From ae1bbfeccc01543c5c0b38f29a957bd0c5015797 Mon Sep 17 00:00:00 2001 From: Nicholas Ludwig Date: Tue, 23 Jul 2024 11:46:08 -0700 Subject: [PATCH 1/4] Added sidecar --- cmd/sidecar-gcs/main.go | 186 ++++++++++++++++++++++++++++++++++++ internal/gcs/protocol.go | 17 ++++ internal/uvm/create.go | 6 ++ internal/uvm/create_wcow.go | 18 ++++ internal/uvm/start.go | 41 +++++++- internal/uvm/types.go | 2 + 6 files changed, 269 insertions(+), 1 deletion(-) create mode 100644 cmd/sidecar-gcs/main.go diff --git a/cmd/sidecar-gcs/main.go b/cmd/sidecar-gcs/main.go new file mode 100644 index 0000000000..ffbe188a1a --- /dev/null +++ b/cmd/sidecar-gcs/main.go @@ -0,0 +1,186 @@ +//go:build windows + +package main + +import ( + "context" + "fmt" + "net" + "os" + "time" + + "github.com/Microsoft/go-winio" + "github.com/Microsoft/go-winio/pkg/guid" + + "github.com/Microsoft/hcsshim/internal/gcs" +) + +func acceptAndClose(l net.Listener) (conn net.Conn, err error) { + conn, err = l.Accept() + l.Close() + + return conn, err +} + +func main() { + ctx := context.Background() + file, err := os.OpenFile("hello.log", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666) + if err != nil { + fmt.Printf("Error opening file: %v", err) + return + } + defer file.Close() + + d := &winio.HvsockDialer{ + Deadline: time.Now().Add(10 * time.Minute), + Retries: 1000, + RetryWait: time.Second, + } + + //DEFINE_GUID(HV_GUID_PARENT, 0xa42e7cda, 0xd03f, 0x480c, 0x9c, 0xc2, 0xa4, 0xde, 0x20, 0xab, 0xb8, 0x78); + addr := &winio.HvsockAddr{ + VMID: guid.GUID{ + Data1: 0xa42e7cda, + Data2: 0xd03f, + Data3: 0x480c, + Data4: [8]uint8{0x9c, 0xc2, 0xa4, 0xde, 0x20, 0xab, 0xb8, 0x78}, + }, + ServiceID: gcs.SidecarGcsHvsockServiceID, + } + + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - started dialing\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + + // Dial the HV socket for the sidecar gcs + conn, err := d.Dial(ctx, addr) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error dialing address: " + err.Error() + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + go func() { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Connection established\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + for { + _, err := conn.Write([]byte(time.Now().Format("2006-01-02 15:04:05") + " - Hello, world!\n")) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error writing to connection: " + err.Error() + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + time.Sleep(5 * time.Second) + } + }() + + // _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Started listening for the GCS\n") + // if err != nil { + // fmt.Printf("Error writing to file: %v", err) + // return + // } + + // start GCS listener + // 0xe0e16197, 0xdd56, 0x4a10, 0x91, 0x95, 0x5e, 0xe7, 0xa1, 0x55, 0xa8, 0x38 + l, err := winio.ListenHvsock(&winio.HvsockAddr{ + VMID: guid.GUID{ + Data1: 0xe0e16197, + Data2: 0xdd56, + Data3: 0x4a10, + Data4: [8]uint8{0x91, 0x95, 0x5e, 0xe7, 0xa1, 0x55, 0xa8, 0x38}, + }, + ServiceID: gcs.SidecarGuestHvsockServiceID, + }) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error opening gcs listener: " + err.Error() + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + if l != