1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
|
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2016, 2017 Ludovic Courtès <ludo@gnu.org>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
(define-module (guix ssh)
#:use-module (guix store)
#:use-module ((guix ui) #:select (_ N_))
#:use-module (ssh session)
#:use-module (ssh auth)
#:use-module (ssh key)
#:use-module (ssh channel)
#:use-module (ssh popen)
#:use-module (ssh session)
#:use-module (ssh dist)
#:use-module (ssh dist node)
#:use-module (srfi srfi-11)
#:use-module (srfi srfi-34)
#:use-module (srfi srfi-35)
#:use-module (ice-9 match)
#:use-module (ice-9 binary-ports)
#:export (open-ssh-session
remote-daemon-channel
connect-to-remote-daemon
send-files
retrieve-files
remote-store-host
file-retrieval-port))
;;; Commentary:
;;;
;;; This module provides tools to support communication with remote stores
;;; over SSH, using Guile-SSH.
;;;
;;; Code:
(define %compression
"zlib@openssh.com,zlib")
(define* (open-ssh-session host #:key user port
(compression %compression))
"Open an SSH session for HOST and return it. When USER and PORT are #f, use
default values or whatever '~/.ssh/config' specifies; otherwise use them.
Throw an error on failure."
(let ((session (make-session #:user user
#:host host
#:port port
#:timeout 10 ;seconds
;; #:log-verbosity 'protocol
;; We need lightweight compression when
;; exchanging full archives.
#:compression compression
#:compression-level 3)))
;; Honor ~/.ssh/config.
(session-parse-config! session)
(match (connect! session)
('ok
;; Use public key authentication, via the SSH agent if it's available.
(match (userauth-public-key/auto! session)
('success
session)
(x
(disconnect! session)
(raise (condition
(&message
(message (format #f (_ "SSH authentication failed for '~a': ~a~%")
host (get-error session)))))))))
(x
;; Connection failed or timeout expired.
(raise (condition
(&message
(message (format #f (_ "SSH connection to '~a' failed: ~a~%")
host (get-error session))))))))))
(define* (remote-daemon-channel session
#:optional
(socket-name
"/var/guix/daemon-socket/socket"))
"Return an input/output port (an SSH channel) to the daemon at SESSION."
(define redirect
;; Code run in SESSION to redirect the remote process' stdin/stdout to the
;; daemon's socket, à la socat. The SSH protocol supports forwarding to
;; Unix-domain sockets but libssh doesn't have an API for that, hence this
;; hack.
`(begin
(use-modules (ice-9 match) (rnrs io ports))
(let ((sock (socket AF_UNIX SOCK_STREAM 0))
(stdin (current-input-port))
(stdout (current-output-port)))
(setvbuf stdin _IONBF)
(setvbuf stdout _IONBF)
(connect sock AF_UNIX ,socket-name)
(let loop ()
(match (select (list stdin sock) '() (list stdin stdout sock))
((reads writes ())
(when (memq stdin reads)
(match (get-bytevector-some stdin)
((? eof-object?)
(primitive-exit 0))
(bv
(put-bytevector sock bv))))
(when (memq sock reads)
(match (get-bytevector-some sock)
((? eof-object?)
(primitive-exit 0))
(bv
(put-bytevector stdout bv))))
(loop))
(_
(primitive-exit 1)))))))
(open-remote-pipe* session OPEN_BOTH
;; Sort-of shell-quote REDIRECT.
"guile" "-c"
(object->string
(object->string redirect))))
(define* (connect-to-remote-daemon session
#:optional
(socket-name
"/var/guix/daemon-socket/socket"))
"Connect to the remote build daemon listening on SOCKET-NAME over SESSION,
an SSH session. Return a <nix-server> object."
(open-connection #:port (remote-daemon-channel session)))
(define (store-import-channel session)
"Return an output port to which archives to be exported to SESSION's store
can be written."
;; Using the 'import-paths' RPC on a remote store would be slow because it
;; makes a round trip every time 32 KiB have been transferred. This
;; procedure instead opens a separate channel to use the remote
;; 'import-paths' procedure, which consumes all the data in a single round
;; trip.
