kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bxcore, gatewayd, loopd: the secret store moves to bxcore::secrets

Browse Source 
Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>
This commit is contained in:
kyle
2026-09-27 19:08:42 -07:00
co-authored by ornith-1.5-35b-a3b
parent de60c9e13a
commit f594e0d9d4
20 changed files with 385 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/gatewayd/src/config.rs
+1 -80
View File
@@ -3,6 +3,7 @@
use std::collections::BTreeMap;
use std::path::{Path, PathBuf};
use bxcore::secrets::{SecretSource, SecretSpec};
use serde::Deserialize;
#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
@@ -39,26 +40,6 @@ pub struct MattermostConfig {
pub ca_file: Option<PathBuf>,
}
/// Where one secret comes from: exactly one of the three is set (checked by `Config::load`).
#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Default)]
#[serde(deny_unknown_fields)]
pub struct SecretSpec {
#[serde(default)]
pub credential: Option<String>,
#[serde(default)]
pub env: Option<String>,
#[serde(default)]
pub file: Option<PathBuf>,
}
/// A checked `SecretSpec`.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum SecretSource {
Credential(String),
Env(String),
File(PathBuf),
}
#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AllowConfig {
@@ -267,66 +248,6 @@ impl Config {
}
}
impl SecretSpec {
/// Exactly one source, well formed.
pub fn source(&self) -> Result<SecretSource, String> {
// Exactly one of the three set, else "needs exactly one of credential, env and file".
// credential: not empty, only ASCII letters, digits, _ . -. env: not empty, only A-Z, 0-9,
// _. file: an absolute path. The messages are in the task.
let mut count = 0;
if self.credential.is_some() {
count += 1;
}
if self.env.is_some() {
count += 1;
}
if self.file.is_some() {
count += 1;
}
if count != 1 {
return Err("needs exactly one of credential, env and file".to_string());
}
if let Some(credential) = &self.credential {
if credential.is_empty()
|| !credential.bytes().all(|b| {
b.is_ascii_alphabetic() || b.is_ascii_digit() || matches!(b, b'_' | b'.' | b'-')
})
{
return Err(format!(
"credential {:?} is not a credential name (letters, digits, _ . -)",
credential
));
}
return Ok(SecretSource::Credential(credential.clone()));
}
if let Some(env) = &self.env {
if env.is_empty()
|| !env
.bytes()
.all(|b| matches!(b, b'A'..=b'Z' | b'0'..=b'9' | b'_'))
{
return Err(format!(
"env {:?} is not a variable name (A-Z, 0-9, _)",
env
));
}
return Ok(SecretSource::Env(env.clone()));
}
// `count == 1` and the two above are `None`, so this is `Some`.
let file = match &self.file {
Some(file) => file,
None => return Err("needs exactly one of credential, env and file".to_string()),
};
if !file.is_absolute() {
return Err(format!(
"file {:?} must be an absolute path",
file.display()
));
}
Ok(SecretSource::File(file.clone()))
}
}
/// A Mattermost id: 26 characters of `a-z0-9`.
pub fn valid_id(id: &str) -> bool {
// 26 bytes, each a-z or 0-9.
crates/gatewayd/src/lib.rs
-1
View File
@@ -8,7 +8,6 @@ pub mod gateway;
pub mod http;
pub mod mm;
pub mod net;
pub mod secrets;
pub mod serve;
pub mod sessions;
pub mod state;
crates/gatewayd/src/main.rs
+6 -4
View File
@@ -7,8 +7,8 @@ use std::process::ExitCode;
use std::sync::Arc;
use std::sync::atomic::AtomicBool;
use bxcore::secrets;
use gatewayd::config::{Config, MATTERMOST_TOKEN};
use gatewayd::secrets;
use gatewayd::serve::{START_FAILED, Tuning, run};
fn main() -> ExitCode {
@@ -30,8 +30,9 @@ fn serve(path: &Path) -> ExitCode {
// "gatewayd: {e}\n{START_FAILED}".
// 2. `let source = match config.token_source() { ... }`: an Err(why) prints
// "gatewayd: {}: {why}\n{START_FAILED}" with `path.display()`.
// 3. `let loaded = match secrets::load(MATTERMOST_TOKEN, &source, &|k| std::env::var_os(k))`:
// an Err(e) prints "gatewayd: {e}" (the error carries its own pointer).
// 3. `let env = |k: &str| std::env::var_os(k);`, then
// `let loaded = match secrets::load("gatewayd", MATTERMOST_TOKEN, &source, &env)`: an Err(e)
// prints "gatewayd: {e}" (the error carries its own pointer).
// Then `if let Some(warning) = &loaded.warning { eprintln!("{warning}"); }`.