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - GCS listener opened\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + + // Accept the connection + gcsConn, err := acceptAndClose(l) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error with accept: " + err.Error() + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - GCS connection established\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + + l = nil + + go func() { + logfile, err := os.OpenFile("gcsLog.txt", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - error reading \n") + if err != nil { + return + } + return + } + defer logfile.Close() + + gcsbuffer := make([]byte, 1024) + for { + _, err := gcsConn.Read(gcsbuffer) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - error reading from client\n") + if err != nil { + return + } + return + } + time.Sleep(5 * time.Second) + + if _, err := logfile.Write(gcsbuffer); err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - error writing to logfile\n") + if err != nil { + return + } + return + } + } + }() + + for { + fmt.Println("Running sidecar") + } + } +} + +/* +Next steps: +1) run sidecar as a service, inbox component cannot start outbox componenet +2) Sidecar will be a container layer in the image +*/ + +//sidecar is client for shim, gcs is client for sidecar diff --git a/internal/gcs/protocol.go b/internal/gcs/protocol.go index 94e55e4c1e..33d3efd359 100644 --- a/internal/gcs/protocol.go +++ b/internal/gcs/protocol.go @@ -25,6 +25,23 @@ var WindowsGcsHvsockServiceID = guid.GUID{ Data4: [8]uint8{0x85, 0x6b, 0x62, 0x45, 0xe6, 0x9f, 0x46, 0x20}, } +// SidecarGcsHvsockServiceID is the hvsock service ID that the sidecar GCS +// will connect to. +var SidecarGcsHvsockServiceID = guid.GUID{ + Data1: 0x4de21eee, + Data2: 0x4cd0, + Data3: 0x4aac, + Data4: [8]uint8{0x92, 0xa8, 0x6c, 0x2b, 0x7e, 0x54, 0xb5, 0x85}, +} + +// 8225629d-6bfa-4b6e-a75d-7c2a1d489ffb +var SidecarGuestHvsockServiceID = guid.GUID{ + Data1: 0x8225629d, + Data2: 0x6bfa, + Data3: 0x4b6e, + Data4: [8]uint8{0xa7, 0x5d, 0x7c, 0x2a, 0x1d, 0x48, 0x9f, 0xfb}, +} + // WindowsGcsHvHostID is the hvsock address for the parent of the VM running the GCS var WindowsGcsHvHostID = guid.GUID{ Data1: 0x894cc2d6, diff --git a/internal/uvm/create.go b/internal/uvm/create.go index fa28857617..53867201a3 100644 --- a/internal/uvm/create.go +++ b/internal/uvm/create.go @@ -398,8 +398,14 @@ func (uvm *UtilityVM) CloseGCSConnection() (err error) { if uvm.gc != nil { err = uvm.gc.Close() } + if uvm.sc != nil { + err = uvm.sc.Close() + } if uvm.gcListener != nil { err = uvm.gcListener.Close() } + if uvm.scListener != nil { + err = uvm.scListener.Close() + } return err } diff --git a/internal/uvm/create_wcow.go b/internal/uvm/create_wcow.go index f413720b5c..efe0806e82 100644 --- a/internal/uvm/create_wcow.go +++ b/internal/uvm/create_wcow.go @@ -72,6 +72,20 @@ func (uvm *UtilityVM) startExternalGcsListener(ctx context.Context) error { return nil } +func (uvm *UtilityVM) startSidecarGcsListener(ctx context.Context) error { + log.G(ctx).WithField("vmID", uvm.runtimeID).Info("Using sidecar GCS bridge") + + l, err := winio.ListenHvsock(&winio.HvsockAddr{ + VMID: uvm.runtimeID, + ServiceID: gcs.SidecarGcsHvsockServiceID, + }) + if err != nil { + return err + } + uvm.scListener = l + return nil +} + func prepareConfigDoc(ctx context.Context, uvm *UtilityVM, opts *OptionsWCOW) (*hcsschema.ComputeSystem, error) { processorTopology, err := processorinfo.HostProcessorInfo(ctx) if err != nil { @@ -315,6 +329,10 @@ func CreateWCOW(ctx context.Context, opts *OptionsWCOW) (_ *UtilityVM, err error return nil, err } + if err = uvm.startSidecarGcsListener(ctx); err != nil { + return nil, err + } + uvm.ncProxyClientAddress = opts.NetworkConfigProxy return uvm, nil diff --git a/internal/uvm/start.go b/internal/uvm/start.go index e01ef515d5..c4b65a7134 100644 --- a/internal/uvm/start.go +++ b/internal/uvm/start.go @@ -11,6 +11,7 @@ import ( "fmt" "io" "net" + "os" "time" "github.com/sirupsen/logrus" @@ -156,7 +157,7 @@ func (uvm *UtilityVM) configureHvSocketForGCS(ctx context.Context) (err error) { func (uvm *UtilityVM) Start(ctx