feat: fixed some repetitive code, added server map on client, planned next init key-exchange & auth

Author: ronakgh97

Cargo.lock

@@ -43,15 +43,15 @@ dashmap = "7.0.0-rc2"
 sha2 = "0.11.0"
 uuid = { version = "1.23.1", features = ["v4"] }
 indicatif = "0.18.4"
-rand = "0.10.1"
+rand = { version = "0.10.1" }
 postcard = { version = "1.1.3", features = ["alloc", "use-std"] }
 aes = "0.9.0"
 ed25519-dalek = { version = "3.0.0-pre.7", features = ["rand_core", "pem", "pkcs8"] }
 x25519-dalek = "3.0.0-pre.6"
+serde_json = "1.0.149"
 # zstd = "0.13.3"
 # tar = "0.4.45"
 # ahash = "0.8.12"
-# serde_json = "1.0.149"
 # bytes = "1.11.1"
 # blake3 = "1.8.5"
 # threadpool = "1.8.1"

Cargo.toml

@@ -1,17 +1,23 @@
 Tweaking with Network Protocol & Security while building Amazon s3 ***COMMUNIST VERSION***
 
-`Ohh no I'm getting side-tracked by crypto shit`
+`Goal: Protect servers from 'bad' users. Protect users from 'bad' servers`
 
 **Features**
 
 - file-system native database
-- super secure & decentralized e2e `(uses ed22519 key for identify & x25519 for protocol encryption)`
+- super secure & decentralized e2e `(uses ed22519 key for identify & x25519 for encryption)`
 - layering, delta transfer push/pull
 - built-in TLS'ish, server secure even on raw ip port
 - backups, versioning, secure key rotation
 - zero-trust architecture `(ssh like handshake)`
 - fearless concurrency `(very little locks freeze)`
 
+**Limitations**
+
+- vulnerable to path injection `(maybe have some edge cases)`
+- first connection not secure `(user must trust the server first)`
+- no recovery keys
+
 **How to set up?**
 
 Use docker [image](https://hub.docker.com/repository/docker/ronakgh97/rdrive/general) then you can use the CLI to

README.md

@@ -143,18 +143,9 @@ async fn main() -> Result<()> {
                 .to_string_lossy()
                 .to_string();
 
+            // read existing or create new
             let catalog_path = get_catalog_path()?;
-            let catalog_dir = catalog_path
-                .parent()
-                .ok_or_else(|| anyhow::anyhow!("Invalid catalog path"))?;
-            tokio::fs::create_dir_all(catalog_dir).await?;
-
-            // Read existing or new
-            let mut catalog = if catalog_path.exists() {
-                Catalog::read(&catalog_path).await?
-            } else {
-                Catalog::default()
-            };
+            let mut catalog = Catalog::read_or_create(&catalog_path).await?;
 
             let file_id = if let Some(tracked) = catalog.file_index.get(&file_name) {
                 for (i, uuid) in tracked.iter().enumerate() {
@@ -249,7 +240,7 @@ async fn main() -> Result<()> {
                     let catalog_path = get_catalog_path()?;
 
                     if catalog_path.exists() {
-                        let mut catalog = Catalog::read(&catalog_path).await?;
+                        let mut catalog = Catalog::read_or_create(&catalog_path).await?;
                         catalog.update_on_pull(&catalog_path, &file_id).await?;
                     }
                 }
@@ -272,7 +263,7 @@ async fn main() -> Result<()> {
             todo!("Non-trivial to implement this feature")
         }
         Some(ClientCommands::Ls { .. }) => {
-            let file_map = Catalog::read(&get_catalog_path()?).await.map_err(|e| {
+            let file_map = Catalog::read_or_create(&get_catalog_path()?).await.map_err(|e| {
                 anyhow::anyhow!(
                     "Failed to read catalog, make sure to push at least one file before listing: {}",
                     e

src/bin/client.rs

@@ -18,7 +18,7 @@ async fn main() -> Result<()> {
     match args.command {
         Some(ServerCommands::Serve { port, protocol }) => match protocol.as_str() {
             "v1" => {
-                let key_path = get_server_key_dir().await?;
+                let key_path = get_server_key_dir()?;
 
                 let (pri_key, pub_key) =
                     (key_path.join("private.pem"), key_path.join("public.pem"));

src/bin/server.rs

@@ -42,15 +42,15 @@ pub async fn get_public_storage_dir() -> Result<PathBuf> {
 }
 
 #[inline(always)]
-pub async fn get_allowed_client_dir() -> Result<PathBuf> {
+pub async fn get_authorized_client_dir() -> Result<PathBuf> {
     let home_dir =
         dirs::home_dir().ok_or_else(|| anyhow::anyhow!("Failed to get home directory"))?;
     let allowed_clients_path = home_dir.join(".rdrive").join("authorized_keys");
     Ok(allowed_clients_path)
 }
 
 #[inline]
-pub async fn get_server_key_dir() -> Result<PathBuf> {
+pub fn get_server_key_dir() -> Result<PathBuf> {
     let home_dir =
         dirs::home_dir().ok_or_else(|| anyhow::anyhow!("Failed to get home directory"))?;
     let server_keys_path = home_dir.join(".rdrive").join("server");
@@ -72,6 +72,11 @@ pub fn get_catalog_path() -> Result<PathBuf> {
     Ok(path)
 }
 
+pub fn get_authorized_server_map_path() -> Result<PathBuf> {
+    let path = get_user_key_dir()?.join("server.map");
+    Ok(path)
+}
+
 /// Hash a whole file and return the hex string of the hash
 pub fn file_hasher(path: &Path) -> Result<String> {
     let file = std::fs::File::open(path)?;
@@ -145,28 +150,43 @@ impl MetadataFile {
 }
 
