64) << 32) \| u32_at(next, 4) as u64;
177	2×	let mut buf = vec![0u8; self.block as usize];
178	2×	read(child * self.block, &mut buf).ok()?;
179	2×	node = buf;
180		}
181	0×	return None;
182	0×	}
183		// The old block map: twelve direct blocks, then one and two levels
184		// of indirection.
185	0×	let per = self.block / 4;
186	0×	let ptr = \|i: usize\| u32_at(&inode.block, i * 4) as u64;
187	0×	let mut indirect = \|table: u64, i: u64\| -> Option<u64> {
188	0×	let mut b = [0u8; 4];
189	0×	read(table * self.block + i * 4, &mut b).ok()?;
190	0×	Some(u32::from_le_bytes(b) as u64).filter(\|&p\| p != 0)
191	0×	};
192	0×	let p = if n < 12 {
193	0×	ptr(n as usize)
194	0×	} else if n < 12 + per {
195	0×	indirect(ptr(12), n - 12)?
196	0×	} else if n < 12 + per + per * per {
197	0×	let k = n - 12 - per;
198	0×	let mid = indirect(ptr(13), k / per)?;
199	0×	indirect(mid, k % per)?
200		} else {
201	0×	return None;
202		};
203	0×	(p != 0).then_some(p)
204	67×	}
205
206		/// Fill `buf` from the start of `inode`'s data.
207	4×	fn read_file(&self, read: &mut ReadFn, inode: &Inode, buf: &mut [u8]) -> Option<()> {
208	4×	if inode.flags & INLINE_DATA_FL != 0 \|\| (buf.len() as u64) > inode.size.min(self.block) {
209	1×	return None;
210	3×	}
211	3×	let at = self.map(read, inode, 0)?;
212	3×	read(at * self.block, buf).ok()
213	4×	}
214
215		/// Where a symlink points.
216	43×	fn link_target(&self, read: &mut ReadFn, inode: &Inode) -> Option<String> {
217	43×	if inode.size == 0 \|\| inode.size > 4096 {
218	0×	return None;
219	43×	}
220	43×	let bytes = if inode.flags & (EXTENTS_FL \| INLINE_DATA_FL) == 0 && inode.size < 60 {
221	43×	inode.block[..inode.size as usize].to_vec()
222		} else {
223	0×	let mut b = vec![0u8; inode.size as usize];
224	0×	self.read_file(read, inode, &mut b)?;
225	0×	b
226		};
227	43×	String::from_utf8(bytes).ok()
228	43×	}
229
230		/// The inode named `name` in directory `dir`.
231	64×	fn lookup(&self, read: &mut ReadFn, dir: &Inode, name: &str) -> Option<u32> {
232	64×	if dir.mode & 0xF000 != 0x4000 \|\| dir.flags & INLINE_DATA_FL != 0 \|\| dir.size > MAX_DIR {
233	0×	return None;
234	64×	}
235	64×	let mut buf = vec![0u8; self.block as usize];
236	64×	for n in 0..dir.size.div_ceil(self.block) {
237	64×	let Some(at) = self.map(read, dir, n) else { continue };
238	64×	read(at * self.block, &mut buf).ok()?;
239	64×	let mut off = 0usize;
240	258×	while off + 8 <= buf.len() {
241	254×	let (ino, rec, len) = (u32_at(&buf, off), u16_at(&buf, off + 4) as usize, buf[off + 6] as usize);
242	254×	if rec < 8 \|\| off + rec > buf.len() {
243	0×	break;
244	254×	}
245	254×	if ino != 0 && off + 8 + len <= buf.len() && &buf[off + 8..off + 8 + len] == name.as_bytes() {
246	60×	return Some(ino);
247	194×	}
248	194×	off += rec;
249		}
250		}
251	4×	None
252	64×	}
253
254		/// The inode at `path` from the root, following every symlink.
255	9×	fn resolve(&self, read: &mut ReadFn, path: &str) -> Option<Inode> {
256	20×	let mut todo: Vec<String> = path.split('/').filter(\|p\| !p.is_empty()).rev().map(String::from).collect();
257	9×	let mut dirs = vec![ROOT_INODE];
258	9×	let mut links = 0;
259	69×	while let Some(name) = todo.pop() {
260	65×	match name.as_str() {
261	65×	"." => continue,
262	65×	".." => {
263	1×	if dirs.len() > 1 {
264	1×	dirs.pop();
265	1×	}
266	1×	continue;
267		}
268	64×	_ => {}
269		}
270	64×	let dir = self.inode(read, *dirs.last()?)?;
271	64×	let n = self.lookup(read, &dir, &name)?;
272	60×	let inode = self.inode(read, n)?;
273	60×	if inode.mode & 0xF000 == 0xA000 {
274	44×	links += 1;
275	44×	if links > MAX_LINKS {
276	1×	return None;
277	43×	}
278	43×	let target = self.link_target(read, &inode)?;
279	43×	if target.starts_with('/') {
280	1×	dirs.truncate(1);
281	42×	}
282	50×	todo.extend(target.split('/').filter(\|p\| !p.is_empty()).rev().map(String::from));
283	43×	continue;
284	16×	}
285	16×	dirs.push(n);
286		}
287	4×	self.inode(read, *dirs.last()?)
