Add local file embedding for SSH keys and systemd units

base/v0_5_exp/schema.go

@@ -54,8 +54,9 @@ type Disk struct {
 }
 
 type Dropin struct {
-	Contents *string `yaml:"contents"`
-	Name     string  `yaml:"name"`
+	Contents      *string `yaml:"contents"`
+	ContentsLocal *string `yaml:"contents_local"`
+	Name          string  `yaml:"name"`
 }
 
 type File struct {
@@ -166,20 +167,21 @@ type PasswdGroup struct {
 }
 
 type PasswdUser struct {
-	Gecos             *string            `yaml:"gecos"`
-	Groups            []Group            `yaml:"groups"`
-	HomeDir           *string            `yaml:"home_dir"`
-	Name              string             `yaml:"name"`
-	NoCreateHome      *bool              `yaml:"no_create_home"`
-	NoLogInit         *bool              `yaml:"no_log_init"`
-	NoUserGroup       *bool              `yaml:"no_user_group"`
-	PasswordHash      *string            `yaml:"password_hash"`
-	PrimaryGroup      *string            `yaml:"primary_group"`
-	ShouldExist       *bool              `yaml:"should_exist"`
-	SSHAuthorizedKeys []SSHAuthorizedKey `yaml:"ssh_authorized_keys"`
-	Shell             *string            `yaml:"shell"`
-	System            *bool              `yaml:"system"`
-	UID               *int               `yaml:"uid"`
+	Gecos                  *string            `yaml:"gecos"`
+	Groups                 []Group            `yaml:"groups"`
+	HomeDir                *string            `yaml:"home_dir"`
+	Name                   string             `yaml:"name"`
+	NoCreateHome           *bool              `yaml:"no_create_home"`
+	NoLogInit              *bool              `yaml:"no_log_init"`
+	NoUserGroup            *bool              `yaml:"no_user_group"`
+	PasswordHash           *string            `yaml:"password_hash"`
+	PrimaryGroup           *string            `yaml:"primary_group"`
+	ShouldExist            *bool              `yaml:"should_exist"`
+	SSHAuthorizedKeys      []SSHAuthorizedKey `yaml:"ssh_authorized_keys"`
+	SSHAuthorizedKeysLocal []string           `yaml:"ssh_authorized_keys_local"`
+	Shell                  *string            `yaml:"shell"`
+	System                 *bool              `yaml:"system"`
+	UID                    *int               `yaml:"uid"`
 }
 
 type Proxy struct {
@@ -247,11 +249,12 @@ type Tree struct {
 }
 
 type Unit struct {
-	Contents *string  `yaml:"contents"`
-	Dropins  []Dropin `yaml:"dropins"`
-	Enabled  *bool    `yaml:"enabled"`
-	Mask     *bool    `yaml:"mask"`
-	Name     string   `yaml:"name"`
+	Contents      *string  `yaml:"contents"`
+	ContentsLocal *string  `yaml:"contents_local"`
+	Dropins       []Dropin `yaml:"dropins"`
+	Enabled       *bool    `yaml:"enabled"`
+	Mask          *bool    `yaml:"mask"`
+	Name          string   `yaml:"name"`
 }
 
 type Verification struct {

base/v0_5_exp/translate.go

@@ -19,6 +19,7 @@ import (
 	"os"
 	slashpath "path"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"text/template"
 
@@ -86,6 +87,8 @@ func (c Config) ToIgn3_4Unvalidated(options common.TranslateOptions) (types.Conf
 	tr.AddCustomTranslator(translateDirectory)
 	tr.AddCustomTranslator(translateLink)
 	tr.AddCustomTranslator(translateResource)
+	tr.AddCustomTranslator(translatePasswdUser)
+	tr.AddCustomTranslator(translateUnit)
 
 	tm, r := translate.Prefixed(tr, "ignition", &c.Ignition, &ret.Ignition)
 	tm.AddTranslation(path.New("yaml", "version"), path.New("json", "ignition", "version"))
@@ -212,6 +215,132 @@ func translateLink(from Link, options common.TranslateOptions) (to types.Link, t
 	return
 }
 
