@yuuki824/kanshi 0.3.0

package/internal/roots/roots.go

@@ -0,0 +1,175 @@
+// Package roots decides which directories the storage map covers and reads
+// how full their volumes are.
+//
+// With no configuration it picks sensible roots for the platform: on Linux the
+// root filesystem plus every drive mounted under /mnt, on Windows the system
+// drive, the user's profile folder and every other fixed drive. Explicit
+// entries replace that, and the word "auto" mixes the defaults back in.
+package roots
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Root is one entry in the storage map. Label is the path as the user knows
+// it; Path is where Kanshi actually reads it, which differs only inside a
+// container, where the host's / is mounted at KANSHI_HOST_ROOT.
+type Root struct {
+	Label string `json:"label"`
+	Path  string `json:"path"`
+}
+
+// Sep is the separator labels are written with. The browser needs it to parse
+// a pasted path and to draw breadcrumbs.
+const Sep = string(filepath.Separator)
+
+// How long a resolved list is reused. Vitals asks every tick; re-reading the
+// mount table that often would be pointless work for something that changes
+// when a drive is plugged in.
+const cacheFor = 30 * time.Second
+
+// Resolver turns the configured entries into roots, and caches the answer.
+type Resolver struct {
+	spec     []string
+	hostRoot string
+
+	mu     sync.Mutex
+	cached []Root
+	at     time.Time
+}
+
+func NewResolver(spec []string, hostRoot string) *Resolver {
+	if hostRoot != "" && !isDir(hostRoot) {
+		// The image sets KANSHI_HOST_ROOT=/hostfs; run without that mount,
+		// the container's own filesystem is all there is to show.
+		hostRoot = ""
+	}
+	return &Resolver{spec: spec, hostRoot: hostRoot}
+}
+
+// Roots returns the cached list, refreshing it once it is stale.
+func (r *Resolver) Roots() []Root {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.cached == nil || time.Since(r.at) > cacheFor {
+		r.cached, r.at = r.resolve(), time.Now()
+	}
+	return r.cached
+}
+
+// Refresh re-resolves now. The storage walk calls this so a drive mounted a
+// moment ago is included.
+func (r *Resolver) Refresh() []Root {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.cached, r.at = r.resolve(), time.Now()
+	return r.cached
+}
+
+// HostRoot is the prefix host paths are read under, or "" on bare metal.
+func (r *Resolver) HostRoot() string { return r.hostRoot }
+
+func (r *Resolver) resolve() []Root {
+	out := []Root{}
+	seen := map[string]bool{}
+	add := func(root Root) {
+		key := Key(root.Path)
+		if !seen[key] {
+			seen[key] = true
+			out = append(out, root)
+		}
+	}
+	for _, entry := range r.spec {
+		if strings.EqualFold(entry, "auto") {
+			for _, root := range auto(r.hostRoot) {
+				add(root)
+			}
+			continue
+		}
+		add(r.explicit(entry))
+	}
+	return out
+}
+
+// explicit parses "label=path" or a bare path. A bare path is labelled with
+// itself, as seen from the host. Inside a container, a host path that does
+// not exist there is looked up under the host root instead — so an old
+// "/mnt/data" entry keeps working after its dedicated volume is gone.
+func (r *Resolver) explicit(entry string) Root {
+	label, p, found := strings.Cut(entry, "=")
+	if !found || p == "" {
+		p, label = label, ""
+	}
+	if r.hostRoot != "" && !within(r.hostRoot, p) && !isDir(p) && isDir(r.hostRoot+p) {
+		p = r.hostRoot + p
+	}
+	if label == "" {
+		label = r.HostPath(p)
+	}
+	return Root{Label: label, Path: p}
+}
+
+// HostPath strips the host-root prefix, turning "/hostfs/mnt/data" into
+// "/mnt/data".
+func (r *Resolver) HostPath(p string) string {
+	if r.hostRoot == "" || !within(r.hostRoot, p) {
+		return p
+	}
+	rest := p[len(r.hostRoot):]
+	if rest == "" {
+		return "/"
+	}
+	return rest
+}
+
+// ContainerPath is the reverse of HostPath: where a host path is readable.
+// Excludes are written as host paths, so they go through this.
+func (r *Resolver) ContainerPath(p string) string {
+	if r.hostRoot == "" || within(r.hostRoot, p) {
+		return p
+	}
+	return r.hostRoot + p
+}
+
+// within reports whether p is dir itself or somewhere below it.
+func within(dir, p string) bool {
+	d, q := Key(dir), Key(p)
+	if d == q {
+		return true
+	}
+	if !strings.HasSuffix(d, Sep) {
+		d += Sep
+	}
+	return strings.HasPrefix(q, d)
+}
+
+// Within reports whether child is parent itself or inside it, comparing the
+// way the platform's filesystem does.
+func Within(parent, child string) bool { return within(parent, child) }
+
+// Key normalises a path for comparison: cleaned, and on Windows lower-cased,
+// since NTFS treats C:\Users and c:\users as the same directory.
+func Key(p string) string {
+	p = filepath.Clean(p)
+	if caseInsensitive {
+		p = strings.ToLower(p)
+	}
+	return p
+}
+
+func isDir(p string) bool {
+	info, err := os.Stat(p)
+	return err == nil && info.IsDir()
+}
+
+// Usage is how full the volume holding a root is.
+type Usage struct {
+	Total, Used, Free uint64
+	// Volume identifies the filesystem, so two roots on the same one share a
+	// single meter rather than showing the same numbers twice.
+	Volume string
+}