context.Context) (err error) { // save parent context, without timeout to use in terminate pCtx := ctx - ctx, cancel := context.WithTimeout(pCtx, 2*time.Minute) + ctx, cancel := context.WithTimeout(pCtx, 3*time.Minute) g, gctx := errgroup.WithContext(ctx) defer func() { _ = g.Wait() @@ -299,6 +300,43 @@ func (uvm *UtilityVM) Start(ctx context.Context) (err error) { uvm.protocol = properties.GuestConnectionInfo.ProtocolVersion } + if uvm.scListener != nil { + // Accept the sidecar GCS connection. + log.G(ctx).WithField("scListener", uvm.scListener).Info("Waiting for sidecar GCS connection") + conn, err := uvm.acceptAndClose(ctx, uvm.scListener) + uvm.scListener = nil + if err != nil { + log.G(ctx).WithField("err", err.Error()).Info("Failed to connect to sidecar GCS") + return fmt.Errorf("failed to connect to sidecar GCS: %w", err) + } + + log.G(ctx).WithField("scListener", uvm.scListener).Info("Successful sidecar GCS connection") + + //Read from the sidecar GCS connection + go func() { + file, err := os.OpenFile("C:\\ContainerPlat\\conn_log.txt", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666) + if err != nil { + log.G(ctx).WithField("err", err.Error()).Info("Error opening file") + } + defer file.Close() + + buffer := make([]byte, 1024) + for { + _, err := conn.Read(buffer) + if err != nil { + log.G(ctx).WithField("err", err.Error()).Info("Failed to read from sidecar GCS connection") + return + } + time.Sleep(5 * time.Second) + + if _, err := file.Write(buffer); err != nil { + log.G(ctx).WithField("err", err.Error()).Info("Failed to write to log file") + return + } + } + }() + } + // Initialize the SCSIManager. var gb scsi.GuestBackend if uvm.gc != nil { @@ -306,6 +344,7 @@ func (uvm *UtilityVM) Start(ctx context.Context) (err error) { } else { gb = scsi.NewHCSGuestBackend(uvm.hcsSystem, uvm.OS()) } + guestMountFmt := `c:\mounts\scsi\m%d` if uvm.OS() == "linux" { guestMountFmt = "/run/mounts/scsi/m%d" diff --git a/internal/uvm/types.go b/internal/uvm/types.go index 6d736f837e..8974bc3fd1 100644 --- a/internal/uvm/types.go +++ b/internal/uvm/types.go @@ -41,6 +41,8 @@ type UtilityVM struct { hcsSystem *hcs.System // The handle to the compute system gcListener net.Listener // The GCS connection listener gc *gcs.GuestConnection // The GCS connection + scListener net.Listener // The sidecar GCS connection listener + sc *gcs.GuestConnection // The sidecar GCS connection processorCount int32 physicallyBacked bool // If the uvm is backed by physical memory and not virtual memory m sync.Mutex // Lock for adding/removing devices From 85a4a1cff984f5b7061cfc947bacb29975de37e6 Mon Sep 17 00:00:00 2001 From: nmlud21 Date: Mon, 29 Jul 2024 12:03:30 -0700 Subject: [PATCH 2/4] Send struct data via HVSock connection --- cmd/sidecar-gcs/main.go | 53 +++++++++++++++++++++++++---------------- internal/uvm/start.go | 45 ++++++++++++++++++++++++++-------- 2 files changed, 67 insertions(+), 31 deletions(-) diff --git a/cmd/sidecar-gcs/main.go b/cmd/sidecar-gcs/main.go index ffbe188a1a..a712f91f45 100644 --- a/cmd/sidecar-gcs/main.go +++ b/cmd/sidecar-gcs/main.go @@ -4,14 +4,16 @@ package main import ( "context" + "encoding/gob" "fmt" "net" "os" "time" + specs "github.com/opencontainers/runtime-spec/specs-go" + "github.com/Microsoft/go-winio" "github.com/Microsoft/go-winio/pkg/guid" - "github.com/Microsoft/hcsshim/internal/gcs" ) @@ -24,7 +26,7 @@ func acceptAndClose(l net.Listener) (conn net.Conn, err error) { func main() { ctx := context.Background() - file, err := os.OpenFile("hello.log", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666) + file, err := os.OpenFile("sidecar.log", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666) if err != nil { fmt.Printf("Error opening file: %v", err) return @@ -71,26 +73,41 @@ func main() { fmt.Printf("Error writing to file: %v", err) return } - for { - _, err := conn.Write([]byte(time.Now().Format("2006-01-02 15:04:05") + " - Hello, world!