+func translatePasswdUser(from PasswdUser, options common.TranslateOptions) (to types.PasswdUser, tm translate.TranslationSet, r report.Report) {
+	tr := translate.NewTranslator("yaml", "json", options)
+	tm, r = translate.Prefixed(tr, "gecos", &from.Gecos, &to.Gecos)
+	translate.MergeP(tr, tm, &r, "groups", &from.Groups, &to.Groups)
+	translate.MergeP2(tr, tm, &r, "home_dir", &from.HomeDir, "homeDir", &to.HomeDir)
+	translate.MergeP(tr, tm, &r, "name", &from.Name, &to.Name)
+	translate.MergeP2(tr, tm, &r, "no_create_home", &from.NoCreateHome, "noCreateHome", &to.NoCreateHome)
+	translate.MergeP2(tr, tm, &r, "no_log_init", &from.NoLogInit, "noLogInit", &to.NoLogInit)
+	translate.MergeP2(tr, tm, &r, "no_user_group", &from.NoUserGroup, "noUserGroup", &to.NoUserGroup)
+	translate.MergeP2(tr, tm, &r, "password_hash", &from.PasswordHash, "passwordHash", &to.PasswordHash)
+	translate.MergeP2(tr, tm, &r, "primary_group", &from.PrimaryGroup, "primaryGroup", &to.PrimaryGroup)
+	translate.MergeP(tr, tm, &r, "shell", &from.Shell, &to.Shell)
+	translate.MergeP2(tr, tm, &r, "should_exist", &from.ShouldExist, "shouldExist", &to.ShouldExist)
+	translate.MergeP2(tr, tm, &r, "ssh_authorized_keys", &from.SSHAuthorizedKeys, "sshAuthorizedKeys", &to.SSHAuthorizedKeys)
+	translate.MergeP(tr, tm, &r, "system", &from.System, &to.System)
+	translate.MergeP(tr, tm, &r, "uid", &from.UID, &to.UID)
+
+	if len(from.SSHAuthorizedKeysLocal) > 0 {
+		c := path.New("yaml", "ssh_authorized_keys_local")
+		tm.AddTranslation(c, path.New("json", "sshAuthorizedKeys"))
+
+		if options.FilesDir == "" {
+			r.AddOnError(c, common.ErrNoFilesDir)
+			return
+		}
+
+		for _, sshKeyFile := range from.SSHAuthorizedKeysLocal {
+			sshKeys, err := readSshKeyFile(options.FilesDir, sshKeyFile)
+			if err != nil {
+				r.AddOnError(c, err)
+				continue
+			}
+
+			// offset for TranslationSets when both ssh_authorized_keys and ssh_authorized_keys_local are available
+			offset := len(to.SSHAuthorizedKeys)
+			for i, line := range regexp.MustCompile("\r?\n").Split(sshKeys, -1) {
+				tm.AddTranslation(c, path.New("json", "sshAuthorizedKeys", i+offset))
+				to.SSHAuthorizedKeys = append(to.SSHAuthorizedKeys, types.SSHAuthorizedKey(line))
+			}
+		}
+	}
+
+	return
+}
+
+func readSshKeyFile(filesDir string, sshKeyFile string) (string, error) {
+	// calculate file path within FilesDir and check for path traversal
+	filePath := filepath.Join(filesDir, sshKeyFile)
+	if err := baseutil.EnsurePathWithinFilesDir(filePath, filesDir); err != nil {
+		return "", err
+	}
+	contents, err := os.ReadFile(filePath)
+	if err != nil {
+		return "", err
+	}
+	return string(contents), nil
+}
+
+func translateUnit(from Unit, options common.TranslateOptions) (to types.Unit, tm translate.TranslationSet, r report.Report) {
+	tr := translate.NewTranslator("yaml", "json", options)
+	tr.AddCustomTranslator(translateUnitDropIn)
+	tm, r = translate.Prefixed(tr, "contents", &from.Contents, &to.Contents)
+	translate.MergeP(tr, tm, &r, "dropins", &from.Dropins, &to.Dropins)
+	translate.MergeP(tr, tm, &r, "enabled", &from.Enabled, &to.Enabled)
+	translate.MergeP(tr, tm, &r, "mask", &from.Mask, &to.Mask)
+	translate.MergeP(tr, tm, &r, "name", &from.Name, &to.Name)
+
+	if util.NotEmpty(from.ContentsLocal) {
+		c := path.New("yaml", "contents_local")
+		if options.FilesDir == "" {
+			r.AddOnError(c, common.ErrNoFilesDir)
+			return
+		}
+
+		// calculate file path within FilesDir and check for
+		// path traversal
+		filePath := filepath.Join(options.FilesDir, *from.ContentsLocal)
+		if err := baseutil.EnsurePathWithinFilesDir(filePath, options.FilesDir); err != nil {
+			r.AddOnError(c, err)
+			return
+		}
+		contents, err := os.ReadFile(filePath)
+		if err != nil {
+			r.AddOnError(c, err)
+			return
+		}
+		tm.AddTranslation(c, path.New("json", "contents"))
+		to.Contents = util.StrToPtr(string(contents))
+	}
+
+	return
+}
+
+func translateUnitDropIn(from Dropin, options common.TranslateOptions) (to types.Dropin, tm translate.TranslationSet, r report.Report) {
+	tr := translate.NewTranslator("yaml", "json", options)
+	tm, r = translate.Prefixed(tr, "contents", &from.Contents, &to.Contents)
+	translate.MergeP(tr, tm, &r, "name", &from.Name, &to.Name)
+
+	if util.NotEmpty(from.ContentsLocal) {
+		c := path.New("yaml", "contents_local")
+		tm.AddTranslation(c, path.New("json", "contents"))
+
+		if options.FilesDir == "" {
+			r.AddOnError(c, common.ErrNoFilesDir)
+			return
+		}
+
+		// calculate file path within FilesDir and check for
+		// path traversal
+		filePath := filepath.Join(options.FilesDir, *from.ContentsLocal)
+		if err := baseutil.EnsurePathWithinFilesDir(filePath, options.FilesDir); err != nil {
+			r.AddOnError(c, err)
+			return
+		}
+		contents, err := os.ReadFile(filePath)
+		if err != nil {
+			r.AddOnError(c, err)
+			return
+		}
+		stringContents := string(contents)
+		to.Contents = util.StrToPtr(stringContents)
+	}
+
+	return
+}
+
 func (c Config) processTrees(ret *types.Config, options common.TranslateOptions) (translate.TranslationSet, report.Report) {
 	ts := translate.NewTranslationSet("yaml", "json")
 	var r report.Report