a3s-box-runtime 3.2.0

MicroVM runtime engine — VM lifecycle, OCI images, attestation, networking
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
use std::num::NonZeroU16;
#[cfg(target_os = "linux")]
use std::path::Path;
use std::time::Duration;

#[cfg(target_os = "linux")]
use a3s_box_core::ExecutionBackend;
use a3s_box_core::{
    ExecutionGeneration, ExecutionId, ExecutionManagerError, ExecutionManagerResult,
    ExecutionPortConnector, ExecutionPortStream,
};
use async_trait::async_trait;
#[cfg(target_os = "linux")]
use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
#[cfg(target_os = "linux")]
use tokio::net::UnixStream;

use super::LocalExecutionManager;
#[cfg(target_os = "linux")]
use crate::BoxRecord;

#[cfg(target_os = "linux")]
const PORT_FORWARD_STREAM_ID: u32 = 1;
#[cfg(target_os = "linux")]
const PORT_FORWARD_FRAME_OPEN: u8 = 1;
#[cfg(target_os = "linux")]
const PORT_FORWARD_FRAME_OPEN_ACK: u8 = 2;
#[cfg(target_os = "linux")]
const PORT_FORWARD_FRAME_DATA: u8 = 3;
#[cfg(target_os = "linux")]
const PORT_FORWARD_FRAME_CLOSE: u8 = 4;
#[cfg(target_os = "linux")]
const PORT_FORWARD_BUFFER_BYTES: usize = 16 * 1024;
#[cfg(target_os = "linux")]
const PORT_FORWARD_MAX_FRAME_BYTES: usize = 64 * 1024;

#[async_trait]
impl ExecutionPortConnector for LocalExecutionManager {
    async fn connect_port(
        &self,
        execution_id: &ExecutionId,
        generation: ExecutionGeneration,
        port: NonZeroU16,
        timeout: Duration,
    ) -> ExecutionManagerResult<ExecutionPortStream> {
        if timeout.is_zero() {
            return Err(ExecutionManagerError::InvalidRequest(
                "port connection timeout must be non-zero".to_string(),
            ));
        }

        #[cfg(target_os = "linux")]
        {
            let (record, backend) = self.require_connectable(execution_id, generation).await?;
            let pid = record
                .pid
                .ok_or_else(|| ExecutionManagerError::NotFound(execution_id.clone()))?;
            let pid_start_time = record.pid_start_time;
            if !crate::process::is_process_alive_with_identity(pid, pid_start_time) {
                return Err(ExecutionManagerError::NotFound(execution_id.clone()));
            }

            let stream: ExecutionPortStream = if backend.is_sandbox() {
                Box::pin(
                    connect_in_network_namespace(
                        execution_id.clone(),
                        pid,
                        pid_start_time,
                        port,
                        timeout,
                    )
                    .await?,
                )
            } else {
                let socket_path = record.exec_socket_path.with_file_name("portfwd.sock");
                connect_microvm_port(execution_id, &socket_path, port, timeout).await?
            };

            // The lifecycle may have advanced while the blocking connect was in
            // flight. Re-read the canonical record before publishing the stream.
            let (current, current_backend) =
                self.require_connectable(execution_id, generation).await?;
            if current.pid != Some(pid)
                || current.pid_start_time != pid_start_time
                || current_backend != backend
                || current.exec_socket_path != record.exec_socket_path
                || !crate::process::is_process_alive_with_identity(pid, pid_start_time)
            {
                return Err(ExecutionManagerError::Conflict {
                    execution_id: execution_id.clone(),
                    message: "runtime generation changed while connecting its data plane"
                        .to_string(),
                });
            }
            return Ok(stream);
        }

        #[cfg(not(target_os = "linux"))]
        {
            let _ = (execution_id, generation, port, timeout);
            Err(ExecutionManagerError::Unavailable(
                "Sandbox port connections require Linux network namespaces".to_string(),
            ))
        }
    }
}

#[cfg(target_os = "linux")]
impl LocalExecutionManager {
    async fn require_connectable(
        &self,
        execution_id: &ExecutionId,
        generation: ExecutionGeneration,
    ) -> ExecutionManagerResult<(BoxRecord, ExecutionBackend)> {
        let record = self
            .require_running_record(execution_id, generation)
            .await?;
        let backend = record
            .managed_execution
            .as_ref()
            .map(|metadata| metadata.plan.backend)
            .ok_or_else(|| {
                ExecutionManagerError::Internal(format!(
                    "execution {execution_id} has no managed execution plan"
                ))
            })?;
        Ok((record, backend))
    }
}

#[cfg(target_os = "linux")]
#[derive(Debug)]
struct PortForwardFrame {
    kind: u8,
    stream_id: u32,
    payload: Vec<u8>,
}

