egress.rs 0.0%

0 of 56 lines run, 0 of 8 functions · run #197 on main · run missed

//! The guest's half of allow-listed egress (oxygenflow#55): a proxy on
//! 127.0.0.1:3128 that relays each connection, unread, over vsock to the
//! runner (host CID 2), which decides what may pass. The VM has no network
//! device; this is its only way out.

use std::fs::File;
use std::io::{Read, Write};
use std::net::{TcpListener, TcpStream};
use std::os::fd::{AsRawFd, FromRawFd};

/// Where the job's tools reach the proxy, and the vsock port behind it.
const LISTEN: &str = "127.0.0.1:3128";
const VSOCK_PORT: u32 = 3128;

/// Start relaying in the background (before the job starts, so its first
/// connection finds the proxy listening).
pub fn start() -> Result<(), String> {
    let listener = TcpListener::bind(LISTEN).map_err(|e| format!("egress proxy on {LISTEN}: {e}"))?;
    std::thread::spawn(move || {
        for conn in listener.incoming().flatten() {
            std::thread::spawn(move || relay(conn));
        }
    });
    Ok(())
}

fn vsock_to_host(port: u32) -> std::io::Result<File> {
    let fd = unsafe { libc::socket(libc::AF_VSOCK, libc::SOCK_STREAM | libc::SOCK_CLOEXEC, 0) };
    if fd < 0 {
        return Err(std::io::Error::last_os_error());
    }
    // Owned from here, so it is closed on every path.
    let file = unsafe { File::from_raw_fd(fd) };
    let mut addr: libc::sockaddr_vm = unsafe { std::mem::zeroed() };
    addr.svm_family = libc::AF_VSOCK as libc::sa_family_t;
    addr.svm_cid = libc::VMADDR_CID_HOST;
    addr.svm_port = port;
    let rc = unsafe {
        libc::connect(
            fd,
            &addr as *const libc::sockaddr_vm as *const libc::sockaddr,
            std::mem::size_of::<libc::sockaddr_vm>() as libc::socklen_t,
        )
    };
    if rc != 0 {
        return Err(std::io::Error::last_os_error());
    }
    Ok(file)
}

fn relay(tcp: TcpStream) {
    let Ok(host) = vsock_to_host(VSOCK_PORT) else {
        let mut tcp = tcp;
        let _ = tcp.write_all(b"HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\nthe runner's egress proxy did not answer\n");
        return;
    };
    let (Ok(mut tcp_r), Ok(mut host_w)) = (tcp.try_clone(), host.try_clone()) else { return };
    let up = std::thread::spawn(move || {
        copy(&mut tcp_r, &mut host_w);
        unsafe { libc::shutdown(host_w.as_raw_fd(), libc::SHUT_WR) };
    });
    let (mut host_r, mut tcp_w) = (host, tcp);
    copy(&mut host_r, &mut tcp_w);
    let _ = tcp_w.shutdown(std::net::Shutdown::Write);
    let _ = up.join();
}

fn copy(from: &mut impl Read, to: &mut impl Write) {
    let mut buf = [0u8; 16 * 1024];
    loop {
        match from.read(&mut buf) {
            Ok(0) | Err(_) => return,
            Ok(n) => {
                if to.write_all(&buf[..n]).is_err() {
                    return;
                }
            }
        }
    }
}

1		//! The guest's half of allow-listed egress (oxygenflow#55): a proxy on
2		//! 127.0.0.1:3128 that relays each connection, unread, over vsock to the
3		//! runner (host CID 2), which decides what may pass. The VM has no network
4		//! device; this is its only way out.
5
6		use std::fs::File;
7		use std::io::{Read, Write};
8		use std::net::{TcpListener, TcpStream};
9		use std::os::fd::{AsRawFd, FromRawFd};
10
11		/// Where the job's tools reach the proxy, and the vsock port behind it.
12		const LISTEN: &str = "127.0.0.1:3128";
13		const VSOCK_PORT: u32 = 3128;
14
15		/// Start relaying in the background (before the job starts, so its first
16		/// connection finds the proxy listening).
17	0×	pub fn start() -> Result<(), String> {
18	0×	let listener = TcpListener::bind(LISTEN).map_err(\|e\| format!("egress proxy on {LISTEN}: {e}"))?;
19	0×	std::thread::spawn(move \|\| {
20	0×	for conn in listener.incoming().flatten() {
21	0×	std::thread::spawn(move \|\| relay(conn));
22		}
23	0×	});
24	0×	Ok(())
25	0×	}
26
27	0×	fn vsock_to_host(port: u32) -> std::io::Result<File> {
28	0×	let fd = unsafe { libc::socket(libc::AF_VSOCK, libc::SOCK_STREAM \| libc::SOCK_CLOEXEC, 0) };
29	0×	if fd < 0 {
30	0×	return Err(std::io::Error::last_os_error());
31	0×	}
32		// Owned from here, so it is closed on every path.
33	0×	let file = unsafe { File::from_raw_fd(fd) };
34	0×	let mut addr: libc::sockaddr_vm = unsafe { std::mem::zeroed() };
35	0×	addr.svm_family = libc::AF_VSOCK as libc::sa_family_t;
36	0×	addr.svm_cid = libc::VMADDR_CID_HOST;
37	0×	addr.svm_port = port;
38	0×	let rc = unsafe {
39	0×	libc::connect(
40	0×	fd,
41	0×	&addr as const libc::sockaddr_vm as const libc::sockaddr,
42	0×	std::mem::size_of::<libc::sockaddr_vm>() as libc::socklen_t,
43		)
44		};
45	0×	if rc != 0 {
46	0×	return Err(std::io::Error::last_os_error());
47	0×	}
48	0×	Ok(file)
49	0×	}
50
51	0×	fn relay(tcp: TcpStream) {
52	0×	let Ok(host) = vsock_to_host(VSOCK_PORT) else {
53	0×	let mut tcp = tcp;
54	0×	let _ = tcp.write_all(b"HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\nthe runner's egress proxy did not answer\n");
55	0×	return;
56		};
57	0×	let (Ok(mut tcp_r), Ok(mut host_w)) = (tcp.try_clone(), host.try_clone()) else { return };
58	0×	let up = std::thread::spawn(move \|\| {
59	0×	copy(&mut tcp_r, &mut host_w);
60	0×	unsafe { libc::shutdown(host_w.as_raw_fd(), libc::SHUT_WR) };
61	0×	});
62	0×	let (mut host_r, mut tcp_w) = (host, tcp);
63	0×	copy(&mut host_r, &mut tcp_w);
64	0×	let _ = tcp_w.shutdown(std::net::Shutdown::Write);
65	0×	let _ = up.join();
66	0×	}
67
68	0×	fn copy(from: &mut impl Read, to: &mut impl Write) {
69	0×	let mut buf = [0u8; 16 * 1024];
70		loop {
71	0×	match from.read(&mut buf) {
72	0×	Ok(0) \| Err(_) => return,
73	0×	Ok(n) => {
74	0×	if to.write_all(&buf[..n]).is_err() {
75	0×	return;
76	0×	}
77		}
78		}
79		}
80	0×	}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/flow-init/src/egress.rs 0.0%

Keyboard