(define import
`(begin
(use-modules (guix))
(with-store store
(setvbuf (current-input-port) _IONBF)
;; FIXME: Exceptions are silently swallowed. We should report them
;; somehow.
(import-paths store (current-input-port)))))
(open-remote-output-pipe session
(string-join
`("guile" "-c"
,(object->string
(object->string import))))))
(define* (store-export-channel session files
#:key recursive?)
"Return an input port from which an export of FILES from SESSION's store can
be read. When RECURSIVE? is true, the closure of FILES is exported."
;; Same as above: this is more efficient than calling 'export-paths' on a
;; remote store.
(define export
`(begin
(use-modules (guix))
(with-store store
(setvbuf (current-output-port) _IONBF)
;; FIXME: Exceptions are silently swallowed. We should report them
;; somehow.
(export-paths store ',files (current-output-port)
#:recursive? ,recursive?))))
(open-remote-input-pipe session
(string-join
`("guile" "-c"
,(object->string
(object->string export))))))
(define* (send-files local files remote
#:key
recursive?
(log-port (current-error-port)))
"Send the subset of FILES from LOCAL (a local store) that's missing to
REMOTE, a remote store. When RECURSIVE? is true, send the closure of FILES.
Return the list of store items actually sent."
;; Compute the subset of FILES missing on SESSION and send them.
(let* ((files (if recursive? (requisites local files) files))
(session (channel-get-session (nix-server-socket remote)))
(node (make-node session))
(missing (node-eval node
`(begin
(use-modules (guix)
(srfi srfi-1) (srfi srfi-26))
(with-store store
(remove (cut valid-path? store <>)
',files)))))
(count (length missing))
(port (store-import-channel session)))
(format log-port (N_ "sending ~a store item to '~a'...~%"
"sending ~a store items to '~a'...~%" count)
count (session-get session 'host))
;; Send MISSING in topological order.
(export-paths local missing port)
;; Tell the remote process that we're done. (In theory the end-of-archive
;; mark of 'export-paths' would be enough, but in practice it's not.)
(channel-send-eof port)
;; Wait for completion of the remote process.
(let ((result (zero? (channel-get-exit-status port))))
(close-port port)
missing)))
(define (remote-store-session remote)
"Return the SSH channel beneath REMOTE, a remote store as returned by
'connect-to-remote-daemon', or #f."
(channel-get-session (nix-server-socket remote)))
(define (remote-store-host remote)
"Return the name of the host REMOTE is connected to, where REMOTE is a
remote store as returned by 'connect-to-remote-daemon'."
(match (remote-store-session remote)
(#f #f)
((? session? session)
(session-get session 'host))))
(define* (file-retrieval-port files remote
#:key recursive?)
"Return an input port from which to retrieve FILES (a list of store items)
from REMOTE, along with the number of items to retrieve (lower than or equal
to the length of FILES.)"
(values (store-export-channel (remote-store-session remote) files
#:recursive? recursive?)
(length files))) ;XXX: inaccurate when RECURSIVE? is true
(define* (retrieve-files local files remote
#:key recursive? (log-port (current-error-port)))
"Retrieve FILES from REMOTE and import them using the 'import-paths' RPC on
LOCAL. When RECURSIVE? is true, retrieve the closure of FILES."
(let-values (((port count)
(file-retrieval-port files remote
#:recursive? recursive?)))
(format #t (N_ "retrieving ~a store item from '~a'...~%"
"retrieving ~a store items from '~a'...~%" count)
count (remote-store-host remote))
(when (eof-object? (lookahead-u8 port))
;; The failure could be because one of the requested store items is not
;; valid on REMOTE, or because Guile or Guix is improperly installed.
;; TODO: Improve error reporting.
(raise (condition
(&message
(message
(format #f
(_ "failed to retrieve store items from '~a'")
(remote-store-host remote)))))))
(let ((result (import-paths local port)))
(close-port port)
result)))
;;; ssh.scm ends here
|