#[cfg(target_os = "linux")]
async fn connect_microvm_port(
    execution_id: &ExecutionId,
    socket_path: &Path,
    port: NonZeroU16,
    timeout: Duration,
) -> ExecutionManagerResult<ExecutionPortStream> {
    let connect = async {
        let mut control = UnixStream::connect(socket_path).await.map_err(|error| {
            ExecutionManagerError::Unavailable(format!(
                "failed to connect to MicroVM port channel for {execution_id}: {error}"
            ))
        })?;
        write_port_forward_frame(
            &mut control,
            PORT_FORWARD_FRAME_OPEN,
            PORT_FORWARD_STREAM_ID,
            &port.get().to_be_bytes(),
        )
        .await
        .map_err(|error| {
            ExecutionManagerError::Unavailable(format!(
                "failed to request MicroVM port {} for {execution_id}: {error}",
                port.get()
            ))
        })?;
        let acknowledgement = read_port_forward_frame(&mut control)
            .await
            .map_err(|error| {
                ExecutionManagerError::Unavailable(format!(
                    "failed to open MicroVM port {} for {execution_id}: {error}",
                    port.get()
                ))
            })?;
        let accepted = acknowledgement.as_ref().is_some_and(|frame| {
            frame.kind == PORT_FORWARD_FRAME_OPEN_ACK
                && frame.stream_id == PORT_FORWARD_STREAM_ID
                && frame.payload.as_slice() == [0]
        });
        if !accepted {
            return Err(ExecutionManagerError::Unavailable(format!(
                "MicroVM port {} rejected the connection for {execution_id}",
                port.get()
            )));
        }

        let (application, relay) = tokio::io::duplex(PORT_FORWARD_MAX_FRAME_BYTES);
        let relay_execution_id = execution_id.clone();
        tokio::spawn(async move {
            if let Err(error) = relay_microvm_port(control, relay).await {
                tracing::warn!(
                    execution_id = %relay_execution_id,
                    guest_port = port.get(),
                    error = %error,
                    "MicroVM port relay failed"
                );
            }
        });
        Ok(Box::pin(application) as ExecutionPortStream)
    };

    tokio::time::timeout(timeout, connect).await.map_err(|_| {
        ExecutionManagerError::Unavailable(format!(
            "timed out connecting MicroVM port {} for {execution_id}",
            port.get()
        ))
    })?
}

#[cfg(target_os = "linux")]
async fn relay_microvm_port(
    control: UnixStream,
    relay: tokio::io::DuplexStream,
) -> std::io::Result<()> {
    let (mut control_read, mut control_write) = control.into_split();
    let (mut relay_read, mut relay_write) = tokio::io::split(relay);
    let mut buffer = [0_u8; PORT_FORWARD_BUFFER_BYTES];

    loop {
        tokio::select! {
            read = relay_read.read(&mut buffer) => match read? {
                0 => {
                    write_port_forward_frame(
                        &mut control_write,
                        PORT_FORWARD_FRAME_CLOSE,
                        PORT_FORWARD_STREAM_ID,
                        &[],
                    )
                    .await?;
                    return Ok(());
                }
                count => {
                    write_port_forward_frame(
                        &mut control_write,
                        PORT_FORWARD_FRAME_DATA,
                        PORT_FORWARD_STREAM_ID,
                        &buffer[..count],
                    )
                    .await?;
                }
            },
            frame = read_port_forward_frame(&mut control_read) => {
                let Some(frame) = frame? else {
                    relay_write.shutdown().await?;
                    return Ok(());
                };
                if frame.stream_id != PORT_FORWARD_STREAM_ID {
                    return Err(std::io::Error::new(
                        std::io::ErrorKind::InvalidData,
                        "MicroVM port channel returned an unexpected stream ID",
                    ));
                }
                match frame.kind {
                    PORT_FORWARD_FRAME_DATA => relay_write.write_all(&frame.payload).await?,
                    PORT_FORWARD_FRAME_CLOSE => {
                        relay_write.shutdown().await?;
                        return Ok(());
                    }
                    _ => {
                        return Err(std::io::Error::new(
                            std::io::ErrorKind::InvalidData,
                            "MicroVM port channel returned an unexpected frame",
                        ));
                    }
                }
            }
        }
    }
}

#[cfg(target_os = "linux")]
async fn write_port_forward_frame<W>(
    stream: &mut W,
    kind: u8,
    stream_id: u32,
    payload: &[u8],
) -> std::io::Result<()>
where
    W: AsyncWrite + Unpin,
{
    let payload_len = u32::try_from(payload.len()).map_err(|_| {
        std::io::Error::new(
            std::io::ErrorKind::InvalidInput,
            "MicroVM port frame payload exceeds u32",
        )
    })?;
    stream.write_all(&[kind]).await?;
    stream.write_all(&stream_id.to_be_bytes()).await?;
    stream.write_all(&payload_len.to_be_bytes()).await?;
    stream.write_all(payload).await?;
    stream.flush().await
}

