|
1 | 1 | #!/usr/bin/env python3 |
2 | | -"""dstack -> configfs-tsm compatibility shim (FIFO mode, zero privileges). |
| 2 | +"""dstack -> configfs-tsm shim. |
3 | 3 |
|
4 | | -Re-exposes the dstack guest-agent `GetQuote` RPC under the standard |
5 | | -configfs-tsm file ABI that unmodified attestation binaries expect: |
| 4 | +Serves <dir>/inblob (write report_data, <=64 bytes) and <dir>/outblob (read the |
| 5 | +raw Intel DCAP TDX quote) by forwarding to the dstack guest-agent GetQuote RPC. |
| 6 | +inblob/outblob are FIFOs, so a read of outblob blocks until the quote is ready. |
| 7 | +report_data is forwarded byte-for-byte, so the quote is the genuine hardware |
| 8 | +quote. |
6 | 9 |
|
7 | | - <report-dir>/inblob write <=64 bytes of report_data |
8 | | - <report-dir>/outblob read -> raw Intel DCAP TDX quote |
| 10 | +Serves ONE request at a time and supports a SINGLE in-flight requester -- like a |
| 11 | +single configfs-tsm report entry, it cannot correlate concurrent callers. Run one |
| 12 | +shim per app. An empty outblob read means the quote failed. |
9 | 13 |
|
10 | | -`inblob` and `outblob` are implemented as named pipes (FIFOs), so a read of |
11 | | -`outblob` naturally blocks until the quote for the most recent `inblob` write |
12 | | -is ready. That matches the canonical configfs-tsm usage (write inblob, then |
13 | | -read outblob) with no race, and -- crucially -- needs NO FUSE, NO |
14 | | -CAP_SYS_ADMIN, and NO remount of /sys. It runs as an ordinary process in a |
15 | | -sidecar or a pre-launch wrapper. |
16 | | -
|
17 | | -The quote itself still comes from real TDX hardware via the guest-agent over |
18 | | -its unix socket, so attestation is not weakened: report_data is forwarded |
19 | | -byte-for-byte and the returned quote is the genuine hardware quote. |
20 | | -
|
21 | | -Usage: |
22 | | - tsm_shim.py --report-dir /run/tsm/report --socket /var/run/dstack.sock |
| 14 | +Env: TSM_REPORT_DIR (default /run/tsm/report), DSTACK_SOCKET (default |
| 15 | +/var/run/dstack.sock). |
23 | 16 | """ |
24 | | -import argparse |
| 17 | +import errno |
| 18 | +import fcntl |
25 | 19 | import http.client |
26 | 20 | import json |
27 | 21 | import os |
28 | 22 | import socket |
29 | 23 | import sys |
30 | 24 | import time |
31 | | -import traceback |
| 25 | + |
| 26 | +REPORT_DIR = os.environ.get("TSM_REPORT_DIR", "/run/tsm/report") |
| 27 | +SOCKET = os.environ.get("DSTACK_SOCKET", "/var/run/dstack.sock") |
| 28 | +# How long to wait for the app to open outblob for reading before giving up, so a |
| 29 | +# caller that writes inblob then dies can't wedge the daemon. |
| 30 | +OUTBLOB_DEADLINE = float(os.environ.get("TSM_OUTBLOB_DEADLINE", "30")) |
32 | 31 |
|
33 | 32 |
|
34 | 33 | def log(msg): |
35 | 34 | sys.stderr.write(f"[tsm-shim] {msg}\n") |
36 | 35 | sys.stderr.flush() |
37 | 36 |
|
38 | 37 |
|
39 | | -class _UDSConnection(http.client.HTTPConnection): |
40 | | - """HTTPConnection that dials an AF_UNIX socket instead of TCP.""" |
| 38 | +class _UDS(http.client.HTTPConnection): |
| 39 | + """HTTPConnection over an AF_UNIX socket.""" |
41 | 40 |
|
42 | | - def __init__(self, uds_path, timeout): |
| 41 | + def __init__(self, path, timeout): |
43 | 42 | super().__init__("localhost", timeout=timeout) |
44 | | - self._uds_path = uds_path |
| 43 | + self._path = path |
45 | 44 |
|
46 | 45 | def connect(self): |