288	9×	}
289		}
290
291		#[cfg(test)]
292		mod tests {
293		use super::*;
294		use std::process::Command;
295
296		/// The first 64 bytes of an ELF program for `machine`, 64-bit little
297		/// endian.
298	6×	fn elf(machine: u16) -> Vec<u8> {
299	6×	let mut h = vec![0u8; 64];
300	6×	h[..4].copy_from_slice(b"\x7fELF");
301	6×	h[4] = 2;
302	6×	h[5] = 1;
303	6×	h[6] = 1;
304	6×	h[16] = 3;
305	6×	h[18..20].copy_from_slice(&machine.to_le_bytes());
306	6×	h
307	6×	}
308
309		/// An ext4 image of `tree`, as `flow rootfs import` makes one; `None`
310		/// where mkfs.ext4 is missing.
311	3×	fn image(tree: &Path, out: &Path, size: &str, extra: &[&str]) -> Option<()> {
312	3×	let status = Command::new("mkfs.ext4")
313	3×	.args(["-q", "-F", "-L", "rootfs", "-E", "root_owner=0:0"])
314	3×	.args(extra)
315	3×	.arg("-d")
316	3×	.arg(tree)
317	3×	.arg(out)
318	3×	.arg(size)
319	3×	.status()
320	3×	.ok()?;
321	3×	assert!(status.success(), "mkfs.ext4 failed");
322	3×	Some(())
323	3×	}
324
325		#[test]
326	1×	fn elf_headers_name_their_architecture() {
327	1×	assert_eq!(elf_arch(&elf(0x3E)), Some("x86_64"));
328	1×	assert_eq!(elf_arch(&elf(0xF3)), Some("riscv64"));
329	1×	assert_eq!(elf_arch(&elf(0xB7)), Some("aarch64"));
330	1×	assert_eq!(elf_arch(b"#!/bin/sh\necho hello\n"), None);
331	1×	assert_eq!(elf_arch(&elf(0x9999)), None);
332	1×	}
333
334		#[test]
335	1×	fn an_images_shell_names_its_architecture_through_symlinks() {
336	1×	let dir = tempfile::tempdir().unwrap();
337		// A merged /usr, as Debian and Ubuntu have it: bin -> usr/bin, and
338		// sh -> dash; a riscv64 shell.
339	1×	let tree = dir.path().join("tree");
340	1×	std::fs::create_dir_all(tree.join("usr/bin")).unwrap();
341	1×	std::fs::write(tree.join("usr/bin/dash"), elf(0xF3)).unwrap();
342	1×	std::os::unix::fs::symlink("dash", tree.join("usr/bin/sh")).unwrap();
343	1×	std::os::unix::fs::symlink("usr/bin", tree.join("bin")).unwrap();
344		// A full directory, so lookups cross blocks.
345	400×	for i in 0..400 {
346	400×	std::fs::write(tree.join(format!("usr/bin/tool-with-a-long-name-{i:04}")), b"#!/bin/sh\n").unwrap();
347	400×	}
348	1×	let img = dir.path().join("rootfs.ext4");
349	1×	if image(&tree, &img, "8M", &[]).is_none() {
350	0×	eprintln!("mkfs.ext4 not found: skipped");
351	0×	return;
352	1×	}
353	1×	assert_eq!(arch_of_file(&img), Some("riscv64"));
354		// 1 KiB blocks, and an absolute link through a deeper directory.
355	1×	let tree2 = dir.path().join("tree2");
356	1×	std::fs::create_dir_all(tree2.join("bin")).unwrap();
357	1×	std::fs::create_dir_all(tree2.join("opt/busybox/bin")).unwrap();
358	1×	std::fs::write(tree2.join("opt/busybox/bin/busybox"), elf(0x3E)).unwrap();
359	1×	std::os::unix::fs::symlink("/opt/busybox/bin/../bin/busybox", tree2.join("bin/busybox")).unwrap();
360	1×	let img2 = dir.path().join("small.ext4");
361	1×	image(&tree2, &img2, "8M", &["-b", "1024"]).unwrap();
362	1×	assert_eq!(arch_of_file(&img2), Some("x86_64"), "no sh: busybox decides");
363	1×	}
364
365		#[test]
366	1×	fn what_is_not_an_image_or_has_no_shell_answers_nothing() {
367	1×	let dir = tempfile::tempdir().unwrap();
368	1×	let junk = dir.path().join("junk");
369	1×	std::fs::write(&junk, vec![0x5Au8; 64 << 10]).unwrap();
370	1×	assert_eq!(arch_of_file(&junk), None);
371	1×	assert_eq!(arch_of_file(&dir.path().join("missing")), None);
372	1×	let tree = dir.path().join("tree");
373	1×	std::fs::create_dir_all(tree.join("bin")).unwrap();
374	1×	std::fs::write(tree.join("bin/sh"), b"#!/not/an/elf\n").unwrap();
375	1×	std::os::unix::fs::symlink("loop", tree.join("bin/loop")).unwrap();
376	1×	std::os::unix::fs::symlink("loop", tree.join("bin/busybox")).unwrap();
377	1×	let img = dir.path().join("rootfs.ext4");
378	1×	if image(&tree, &img, "8M", &[]).is_none() {
379	0×	return;
380	1×	}
381	1×	assert_eq!(arch_of_file(&img), None, "a script shell and a symlink loop name nothing");
382	1×	}
383		}

Coverage / crates/jet/src/rootfs.rs 85.7%

Keyboard