\n")) + // for { + // _, err := conn.Write([]byte(time.Now().Format("2006-01-02 15:04:05") + " - Message from sidecar\n")) + // if err != nil { + // _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error writing to connection: " + err.Error() + "\n") + // if err != nil { + // fmt.Printf("Error writing to file: %v", err) + // return + // } + // return + // } + + // time.Sleep(5 * time.Second) + // } + + var policy specs.Mount + dec := gob.NewDecoder(conn) + err := dec.Decode(&policy) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error decoding mount policy\n") if err != nil { - _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error writing to connection: " + err.Error() + "\n") - if err != nil { - fmt.Printf("Error writing to file: %v", err) - return - } + fmt.Printf("Error writing to file: %v", err) return } + return + } - time.Sleep(5 * time.Second) + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - " + policy.Destination + ", " + policy.Type + ", " + policy.Source + " read successfully\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return } }() - // _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Started listening for the GCS\n") - // if err != nil { - // fmt.Printf("Error writing to file: %v", err) - // return - // } + // GCS connection + /////////////////////////////////////////////// // start GCS listener // 0xe0e16197, 0xdd56, 0x4a10, 0x91, 0x95, 0x5e, 0xe7, 0xa1, 0x55, 0xa8, 0x38 @@ -177,10 +194,4 @@ func main() { } } -/* -Next steps: -1) run sidecar as a service, inbox component cannot start outbox componenet -2) Sidecar will be a container layer in the image -*/ - //sidecar is client for shim, gcs is client for sidecar diff --git a/internal/uvm/start.go b/internal/uvm/start.go index c4b65a7134..e16ec6bdd1 100644 --- a/internal/uvm/start.go +++ b/internal/uvm/start.go @@ -6,6 +6,7 @@ import ( "bytes" "context" "crypto/rand" + "encoding/gob" "encoding/json" "errors" "fmt" @@ -14,6 +15,7 @@ import ( "os" "time" + specs "github.com/opencontainers/runtime-spec/specs-go" "github.com/sirupsen/logrus" "golang.org/x/sync/errgroup" "golang.org/x/sys/windows" @@ -312,27 +314,50 @@ func (uvm *UtilityVM) Start(ctx context.Context) (err error) { log.G(ctx).WithField("scListener", uvm.scListener).Info("Successful sidecar GCS connection") + policy := specs.Mount{ + Destination: "/dest/mount/path", + Type: "bind", + Source: "/src/mount/path", + } + //Read from the sidecar GCS connection go func() { - file, err := os.OpenFile("C:\\ContainerPlat\\conn_log.txt", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666) + file, err := os.OpenFile("C:\\ContainerPlat\\conn_log.txt", os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0666) if err != nil { log.G(ctx).WithField("err", err.Error()).Info("Error opening file") } defer file.Close() - buffer := make([]byte, 1024) - for { - _, err := conn.Read(buffer) + // buffer := make([]byte, 1024) + // for { + // _, err := conn.Read(buffer) + // if err != nil { + // log.G(ctx).WithField("err", err.Error()).Info("Failed to read from sidecar GCS connection") + // return + // } + // time.Sleep(5 * time.Second) + + // if _, err := file.Write(buffer); err != nil { + // log.G(ctx).WithField("err", err.Error()).Info("Failed to write to log file") + // return + // } + // } + + enc := gob.NewEncoder(conn) + err = enc.Encode(policy) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") if