package/internal/roots/roots_linux.go

@@ -0,0 +1,132 @@
+package roots
+
+import (
+	"bufio"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
+const caseInsensitive = false
+
+// auto is / plus every real filesystem mounted under /mnt.
+func auto(hostRoot string) []Root {
+	base := hostRoot
+	if base == "" {
+		base = "/"
+	}
+	out := []Root{{Label: "/", Path: base}}
+	for _, point := range mountsUnder(hostRoot+"/mnt", "/proc/self/mountinfo") {
+		label := strings.TrimPrefix(point, hostRoot)
+		out = append(out, Root{Label: label, Path: point})
+	}
+	return out
+}
+
+// Kernel and virtual filesystems that can be mounted under /mnt but hold no
+// data worth mapping.
+var pseudoFS = map[string]bool{
+	"autofs": true, "binfmt_misc": true, "bpf": true, "cgroup": true, "cgroup2": true,
+	"configfs": true, "debugfs": true, "devpts": true, "devtmpfs": true, "efivarfs": true,
+	"fusectl": true, "hugetlbfs": true, "mqueue": true, "nsfs": true, "overlay": true,
+	"proc": true, "pstore": true, "ramfs": true, "rpc_pipefs": true, "securityfs": true,
+	"squashfs": true, "sysfs": true, "tmpfs": true, "tracefs": true, "nfsd": true,
+	"fuse.gvfsd-fuse": true, "fuse.portal": true, "fuse.lxcfs": true, "fuse.snapfuse": true,
+}
+
+// mountsUnder lists mount points at or below dir from a mountinfo file,
+// sorted.
+// Inside a container the host's mounts appear under the host root because the
+// bind mount of / is recursive, so the same code finds them in both places.
+func mountsUnder(dir, mountinfo string) []string {
+	f, err := os.Open(mountinfo)
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+
+	type mount struct{ source, fstype string }
+	byPoint := map[string]mount{}
+	sc := bufio.NewScanner(f)
+	sc.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	for sc.Scan() {
+		// 36 35 98:0 /mnt1 /mnt/parent rw,noatime master:1 - ext3 /dev/root rw
+		pre, post, ok := strings.Cut(sc.Text(), " - ")
+		if !ok {
+			continue
+		}
+		fields := strings.Fields(pre)
+		tail := strings.Fields(post)
+		if len(fields) < 5 || len(tail) < 1 {
+			continue
+		}
+		point := unescape(fields[4])
+		if point != dir && !strings.HasPrefix(point, dir+"/") {
+			continue
+		}
+		// Later lines are mounted on top of earlier ones at the same point,
+		// so the last one is what a path lookup actually reaches.
+		byPoint[point] = mount{source: fields[2] + " " + unescape(fields[3]), fstype: tail[0]}
+	}
+
+	points := make([]string, 0, len(byPoint))
+	for p := range byPoint {
+		points = append(points, p)
+	}
+	sort.Strings(points)
+
+	// A bind mount of the same directory at two points would be walked, and
+	// counted, twice. Keep the first.
+	sources := map[string]bool{}
+	out := points[:0]
+	for _, p := range points {
+		m := byPoint[p]
+		if pseudoFS[m.fstype] || sources[m.source] {
+			continue
+		}
+		sources[m.source] = true
+		out = append(out, p)
+	}
+	return out
+}
+
+// unescape reverses mountinfo's octal escapes ("\040" is a space).
+func unescape(s string) string {
+	if !strings.Contains(s, `\`) {
+		return s
+	}
+	var b strings.Builder
+	for i := 0; i < len(s); i++ {
+		if s[i] == '\\' && i+4 <= len(s) {
+			if n, err := strconv.ParseUint(s[i+1:i+4], 8, 8); err == nil {
+				b.WriteByte(byte(n))
+				i += 3
+				continue
+			}
+		}
+		b.WriteByte(s[i])
+	}
+	return b.String()
+}
+
+// DiskUsage reads a volume's size off statfs.
+func DiskUsage(path string) (Usage, error) {
+	var st syscall.Statfs_t
+	if err := syscall.Statfs(path, &st); err != nil {
+		return Usage{}, err
+	}
+	bsize := uint64(st.Bsize)
+	total := st.Blocks * bsize
+	// Bavail excludes root-reserved blocks, so used+free won't equal total.
+	// "Used" is reported the way df does it.
+	u := Usage{Total: total, Used: total - st.Bfree*bsize, Free: st.Bavail * bsize}
+	var s syscall.Stat_t
+	if err := syscall.Stat(path, &s); err == nil {
+		u.Volume = strconv.FormatUint(uint64(s.Dev), 10)
+	} else {
+		u.Volume = path
+	}
+	return u, nil
+}