 #[derive(Deserialize, Serialize, Default)]
-pub struct FileInfo {
+pub struct FileHistory {
     pub name: String,
     pub last_push: String,
     pub last_pull: String,
 }
 
 #[derive(Deserialize, Serialize, Default)]
 pub struct Catalog {
-    pub file_map: HashMap<String, FileInfo>,
+    pub file_map: HashMap<String, FileHistory>,
     pub file_index: HashMap<String, Vec<String>>,
 }
 
 impl Catalog {
-    pub async fn read(path: &PathBuf) -> Result<Self> {
+    async fn read(path: &PathBuf) -> Result<Self> {
         use postcard::from_bytes;
 
         let file = tokio::fs::read(path).await?;
         let catalog = from_bytes(&file)?;
         Ok(catalog)
     }
 
-    pub async fn write(&mut self, path: &PathBuf) -> Result<()> {
+    pub async fn read_or_create(path: &PathBuf) -> Result<Self> {
+        let catalog_dir = path
+            .parent()
+            .ok_or_else(|| anyhow::anyhow!("Invalid catalog path"))?;
+        tokio::fs::create_dir_all(catalog_dir).await?;
+
+        // Read existing or new
+        let catalog = match path.exists() {
+            true => Self::read(path).await?,
+            false => Self::default(),
+        };
+
+        Ok(catalog)
+    }
+
+    async fn write(&mut self, path: &PathBuf) -> Result<()> {
         use postcard::to_allocvec;
 
         let bytes = to_allocvec(self)?;
@@ -188,7 +208,7 @@ impl Catalog {
             .and_modify(|meta| {
                 meta.last_push = timestamp.clone();
             })
-            .or_insert_with(|| FileInfo {
+            .or_insert_with(|| FileHistory {
                 name: file_name.to_string(),
                 last_push: timestamp.clone(),
                 last_pull: "never".to_string(),
@@ -217,6 +237,39 @@ impl Catalog {
     }
 }
 
+#[derive(Deserialize, Serialize, Default)]
+pub struct AuthServerMap {
+    /// Map -> (Host/IP, pubkey_hex)
+    pub server_map: HashMap<String, String>,
+}
+
+impl AuthServerMap {
+    pub async fn read_or_create(path: &PathBuf) -> Result<Self> {
+        let server_map = path
+            .parent()
+            .ok_or_else(|| anyhow::anyhow!("Invalid server map path"))?;
+        tokio::fs::create_dir_all(server_map).await?;
+
+        let map = match path.exists() {
+            true => {
+                let str = tokio::fs::read_to_string(&path).await?;
+                serde_json::from_str(str.as_str())
+                    .map_err(|e| anyhow::anyhow!("Failed to parse server map JSON: {}", e))?
+            }
+            false => Self::default(),
+        };
+
+        Ok(map)
+    }
+
+    pub async fn write(&mut self, path: &PathBuf) -> Result<()> {
+        let json = serde_json::to_string_pretty(self)
+            .map_err(|e| anyhow::anyhow!("Failed to serialize server map to JSON: {}", e))?;
+        tokio::fs::write(path, json).await?;
+        Ok(())
+    }
+}
+
 pub static START_TIME: OnceLock<chrono::DateTime<Local>> = OnceLock::new();
 pub static ACTIVE_CONNECTIONS: LazyLock<Arc<AtomicUsize>> =
     LazyLock::new(|| Arc::new(AtomicUsize::new(0)));
@@ -226,6 +279,53 @@ pub static ENABLE_CLIENT_WHITELIST: LazyLock<bool> = LazyLock::new(|| {
         .and_then(|s| s.parse().ok())
         .unwrap_or(true) // default to true
 });
+
+pub static SERVER_PUB_KEY_PEM: LazyLock<String> = LazyLock::new(|| {
+    let pubkey = get_server_key_dir()
+        .unwrap_or_else(|e| {
+            eprintln!(
+                "{}",
+                format!("Failed to get server key directory: {}", e)
+                    .red()
+                    .bold()
+            );
+            std::process::exit(1);
+        })
+        .join("public.pem");
+    std::fs::read_to_string(pubkey).unwrap_or_else(|e| {
+        eprintln!(
+            "{}",
+            format!("Failed to read server public key: {}", e)
+                .red()
+                .bold()
+        );
+        std::process::exit(1);
+    })
+});
+
+pub static SERVER_PRI_KEY_PEM: LazyLock<String> = LazyLock::new(|| {
+    let prikey = get_server_key_dir()
+        .unwrap_or_else(|e| {
+            eprintln!(
+                "{}",
+                format!("Failed to get server key directory: {}", e)
+                    .red()
+                    .bold()
+            );
+            std::process::exit(1);
+        })
+        .join("private.pem");
+    std::fs::read_to_string(prikey).unwrap_or_else(|e| {
+        eprintln!(
+            "{}",
+            format!("Failed to read server private key: {}", e)
+                .red()
+                .bold()
+        );
+        std::process::exit(1);
+    })
+});
+
 pub static MAX_CONNECTIONS: LazyLock<usize> = LazyLock::new(|| {
     std::env::var("MAX_CONNECTIONS")
         .ok()
@@ -243,7 +343,7 @@ pub static SHARED_FILE_LOCK: LazyLock<Arc<DashMap<String, Arc<RwLock<()>>>>> =
     LazyLock::new(|| Arc::new(DashMap::new()));
 
 #[inline(always)]
-pub fn get_file_lock(file_id: &str) -> Arc<RwLock<()>> {
+pub fn hold_file_lock(file_id: &str) -> Arc<RwLock<()>> {
     let map = &*SHARED_FILE_LOCK;
     map.entry(file_id.to_string())
         .or_insert_with(|| Arc::new(RwLock::new(())))