47 | | - s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) |
48 | | - s.settimeout(self.timeout) |
49 | | - s.connect(self._uds_path) |
50 | | - self.sock = s |
51 | | - |
| 46 | + self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) |
| 47 | + self.sock.settimeout(self.timeout) |
| 48 | + self.sock.connect(self._path) |
52 | 49 |
|
53 | | -def get_quote(sock_path, report_data, timeout=30): |
54 | | - """Call dstack guest-agent DstackGuest.GetQuote, return raw quote bytes. |
55 | 50 |
|
56 | | - Wire format mirrors the official dstack SDK: POST /GetQuote over the unix |
57 | | - socket with JSON body {"report_data": "<hex>"}; response is JSON with a |
58 | | - hex-encoded "quote". http.client transparently handles chunked / |
59 | | - content-length response framing, so no extra deps are required. |
60 | | - """ |
61 | | - body = json.dumps({"report_data": report_data.hex()}) |
62 | | - conn = _UDSConnection(sock_path, timeout) |
| 51 | +def get_quote(report_data, timeout=30): |
| 52 | + conn = _UDS(SOCKET, timeout) |
63 | 53 | try: |
64 | | - conn.request( |
65 | | - "POST", |
66 | | - "/GetQuote", |
67 | | - body=body, |
68 | | - headers={"Host": "localhost", "Content-Type": "application/json"}, |
69 | | - ) |
| 54 | + conn.request("POST", "/GetQuote", |
| 55 | + body=json.dumps({"report_data": report_data.hex()}), |
| 56 | + headers={"Host": "localhost", "Content-Type": "application/json"}) |
70 | 57 | resp = conn.getresponse() |
71 | 58 | data = resp.read() |
72 | 59 | if resp.status != 200: |
73 | | - raise RuntimeError( |
74 | | - f"guest-agent GetQuote returned HTTP {resp.status}: {data[:200]!r}" |
75 | | - ) |
76 | | - obj = json.loads(data) |
77 | | - if "quote" not in obj: |
78 | | - raise RuntimeError(f"GetQuote response missing 'quote': {obj}") |
79 | | - return bytes.fromhex(obj["quote"]) |
| 60 | + raise RuntimeError(f"guest-agent returned http {resp.status}: {data[:200]!r}") |
| 61 | + quote = json.loads(data).get("quote") |
| 62 | + if not quote: |
| 63 | + raise RuntimeError(f"no quote in response: {data[:200]!r}") |
| 64 | + return bytes.fromhex(quote) |
80 | 65 | finally: |
81 | 66 | conn.close() |
82 | 67 |
|
83 | 68 |
|
84 | | -def _make_fifo(path): |
| 69 | +def open_write_deadline(path, deadline=30.0): |
| 70 | + """open a FIFO for writing, waiting up to `deadline`s for a reader. |
| 71 | +
|
| 72 | + Returns a blocking fd, or None if no reader showed up -- so a caller that |
| 73 | + writes inblob then dies can't wedge the daemon forever. |
| 74 | + """ |
| 75 | + end = time.monotonic() + deadline |
| 76 | + while True: |
| 77 | + try: |
| 78 | + fd = os.open(path, os.O_WRONLY | os.O_NONBLOCK) |
| 79 | + except OSError as exc: |
| 80 | + if exc.errno == errno.ENXIO and time.monotonic() < end: |
| 81 | + time.sleep(0.05) |
| 82 | + continue |
| 83 | + return None |
| 84 | + fcntl.fcntl(fd, fcntl.F_SETFL, fcntl.fcntl(fd, fcntl.F_GETFL) & ~os.O_NONBLOCK) |
| 85 | + return fd |
| 86 | + |
| 87 | + |
| 88 | +def make_fifo(path): |
85 | 89 | if os.path.lexists(path): |
86 | 90 | os.remove(path) |
87 | 91 | os.mkfifo(path, 0o600) |
88 | 92 |
|
89 | 93 |
|
90 | | -def serve(report_dir, sock_path): |
91 | | - os.makedirs(report_dir, exist_ok=True) |
92 | | - inblob = os.path.join(report_dir, "inblob") |
93 | | - outblob = os.path.join(report_dir, "outblob") |
94 | | - _make_fifo(inblob) |
95 | | - _make_fifo(outblob) |