#[cfg(target_os = "linux")]
async fn read_port_forward_frame<R>(stream: &mut R) -> std::io::Result<Option<PortForwardFrame>>
where
    R: AsyncRead + Unpin,
{
    let mut header = [0_u8; 9];
    match stream.read_exact(&mut header).await {
        Ok(_) => {}
        Err(error) if error.kind() == std::io::ErrorKind::UnexpectedEof => return Ok(None),
        Err(error) => return Err(error),
    }
    let payload_len = u32::from_be_bytes([header[5], header[6], header[7], header[8]]) as usize;
    if payload_len > PORT_FORWARD_MAX_FRAME_BYTES {
        return Err(std::io::Error::new(
            std::io::ErrorKind::InvalidData,
            "MicroVM port frame exceeds the bounded payload limit",
        ));
    }
    let mut payload = vec![0_u8; payload_len];
    stream.read_exact(&mut payload).await?;
    Ok(Some(PortForwardFrame {
        kind: header[0],
        stream_id: u32::from_be_bytes([header[1], header[2], header[3], header[4]]),
        payload,
    }))
}

#[cfg(target_os = "linux")]
async fn connect_in_network_namespace(
    execution_id: ExecutionId,
    pid: u32,
    pid_start_time: Option<u64>,
    port: NonZeroU16,
    timeout: Duration,
) -> ExecutionManagerResult<tokio::net::TcpStream> {
    let (sender, receiver) = tokio::sync::oneshot::channel();
    std::thread::Builder::new()
        .name(format!("a3s-port-{pid}-{}", port.get()))
        .spawn(move || {
            let result = connect_in_network_namespace_blocking(
                &execution_id,
                pid,
                pid_start_time,
                port,
                timeout,
            );
            let _ = sender.send(result);
        })
        .map_err(|error| {
            ExecutionManagerError::Unavailable(format!(
                "failed to start Sandbox port connector: {error}"
            ))
        })?;

    let stream = receiver.await.map_err(|_| {
        ExecutionManagerError::Internal(
            "Sandbox port connector exited without a result".to_string(),
        )
    })??;
    tokio::net::TcpStream::from_std(stream).map_err(|error| {
        ExecutionManagerError::Unavailable(format!(
            "failed to register Sandbox port stream with Tokio: {error}"
        ))
    })
}

#[cfg(target_os = "linux")]
fn connect_in_network_namespace_blocking(
    execution_id: &ExecutionId,
    pid: u32,
    pid_start_time: Option<u64>,
    port: NonZeroU16,
    timeout: Duration,
) -> ExecutionManagerResult<std::net::TcpStream> {
    use std::fs::File;
    use std::os::fd::AsRawFd;

    if !crate::process::is_process_alive_with_identity(pid, pid_start_time) {
        return Err(ExecutionManagerError::NotFound(execution_id.clone()));
    }
    let namespace_path = format!("/proc/{pid}/ns/net");
    let namespace = File::open(&namespace_path).map_err(|error| {
        ExecutionManagerError::Unavailable(format!(
            "failed to open Sandbox network namespace {namespace_path}: {error}"
        ))
    })?;
    let result = unsafe { libc::setns(namespace.as_raw_fd(), libc::CLONE_NEWNET) };
    if result != 0 {
        return Err(ExecutionManagerError::Unavailable(format!(
            "failed to enter Sandbox network namespace for PID {pid}: {}",
            std::io::Error::last_os_error()
        )));
    }
    if !crate::process::is_process_alive_with_identity(pid, pid_start_time) {
        return Err(ExecutionManagerError::Unavailable(
            "Sandbox runtime exited while entering its network namespace".to_string(),
        ));
    }

    let address = std::net::SocketAddr::from((std::net::Ipv4Addr::LOCALHOST, port.get()));
    let stream = std::net::TcpStream::connect_timeout(&address, timeout).map_err(|error| {
        ExecutionManagerError::Unavailable(format!(
            "failed to connect to Sandbox loopback port {}: {error}",
            port.get()
        ))
    })?;
    stream.set_nonblocking(true).map_err(|error| {
        ExecutionManagerError::Unavailable(format!(
            "failed to configure Sandbox port stream: {error}"
        ))
    })?;
    Ok(stream)
}

#[cfg(all(test, target_os = "linux"))]
#[path = "port_tests.rs"]
mod tests;