err != nil { - log.G(ctx).WithField("err", err.Error()).Info("Failed to read from sidecar GCS connection") + fmt.Printf("Error writing to file: %v", err) return } - time.Sleep(5 * time.Second) + return + } - if _, err := file.Write(buffer); err != nil { - log.G(ctx).WithField("err", err.Error()).Info("Failed to write to log file") - return - } + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Mount policy encoded successfully\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return } }() } From 9d43aa9b02b5b59529c9d04b4bec803c1d58fe17 Mon Sep 17 00:00:00 2001 From: nmlud21 Date: Mon, 29 Jul 2024 15:56:38 -0700 Subject: [PATCH 3/4] Added basic hard code mount policy enforcement --- cmd/sidecar-gcs/main.go | 96 +++++++++++++++++++++++++++++++++++++++-- internal/uvm/start.go | 40 +++++++++++++++-- 2 files changed, 128 insertions(+), 8 deletions(-) diff --git a/cmd/sidecar-gcs/main.go b/cmd/sidecar-gcs/main.go index a712f91f45..590f8957b6 100644 --- a/cmd/sidecar-gcs/main.go +++ b/cmd/sidecar-gcs/main.go @@ -8,6 +8,7 @@ import ( "fmt" "net" "os" + "strconv" "time" specs "github.com/opencontainers/runtime-spec/specs-go" @@ -24,6 +25,33 @@ func acceptAndClose(l net.Listener) (conn net.Conn, err error) { return conn, err } +func validatePolicy(mountPolicy specs.Mount, checkPolicy specs.Mount, file os.File) bool { + if mountPolicy.Destination != checkPolicy.Destination { + _, err := file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Mount policy denied: expected: " + mountPolicy.Destination + ", got: " + checkPolicy.Destination + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return false + } + return false + } else if mountPolicy.Type != checkPolicy.Type { + _, err := file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Mount policy denied: expected: " + mountPolicy.Type + ", got: " + checkPolicy.Type + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return false + } + return false + } else if mountPolicy.Source != checkPolicy.Source { + _, err := file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Mount policy denied: expected: " + mountPolicy.Source + ", got: " + checkPolicy.Source + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return false + } + return false + } + + return true +} + func main() { ctx := context.Background() file, err := os.OpenFile("sidecar.log", os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666) @@ -68,7 +96,7 @@ func main() { } go func() { - _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Connection established\n") + _, err := file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Connection established\n") if err != nil { fmt.Printf("Error writing to file: %v", err) return @@ -87,9 +115,37 @@ func main() { // time.Sleep(5 * time.Second) // } - var policy specs.Mount + mountPolicy := specs.Mount{ + Destination: "C:\\dest\\mount\\path", + Type: "physical-disk", + Source: "C:\\src\\mount\\path", + } + + var denyPolicy1 specs.Mount + var denyPolicy2 specs.Mount + var acceptPolicy specs.Mount dec := gob.NewDecoder(conn) - err := dec.Decode(&policy) + err = dec.Decode(&denyPolicy1) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error decoding mount policy\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + err = dec.Decode(&denyPolicy2) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error decoding mount policy\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + err = dec.Decode(&acceptPolicy) if err != nil { _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error decoding mount policy\n") if err != nil { @@ -99,13 +155,45 @@ func main() { return } - _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - " + policy.Destination + ", " + policy.Type + ", " + policy.Source + " read successfully\n") + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Deny Policy - " + denyPolicy1.Destination + ", " + denyPolicy1.Type + ", " + denyPolicy1.Source + " read successfully\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Accept Policy - " + acceptPolicy.Destination + ", " + acceptPolicy.Type + ", " + acceptPolicy.Source + " read successfully\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + + //Check against the mount policy + deny1IsValid := validatePolicy(mountPolicy, denyPolicy1, *file) + deny1IsValidStr := strconv.FormatBool(deny1IsValid) + deny2IsValid := validatePolicy(mountPolicy, denyPolicy2, *file) + deny2IsValidStr := strconv.FormatBool(deny2IsValid) + acceptIsValid := validatePolicy(mountPolicy, acceptPolicy, *file) + acceptIsValidStr := strconv.FormatBool(acceptIsValid) + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Deny 1 Policy: expected: false; actual: " + deny1IsValidStr + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Deny 2 Policy: expected: false; actual: " + deny2IsValidStr + "\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Accept Policy: expected: true; actual: " + acceptIsValidStr + "\n") if err != nil { fmt.Printf("Error writing to file: %v", err) return } }() + /////////////////////////////////////////////// // GCS connection /////////////////////////////////////////////// diff --git a/internal/uvm/start.go b/internal/uvm/start.go index e16ec6bdd1..e5f8464f36 100644 --- a/internal/uvm/start.go +++ b/internal/uvm/start.go @@ -314,10 +314,22 @@ func (uvm *UtilityVM) Start(ctx context.Context) (err error) { log.G(ctx).WithField("scListener", uvm.scListener).Info("Successful sidecar GCS connection") - policy := specs.Mount{ - Destination: "/dest/mount/path", + denyPolicy1 := specs.Mount{ + Destination: "C:\\dest\\mount\\path", Type: "bind", - Source: "/src/mount/path", + Source: "C:\\src\\mount\\path", + } + + denyPolicy2 := specs.Mount{ + Destination: "C:\\dest\\mount\\path", + Type: "physical-disk", + Source: "C:\\wrong\\mount\\path", + } + + acceptPolicy := specs.Mount{ + Destination: "C:\\dest\\mount\\path", + Type: "physical-disk", + Source: "C:\\src\\mount\\path", } //Read from the sidecar GCS connection @@ -344,7 +356,27 @@ func (uvm *UtilityVM) Start(ctx context.Context) (err error) { // } enc := gob.NewEncoder(conn) - err = enc.Encode(policy) + err = enc.Encode(denyPolicy1) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + err = enc.Encode(denyPolicy2) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + err = enc.Encode(acceptPolicy) if err != nil { _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") if err != nil { From 41d1b624e8bc8af183d103f0e73f9233ea4ec67a Mon Sep 17 00:00:00 2001 From: nmlud21 Date: Tue, 30 Jul 2024 15:45:35 -0700 Subject: [PATCH 4/4] Updated mount policy enforcment --- cmd/sidecar-gcs/main.go | 32 +++++++++++ internal/uvm/start.go | 116 +++++++++++++++++++++------------------- 2 files changed, 92 insertions(+), 56 deletions(-) diff --git a/cmd/sidecar-gcs/main.go b/cmd/sidecar-gcs/main.go index 590f8957b6..1255a27ba0 100644 --- a/cmd/sidecar-gcs/main.go +++ b/cmd/sidecar-gcs/main.go @@ -191,6 +191,38 @@ func main() { fmt.Printf("Error writing to file: %v", err) return } + + enc := gob.NewEncoder(conn) + err = enc.Encode(deny1IsValid) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + err = enc.Encode(deny2IsValid) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + + err = enc.Encode(acceptIsValid) + if err != nil { + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") + if err != nil { + fmt.Printf("Error writing to file: %v", err) + return + } + return + } + }() /////////////////////////////////////////////// diff --git a/internal/uvm/start.go b/internal/uvm/start.go index e5f8464f36..ee93170b36 100644 --- a/internal/uvm/start.go +++ b/internal/uvm/start.go @@ -333,65 +333,69 @@ func (uvm *UtilityVM) Start(ctx context.Context) (err error) { } //Read from the sidecar GCS connection - go func() { - file, err := os.OpenFile("C:\\ContainerPlat\\conn_log.txt", os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0666) - if err != nil { - log.G(ctx).WithField("err", err.Error()).Info("Error opening file") - } - defer file.Close() - - // buffer := make([]byte, 1024) - // for { - // _, err := conn.Read(buffer) - // if err != nil { - // log.G(ctx).WithField("err", err.Error()).Info("Failed to read from sidecar GCS connection") - // return - // } - // time.Sleep(5 * time.Second) - - // if _, err := file.Write(buffer); err != nil { - // log.G(ctx).WithField("err", err.Error()).Info("Failed to write to log file") - // return - // } - // } - - enc := gob.NewEncoder(conn) - err = enc.Encode(denyPolicy1) - if err != nil { - _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") - if err != nil { - fmt.Printf("Error writing to file: %v", err) - return - } - return - } + //go func() { + file, err := os.OpenFile("C:\\ContainerPlat\\conn_log.txt", os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0666) + if err != nil { + log.G(ctx).WithField("err", err.Error()).Info("Error opening file") + return fmt.Errorf("failed to open file: %w", err) + } + defer file.Close() + + // buffer := make([]byte, 1024) + // for { + // _, err := conn.Read(buffer) + // if err != nil { + // log.G(ctx).WithField("err", err.Error()).Info("Failed to read from sidecar GCS connection") + // return + // } + // time.Sleep(5 * time.Second) + + // if _, err := file.Write(buffer); err != nil { + // log.G(ctx).WithField("err", err.Error()).Info("Failed to write to log file") + // return + // } + // } + + enc := gob.NewEncoder(conn) + err = enc.Encode(denyPolicy1) + if err != nil { + return fmt.Errorf("failed to encode mount policy: %w", err) + } - err = enc.Encode(denyPolicy2) - if err != nil { - _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") - if err != nil { - fmt.Printf("Error writing to file: %v", err) - return - } - return - } + err = enc.Encode(denyPolicy2) + if err != nil { + return fmt.Errorf("failed to encode mount policy: %w", err) + } - err = enc.Encode(acceptPolicy) - if err != nil { - _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Error encoding mount policy\n") - if err != nil { - fmt.Printf("Error writing to file: %v", err) - return - } - return - } + err = enc.Encode(acceptPolicy) + if err != nil { + return fmt.Errorf("failed to encode mount policy: %w", err) + } - _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Mount policy encoded successfully\n") - if err != nil { - fmt.Printf("Error writing to file: %v", err) - return - } - }() + _, err = file.WriteString(time.Now().Format("2006-01-02 15:04:05") + " - Mount policy encoded successfully\n") + if err != nil { + return fmt.Errorf("failed to write to file: %w", err) + } + + var denyPolicy1Bool bool + var denyPolicy2Bool bool + var acceptPolicyBool bool + dec := gob.NewDecoder(conn) + err = dec.Decode(&denyPolicy1Bool) + if err != nil { + return fmt.Errorf("failed to decode mount policy: %w", err) + } + + err = dec.Decode(&denyPolicy2Bool) + if err != nil { + return fmt.Errorf("failed to decode mount policy: %w", err) + } + + err = dec.Decode(&acceptPolicyBool) + if err != nil { + return fmt.Errorf("failed to decode mount policy: %w", err) + } + //}() } // Initialize the SCSIManager.