// 4. The state file's directory:
// `let dir = config.state_path().parent().map(Path::to_path_buf).unwrap_or_default();`
@@ -54,7 +55,8 @@ fn serve(path: &Path) -> ExitCode {
return ExitCode::from(1);
}
};
let loaded = match secrets::load(MATTERMOST_TOKEN, &source, &|k| std::env::var_os(k)) {
let env = |k: &str| std::env::var_os(k);
let loaded = match secrets::load("gatewayd", MATTERMOST_TOKEN, &source, &env) {
Ok(loaded) => loaded,
Err(e) => {
eprintln!("gatewayd: {e}");
crates/gatewayd/src/mm/rest.rs
+1 -1
View File
@@ -3,13 +3,13 @@
use std::time::{Duration, SystemTime};
use bxcore::secrets::Secret;
use serde::Deserialize;
use crate::config::valid_id;
use crate::http::{self, Response, rate_limit_wait};
use crate::mm::{Me, MmError, Post, Since, json, since_list};
use crate::net::Connector;
use crate::secrets::Secret;
use crate::ws::conn::host_header;
/// The pause before trying a call again after a 5xx.
crates/gatewayd/src/secrets.rs
-233
View File
@@ -1,233 +0,0 @@
//! The `SecretStore`: a secret from a systemd credential, an environment variable, or an owner-only
//! file (M4a spec, section 4; the brief after P15). A `Secret` cannot be printed.
use std::ffi::OsString;
use std::io::Read;
use std::os::unix::fs::MetadataExt;
use std::path::Path;
use zeroize::Zeroizing;
use crate::config::SecretSource;
pub const RUNBOOK: &str = "see docs/runbook.md#secret-unavailable";
pub const RUNBOOK_FILE: &str = "see docs/runbook.md#secret-in-a-file";
/// A secret's text. No `Display`; `Debug` shows nothing of it; wiped when dropped.
pub struct Secret(Zeroizing<String>);
impl Secret {
pub fn new(text: String) -> Secret {
Secret(Zeroizing::new(text))
}
/// The text, for the one place that must send it.
pub fn expose(&self) -> &str {
&self.0
}
}
impl std::fmt::Debug for Secret {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
f.write_str("Secret(…)")
}
}
/// A loaded secret, and the warning to print for it, if any.
#[derive(Debug)]
pub struct Loaded {
pub secret: Secret,
pub warning: Option<String>,
}
#[derive(Debug)]
pub struct SecretError {
pub name: String,
pub why: String,
}
impl std::fmt::Display for SecretError {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
write!(f, "secret {}: {}\n{RUNBOOK}", self.name, self.why)
}
}
impl std::error::Error for SecretError {}
/// Load secret `name` from `source`. `env` reads an environment variable (in `gatewayd`,
/// `std::env::var_os`); tests pass their own.
pub fn load(
name: &str,
source: &SecretSource,
env: &dyn Fn(&str) -> Option<OsString>,
) -> Result<Loaded, SecretError> {
// By source (spec section 4). Credential: read $CREDENTIALS_DIRECTORY/<name> (through `env`,
// not std::env); an unset variable, or a file that cannot be read, is an error. Env: the
// variable, UTF-8; unset is an error. File: `read_checked` checks the path, opens and re-checks
// the same file handle, reads it, and set `warning`
// to the exact text in the task. Every value goes through `value`. Every error is a
// `SecretError` naming the secret, never the value.
match source {
SecretSource::Credential(cred) => {
let dir = match env("CREDENTIALS_DIRECTORY") {
Some(dir) => dir,
None => return Err(SecretError {
name: name.to_string(),
why: "CREDENTIALS_DIRECTORY is not set: gatewayd was not started by systemd with LoadCredentialEncrypted=".to_string(),
}),
};
let path = Path::new(dir.as_os_str()).join(cred);
let bytes = match std::fs::read(&path) {
Ok(bytes) => bytes,
Err(e) => {
return Err(SecretError {
name: name.to_string(),
why: format!("cannot read the credential {}: {}", path.display(), e),
});
}
};
let secret = value(bytes).map_err(|why| SecretError {
name: name.to_string(),
why,
})?;
Ok(Loaded {
secret,
warning: None,
})
}
SecretSource::Env(var) => {
let val = match env(var) {
Some(val) => val,
None => {
return Err(SecretError {
name: name.to_string(),
why: format!("the environment variable {} is not set", var),
});
}
};
let text = match val.to_str() {
Some(text) => text,
None => {
return Err(SecretError {
name: name.to_string(),
why: format!("the environment variable {} is not UTF-8", var),
});
}
};
let secret = value(text.as_bytes().to_vec()).map_err(|why| SecretError {
name: name.to_string(),
why,
})?;
Ok(Loaded {
secret,
warning: None,
})
}
SecretSource::File(path) => {
let mut bytes = match read_checked(path, &|| {}) {
Ok(bytes) => bytes,
Err(why) => {
return Err(SecretError {
name: name.to_string(),
why,
});
}
};
let secret = value(std::mem::take(&mut *bytes)).map_err(|why| SecretError {
name: name.to_string(),
why,
})?;
Ok(Loaded {
secret,
warning: Some(format!(
"gatewayd: warning: secret {} is read in plaintext from {}; a systemd credential keeps it encrypted at rest ({RUNBOOK_FILE})",
name,
path.display()
)),
})
}
}
}
/// The bytes of an owner-only regular file, read from the very file that was checked. `between`
/// runs after the path is checked and before it is opened: `load` passes `&|| {}`; tests use it
/// to swap the file.
pub fn read_checked(path: &Path, between: &dyn Fn()) -> Result<Zeroizing<Vec<u8>>, String> {
// 1. `path.is_absolute()`, else "<path> is not an absolute path".