package/internal/roots/roots_windows.go

@@ -0,0 +1,74 @@
+package roots
+
+import (
+	"os"
+	"strings"
+	"syscall"
+	"unsafe"
+)
+
+const caseInsensitive = true
+
+var (
+	kernel32                = syscall.NewLazyDLL("kernel32.dll")
+	procGetLogicalDrives    = kernel32.NewProc("GetLogicalDrives")
+	procGetDriveTypeW       = kernel32.NewProc("GetDriveTypeW")
+	procGetDiskFreeSpaceExW = kernel32.NewProc("GetDiskFreeSpaceExW")
+	procGetVolumePathNameW  = kernel32.NewProc("GetVolumePathNameW")
+)
+
+const driveFixed = 3
+
+// auto is the system drive, the user's profile folder, then every other fixed
+// drive. The profile folder sits on the system drive; the walk notices that
+// and covers both in one pass.
+func auto(string) []Root {
+	system := strings.TrimRight(os.Getenv("SystemDrive"), `\`)
+	if system == "" {
+		system = "C:"
+	}
+	out := []Root{{Label: system + `\`, Path: system + `\`}}
+	if home, err := os.UserHomeDir(); err == nil && isDir(home) {
+		out = append(out, Root{Label: home, Path: home})
+	}
+
+	mask, _, _ := procGetLogicalDrives.Call()
+	for i := 0; i < 26; i++ {
+		if mask&(1<<i) == 0 {
+			continue
+		}
+		drive := string(rune('A'+i)) + `:\`
+		if strings.EqualFold(drive[:2], system) {
+			continue
+		}
+		// Fixed covers internal disks and most external USB drives. Network
+		// shares, optical drives and card readers are left out: walking
+		// those is slow, and they come and go.
+		p, _ := syscall.UTF16PtrFromString(drive)
+		if t, _, _ := procGetDriveTypeW.Call(uintptr(unsafe.Pointer(p))); t == driveFixed && isDir(drive) {
+			out = append(out, Root{Label: drive, Path: drive})
+		}
+	}
+	return out
+}
+
+// DiskUsage reads a volume's size with GetDiskFreeSpaceExW.
+func DiskUsage(path string) (Usage, error) {
+	p, err := syscall.UTF16PtrFromString(path)
+	if err != nil {
+		return Usage{}, err
+	}
+	var avail, total, free uint64
+	r, _, e := procGetDiskFreeSpaceExW.Call(uintptr(unsafe.Pointer(p)),
+		uintptr(unsafe.Pointer(&avail)), uintptr(unsafe.Pointer(&total)), uintptr(unsafe.Pointer(&free)))
+	if r == 0 {
+		return Usage{}, e
+	}
+	u := Usage{Total: total, Used: total - free, Free: avail, Volume: strings.ToLower(path)}
+	// The profile folder and C:\ are the same volume; GetVolumePathName says so.
+	buf := make([]uint16, 300)
+	if r, _, _ := procGetVolumePathNameW.Call(uintptr(unsafe.Pointer(p)), uintptr(unsafe.Pointer(&buf[0])), uintptr(len(buf))); r != 0 {
+		u.Volume = strings.ToLower(syscall.UTF16ToString(buf))
+	}
+	return u, nil
+}