96 | | - # Best-effort: expose a `provider` attribute for apps that sanity-check it. |
97 | | - try: |
98 | | - with open(os.path.join(report_dir, "provider"), "w") as f: |
99 | | - f.write("tdx_guest\n") |
100 | | - except OSError: |
101 | | - pass |
| 94 | +def main(): |
| 95 | + os.makedirs(REPORT_DIR, exist_ok=True) |
| 96 | + inblob = os.path.join(REPORT_DIR, "inblob") |
| 97 | + outblob = os.path.join(REPORT_DIR, "outblob") |
| 98 | + make_fifo(inblob) |
| 99 | + make_fifo(outblob) |
| 100 | + log(f"ready: {REPORT_DIR} -> {SOCKET}") |
102 | 101 |
|
103 | | - log(f"ready: {inblob} (write report_data), {outblob} (read quote) -> {sock_path}") |
104 | 102 | while True: |
105 | 103 | try: |
106 | | - # 1. Block until the app writes report_data to inblob. |
107 | | - with open(inblob, "rb") as f: |
| 104 | + with open(inblob, "rb") as f: # blocks until the app writes |
108 | 105 | report_data = f.read() |
109 | 106 | if not report_data: |
110 | | - continue # opened+closed with no payload; ignore. |
111 | | - rd64 = report_data[:64].ljust(64, b"\0") |
112 | | - log(f"inblob: {len(report_data)} bytes; requesting hardware quote...") |
113 | | - try: |
114 | | - quote = get_quote(sock_path, rd64) |
115 | | - log(f"quote: {len(quote)} bytes, header={quote[:2].hex()}") |
116 | | - except Exception as exc: # noqa: BLE001 - surface to logs, keep serving |
117 | | - log(f"GetQuote failed: {exc}") |
118 | | - quote = b"" # deliver empty so the reader doesn't hang forever. |
119 | | - # 2. Block until the app opens outblob for reading, then deliver. |
120 | | - with open(outblob, "wb") as f: |
| 107 | + continue |
| 108 | + if len(report_data) > 64: |
| 109 | + # >64 bytes means more than one writer raced on inblob -- fail |
| 110 | + # closed rather than hand back a quote bound to ambiguous data. |
| 111 | + log(f"rejecting inblob: {len(report_data)} bytes (>64); concurrent writers?") |
| 112 | + quote = b"" |
| 113 | + else: |
| 114 | + try: |
| 115 | + quote = get_quote(report_data.ljust(64, b"\0")) |
| 116 | + log(f"quote {len(quote)} bytes, header={quote[:2].hex()}") |
| 117 | + except Exception as exc: |
| 118 | + log(f"getquote failed: {exc}") # deliver empty == failure signal |
| 119 | + quote = b"" |
| 120 | + fd = open_write_deadline(outblob, OUTBLOB_DEADLINE) |
| 121 | + if fd is None: |
| 122 | + log("no reader for outblob within deadline; dropping") |
| 123 | + continue |
| 124 | + with os.fdopen(fd, "wb") as f: |
121 | 125 | f.write(quote) |
122 | | - except Exception: # noqa: BLE001 - never let the daemon die. |
123 | | - log("serve loop error:\n" + traceback.format_exc()) |
| 126 | + except Exception as exc: |
| 127 | + log(f"serve loop error: {exc}") |
124 | 128 | time.sleep(0.5) |
125 | 129 |
|
126 | 130 |
|
127 | | -def main(): |
128 | | - ap = argparse.ArgumentParser(description=__doc__) |
129 | | - ap.add_argument( |
130 | | - "--report-dir", |
131 | | - default=os.environ.get("TSM_REPORT_DIR", "/run/tsm/report"), |
132 | | - help="directory in which to expose inblob/outblob FIFOs", |
133 | | - ) |
134 | | - ap.add_argument( |
135 | | - "--socket", |
136 | | - default=os.environ.get("DSTACK_SOCKET", "/var/run/dstack.sock"), |
137 | | - help="path to the dstack guest-agent unix socket", |
138 | | - ) |
139 | | - args = ap.parse_args() |
140 | | - serve(args.report_dir, args.socket) |
141 | | - |
142 | | - |
143 | 131 | if __name__ == "__main__": |
144 | 132 | main() |
0 commit comments