netstack_proxy/
main.rs

1// Copyright 2023 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5//! Provides a transparent netstack proxy.
6//!
7//! The netstack proxy reads the network stack version it wants to use from
8//! fuchsia.net.stackmigrationdeprecated.Control and spawns the appropriate
9//! netstack binary from its own package.
10//!
11//! The directory request handle is passed directly to the spawned netstack.
12//!
13//! The incoming namespace for the spawned netstack is carefully constructed to
14//! extract out the capabilities that are routed to netstack-proxy that are not
15//! used by netstack itself.
16
17use fidl::endpoints::DiscoverableProtocolMarker;
18
19use vfs::directory::entry_container::Directory;
20use vfs::directory::helper::DirectlyMutable;
21use {fidl_fuchsia_net_stackmigrationdeprecated as fnet_migration, fuchsia_async as fasync};
22
23#[fasync::run_singlethreaded]
24pub async fn main() -> std::process::ExitCode {
25    // Start by getting the Netstack version we should use.
26    let current_boot_version = {
27        let migration =
28            fuchsia_component::client::connect_to_protocol::<fnet_migration::StateMarker>()
29                .expect("connect to protocol");
30        let fnet_migration::InEffectVersion { current_boot, .. } =
31            migration.get_netstack_version().await.expect("failed to read netstack version");
32        current_boot
33    };
34
35    println!("netstack migration proxy using version {current_boot_version:?}");
36    let bin_path = match current_boot_version {
37        fnet_migration::NetstackVersion::Netstack2 => c"/pkg/bin/netstack",
38        fnet_migration::NetstackVersion::Netstack3 => c"/pkg/bin/netstack3",
39    };
40
41    let ns = fdio::Namespace::installed().expect("failed to get namespace");
42    let mut entries = ns
43        .export()
44        .expect("failed to export namespace entries")
45        .into_iter()
46        .filter_map(|fdio::NamespaceEntry { handle, path }| match path.as_str() {
47            "/" => {
48                panic!("unexpected non flat namespace, bad capabilities will bleed into netstack")
49            }
50            "/svc" => None,
51            x => {
52                Some((Some(handle), std::ffi::CString::new(x).expect("failed to create C string")))
53            }
54        })
55        .collect::<Vec<_>>();
56
57    let handle =
58        fuchsia_runtime::take_startup_handle(fuchsia_runtime::HandleType::DirectoryRequest.into())
59            .expect("missing startup handle");
60
61    let mut actions = vec![fdio::SpawnAction::add_handle(
62        fuchsia_runtime::HandleInfo::new(fuchsia_runtime::HandleType::DirectoryRequest, 0),
63        handle,
64    )];
65
66    actions.extend(entries.iter_mut().map(|(handle, path)| {
67        // Handle is always Some here, we use an option so we can take it from
68        // entries while entries keeps the CString backing.
69        let handle = handle.take().unwrap();
70        fdio::SpawnAction::add_namespace_entry(path.as_c_str(), handle)
71    }));
72
73    let svc = vfs::directory::immutable::simple::simple();
74    for s in std::fs::read_dir("/svc").expect("failed to get /svc entries") {
75        let entry = s.expect("failed to get directory entry");
76        let name = entry.file_name();
77        let name = name.to_str().expect("failed to get file name");
78
79        // Don't allow Netstack to see the services that we use exclusively to
80        // enable proxying.
81        let block_services = [
82            fidl_fuchsia_process::LauncherMarker::PROTOCOL_NAME,
83            fnet_migration::StateMarker::PROTOCOL_NAME,
84        ];
85        if block_services.into_iter().any(|s| s == name) {
86            continue;
87        }
88        svc.add_entry(
89            name,
90            vfs::service::endpoint(move |_, channel| {
91                fuchsia_component::client::connect_channel_to_protocol_at_path(
92                    channel.into(),
93                    entry.path().to_str().expect("failed to get entry path"),
94                )
95                .unwrap_or_else(|e| eprintln!("error connecting to protocol {:?}", e));
96            }),
97        )
98        .unwrap_or_else(|e| panic!("failed to add entry {name}: {e:?}"));
99    }
100
101    let scope = vfs::execution_scope::ExecutionScope::new();
102
103    let (svc_dir, server_end) = fidl::endpoints::create_endpoints::<fidl_fuchsia_io::NodeMarker>();
104    let flags = fidl_fuchsia_io::PERM_READABLE
105        | fidl_fuchsia_io::PERM_WRITABLE
106        | fidl_fuchsia_io::PERM_EXECUTABLE;
107    svc.open3(
108        scope.clone(),
109        vfs::path::Path::dot(),
110        flags.clone(),
111        &mut vfs::ObjectRequest::new(flags, &Default::default(), server_end.into_channel()),
112    )
113    .expect("failed to create connection to service directory");
114
115    actions.push(fdio::SpawnAction::add_namespace_entry(c"/svc", svc_dir.into_channel().into()));
116
117    // Pass down the configuration VMO if we have it.
118    let config_vmo_handle_info = fuchsia_runtime::HandleType::ComponentConfigVmo.into();
119    if let Some(config_vmo) = fuchsia_runtime::take_startup_handle(config_vmo_handle_info) {
120        actions.push(fdio::SpawnAction::add_handle(config_vmo_handle_info, config_vmo))
121    }
122
123    let proc = fdio::spawn_etc(
124        &fuchsia_runtime::job_default(),
125        fdio::SpawnOptions::CLONE_ALL - fdio::SpawnOptions::CLONE_NAMESPACE,
126        bin_path,
127        &[bin_path],
128        None,
129        &mut actions[..],
130    )
131    .expect("failed to spawn netstack");
132
133    let signals = fasync::OnSignals::new(&proc, zx::Signals::PROCESS_TERMINATED)
134        .await
135        .expect("failed to observe process termination signals");
136    println!("netstack exited unexpectedly with {signals:?}");
137
138    // TODO(https://fxbug.dev/380897722) Inherit the exit code of the proxied netstack process once
139    // netstack supports clean shutdown.
140    std::process::ExitCode::FAILURE
141}
netstack_proxy/main.rs

netstack_proxy/
main.rs