// 2. `let named = std::fs::symlink_metadata(path)`, an Err(e) is "cannot read <path>: <e>";
// `named.file_type().is_symlink()` is "<path> is a symbolic link";
// `!named.file_type().is_file()` is "<path> is not a regular file".
// 3. `between();`
// 4. `let mut file = std::fs::File::open(path)`, an Err(e) is "cannot read <path>: <e>";
// `let opened = file.metadata()`, the same error text.
// 5. `if (opened.dev(), opened.ino()) != (named.dev(), named.ino())`:
// "<path> changed while it was read".
// 6. The owner and mode checks from the original file check, word for word, on `opened` (not
// on `named`): the uid of `user_id()`; "<path> is not owned by the user gatewayd runs as";
// "<path> has mode <mode:03o>; only the owner may read it (0600 or 0400)".
// 7. `let mut bytes = Zeroizing::new(Vec::new());` then `file.read_to_end(&mut bytes)`, an
// Err(e) is "cannot read <path>: <e>". Ok(bytes).
if !path.is_absolute() {
return Err(format!("{} is not an absolute path", path.display()));
}
let named = std::fs::symlink_metadata(path)
.map_err(|e| format!("cannot read {}: {}", path.display(), e))?;
if named.file_type().is_symlink() {
return Err(format!("{} is a symbolic link", path.display()));
}
if !named.file_type().is_file() {
return Err(format!("{} is not a regular file", path.display()));
}
between();
let mut file =
std::fs::File::open(path).map_err(|e| format!("cannot read {}: {}", path.display(), e))?;
let opened = file
.metadata()
.map_err(|e| format!("cannot read {}: {}", path.display(), e))?;
if (opened.dev(), opened.ino()) != (named.dev(), named.ino()) {
return Err(format!("{} changed while it was read", path.display()));
}
let owner = user_id()?;
if opened.uid() != owner {
return Err(format!(
"{} is not owned by the user gatewayd runs as",
path.display()
));
}
let mode = opened.mode() & 0o777;
if mode & 0o077 != 0 {
return Err(format!(
"{} has mode {:03o}; only the owner may read it (0600 or 0400)",
path.display(),
mode
));
}
let mut bytes = Zeroizing::new(Vec::new());
file.read_to_end(&mut bytes)
.map_err(|e| format!("cannot read {}: {}", path.display(), e))?;
Ok(bytes)
}
/// The user id this process runs as: the owner of a pipe it has just made. `std` has no call for
/// it, and `/proc/self` is Linux only.
fn user_id() -> Result<u32, String> {
let (reader, _writer) = std::io::pipe().map_err(|e| format!("cannot make a pipe: {e}"))?;
let pipe = std::fs::File::from(std::os::fd::OwnedFd::from(reader));
let meta = pipe
.metadata()
.map_err(|e| format!("cannot read a pipe: {e}"))?;
Ok(meta.uid())
}
/// The text without one trailing newline; not empty; UTF-8.
fn value(bytes: Vec<u8>) -> Result<Secret, String> {
// UTF-8 (else an error), one trailing newline removed, not empty. Keep the bytes in `Zeroizing`
// until they are inside the `Secret`.
let bytes = Zeroizing::new(bytes);
let text = std::str::from_utf8(&bytes).map_err(|_| "the value is not UTF-8".to_string())?;
let text = text.strip_suffix('\n').unwrap_or(text);
if text.is_empty() {
return Err("the value is empty".to_string());
}
Ok(Secret::new(text.to_string()))
}
crates/gatewayd/src/serve/mod.rs
+1 -1
View File
@@ -13,6 +13,7 @@ use std::sync::mpsc::{self, Receiver, Sender};
use std::time::{Duration, Instant};
use bxcore::SessionId;
use bxcore::secrets::Secret;
use crate::approvals::Registry;
use crate::config::Config;
@@ -20,7 +21,6 @@ use crate::gateway::{self, ToLoop};
use crate::mm::rest::Client;
use crate::mm::{Event, Me, MmError, parse_event};
use crate::net::Connector;
use crate::secrets::Secret;
use crate::sessions::{Queues, Router};
use crate::state::{State, StateError};
use crate::ws::conn::{Timing, Ws};