package/internal/server/access.go

@@ -0,0 +1,155 @@
+package server
+
+import (
+	"encoding/json"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strings"
+
+	"github.com/rene-roid/kanshi/internal/access"
+	"github.com/rene-roid/kanshi/internal/config"
+)
+
+// accessState is what the dashboard's network panel shows.
+type accessState struct {
+	Mode     string        `json:"mode"`
+	Source   config.Source `json:"source"`
+	Editable bool          `json:"editable"`
+	// Reason says why Editable is false, in words the panel can show as is.
+	Reason string        `json:"reason,omitempty"`
+	Links  []access.Link `json:"links"`
+}
+
+func (s *Server) accessState(r *http.Request) accessState {
+	s.accessMu.Lock()
+	mgr, src := s.access, s.accessSource
+	s.accessMu.Unlock()
+
+	st := accessState{Source: src, Links: []access.Link{}}
+	if mgr == nil {
+		return st
+	}
+	st.Mode, st.Links = mgr.Mode().String(), mgr.Links()
+	switch {
+	case src == config.SourceFlag:
+		st.Reason = "Set with --access when kanshi was started."
+	case src == config.SourceEnv:
+		st.Reason = "Set by KANSHI_ACCESS in kanshi's environment."
+	case !s.canSave():
+		st.Reason = "Kanshi cannot save this setting here. Set KANSHI_ACCESS where it is started — for Docker, in the .env file."
+	case !fromLocalhost(r):
+		st.Reason = "Open the dashboard on this computer, at localhost, to change this."
+	default:
+		st.Editable = true
+	}
+	return st
+}
+
+// canSave is checked once, the first time the network panel asks.
+func (s *Server) canSave() bool {
+	s.saveOnce.Do(func() { s.saveOK = s.cfg.File != "" && config.Writable(s.cfg.File) })
+	return s.saveOK
+}
+
+func (s *Server) handleAccess(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, r, s.accessState(r))
+}
+
+// handleSetAccess changes who can reach the dashboard. Widening that is the
+// one thing here that matters for security, so it is only accepted from the
+// machine itself, from the dashboard's own page, and only when no flag or
+// environment variable would override it on the next start.
+func (s *Server) handleSetAccess(w http.ResponseWriter, r *http.Request) {
+	if !fromLocalhost(r) || !sameOrigin(r) {
+		http.Error(w, "the network setting can only be changed from this computer", http.StatusForbidden)
+		return
+	}
+	var body struct {
+		Mode string `json:"mode"`
+	}
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4096)).Decode(&body); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+	mode, err := access.Parse(body.Mode)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	s.accessMu.Lock()
+	mgr, src := s.access, s.accessSource
+	switch {
+	case mgr == nil:
+		s.accessMu.Unlock()
+		http.Error(w, "not listening yet", http.StatusServiceUnavailable)
+		return
+	case src == config.SourceFlag || src == config.SourceEnv || !s.canSave():
+		s.accessMu.Unlock()
+		http.Error(w, "the network setting is fixed by how kanshi was started", http.StatusConflict)
+		return
+	}
+	prev := mgr.Mode()
+	if err := mgr.Apply(mode); err != nil {
+		_ = mgr.Apply(prev)
+		s.accessMu.Unlock()
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	saveErr := config.SaveValue(s.cfg.File, "KANSHI_ACCESS", mode.String())
+	if saveErr == nil {
+		s.accessSource = config.SourceFile
+	}
+	s.accessMu.Unlock()
+
+	s.logf("access changed to %s from the dashboard", mode)
+	st := s.accessState(r)
+	if saveErr != nil {
+		s.logf("warning: could not save %s: %v", s.cfg.File, saveErr)
+		st.Reason = "Applied, but not saved: " + saveErr.Error()
+	}
+	writeJSON(w, r, st)
+}
+
+// fromLocalhost reports a request that arrived over loopback and was
+// addressed to a loopback name. The second half matters: a hostile page can
+// point its own domain at 127.0.0.1 (DNS rebinding), but then the Host header
+// still carries that domain.
+func fromLocalhost(r *http.Request) bool {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return false
+	}
+	if ip, err := netip.ParseAddr(host); err != nil || !ip.Unmap().IsLoopback() {
+		return false
+	}
+	name := r.Host
+	if h, _, err := net.SplitHostPort(name); err == nil {
+		name = h
+	}
+	name = strings.Trim(name, "[]")
+	if strings.EqualFold(name, "localhost") {
+		return true
+	}
+	ip, err := netip.ParseAddr(name)
+	return err == nil && ip.Unmap().IsLoopback()
+}
+
+// sameOrigin reports a request made by the dashboard's own script. The custom
+// header cannot be attached by a form or an <img> on another site, and a
+// cross-origin fetch that tries is stopped by the browser's preflight, which
+// this server never approves.
+func sameOrigin(r *http.Request) bool {
+	if r.Header.Get("X-Kanshi") != "1" {
+		return false
+	}
+	if origin := r.Header.Get("Origin"); origin != "" {
+		u, err := url.Parse(origin)
+		if err != nil || !strings.EqualFold(u.Host, r.Host) {
+			return false
+		}
+	}
+	return true
+}