Skip to content

Commit 9a6fb97

Browse files
ilyalukilyaluk
committed
bob-l2: initial commit
1 parent 9b4a486 commit 9a6fb97

File tree

11 files changed

+201
-2
lines changed

11 files changed

+201
-2
lines changed

‎DEVELOPMENT.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ flashboxes/
2727
│ └── debloat*.sh # System cleanup scripts
2828
├── bob-common/ # TEE Searcher common image
2929
├── bob-l1/ # L1 TEE Searcher sandbox image
30+
├── bob-l2/ # L2 TEE Searcher sandbox image
3031
├── buildernet/ # BuilderNet
3132
├── tdx-dummy/ # TDX test environment
3233
├── kernel/ # Kernel configuration

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ setup: ## Install dependencies (Linux only)
3939

4040
# Build module
4141
build: check-perms setup ## Build the specified module
42-
$(WRAPPER) mkosi --force -I $(IMAGE).conf
42+
$(WRAPPER) mkosi --force --include=$(IMAGE).conf
4343

4444
# Build module with devtools profile
4545
build-dev: check-perms setup ## Build module with development tools
46-
$(WRAPPER) mkosi --force --profile=devtools -I $(IMAGE).conf
46+
$(WRAPPER) mkosi --force --profile=devtools --include=$(IMAGE).conf
4747

4848
##@ Utilities
4949

‎bob-common/mkosi.extra/usr/bin/init-firewall.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,18 @@ accept_dst_ip_port() {
124124
-m comment --comment "$comment"
125125
}
126126

127+
accept_src_ip_dst_port() {
128+
chain="$1"
129+
protocol="$2"
130+
ip="$3"
131+
port="$4"
132+
comment="$5"
133+
134+
iptables -A "$chain" -p "$protocol" -s "$ip" --dport "$port" \
135+
-m conntrack --ctstate NEW -j ACCEPT \
136+
-m comment --comment "$comment"
137+
}
138+
127139
drop_dst_ip() {
128140
chain="$1"
129141
ip="$2"

‎bob-l2.conf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[Include]
2+
Include=base/mkosi.conf
3+
Include=bob-common/mkosi.conf
4+
Include=bob-l2/mkosi.conf
5+
6+
[Config]
7+
Profiles=gcp
8+
9+
[Distribution]
10+
Mirror=https://snapshot.debian.org/archive/debian/20250526T142542Z/
11+
12+
[Build]
13+
ToolsTreeMirror=https://snapshot.debian.org/archive/debian/20250526T142542Z/

‎bob-l2/kernel.config‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
CONFIG_NET_VENDOR_GOOGLE=y
2+
CONFIG_GVE=y
3+
4+
# Enable iptables interface for CONFIG_NF_TABLES
5+
# Same config as in bob-l1
6+
CONFIG_IPV6=n
7+
CONFIG_NETFILTER_NETLINK=y
8+
CONFIG_NETFILTER_NETLINK_LOG=y
9+
CONFIG_NF_CONNTRACK_MARK=y
10+
CONFIG_NF_CONNTRACK_EVENTS=y
11+
CONFIG_NF_CT_PROTO_SCTP=y
12+
CONFIG_NF_CT_PROTO_UDPLITE=y
13+
CONFIG_NF_CT_NETLINK=y
14+
CONFIG_NF_NAT_NEEDED=y
15+
CONFIG_NF_TABLES=y
16+
CONFIG_NF_TABLES_INET=y
17+
CONFIG_NF_TABLES_IPV4=y
18+
CONFIG_NF_TABLES_BRIDGE=y
19+
CONFIG_NF_TABLES_ARP=y
20+
CONFIG_NF_TABLES_NETDEV=y
21+
CONFIG_NETFILTER_XTABLES_COMPAT=y
22+
CONFIG_NFT_CT=y
23+
CONFIG_NFT_COUNTER=y
24+
CONFIG_NFT_LOG=y
25+
CONFIG_NFT_LIMIT=y
26+
CONFIG_NFT_MASQ=y
27+
CONFIG_NFT_REJECT=y
28+
CONFIG_NFT_REJECT_INET=y
29+
CONFIG_NFT_COMPAT=y
30+
CONFIG_NFT_NAT=y
31+
CONFIG_NFT_REDIR=y
32+
CONFIG_NFT_OBJREF=y
33+
CONFIG_NETFILTER_XT_TARGET_LOG=y
34+
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
35+
CONFIG_NETFILTER_XT_MATCH_STATE=y
36+
CONFIG_IP_NF_TARGET_REJECT=y
37+
CONFIG_IP_NF_TARGET_NETMAP=y
38+
CONFIG_IP_NF_TARGET_REDIRECT=y
39+
CONFIG_IP_NF_MANGLE=y
40+
CONFIG_IP_NF_RAW=y
41+
CONFIG_NET_SCHED=y
42+
CONFIG_CRYPTO_USER_API_HASH=y
43+
CONFIG_CRYPTO_USER_API_SKCIPHER=y
44+
CONFIG_CRYPTO_USER_API_RNG=y
45+
CONFIG_CRYPTO_USER_API_AEAD=y

‎bob-l2/mkosi.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[Build]
2+
Environment=KERNEL_CONFIG_SNIPPETS=kernel/snippets/ubuntu.config,bob-l2/kernel.config
3+
WithNetwork=true
4+
5+
[Content]
6+
ExtraTrees=bob-l2/mkosi.extra
7+
PostInstallationScripts=bob-l2/mkosi.postinst
8+
9+
Packages=chrony

‎bob-l2/mkosi.extra/etc/bob/firewall-config‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# This script is sourced from firewall script and contains image-specific rules
2+
# See also: bob-common/mkosi.extra/usr/bin/init-firewall.sh
3+
4+
# Image-specific ports
5+
SSH_CONTROL_PORT=22
6+
SSH_DATA_PORT=10022
7+
SSH_REGISTER_PORT=8080
8+
CVM_REVERSE_PROXY_PORT=8745
9+
SEARCHER_INPUT_PORT=27017
10+
11+
# Well-known ports
12+
DNS_PORT=53
13+
HTTP_PORT=80
14+
HTTPS_PORT=443
15+
NTP_PORT=123
16+
OP_NODE_P2P_PORT=9222
17+
OP_GETH_P2P_PORT=30303
18+
ENGINE_API_PORT=8651
19+
20+
###########################################################################
21+
# (1) ALWAYS_IN: Inbound rules that are always applied
22+
###########################################################################
23+
24+
accept_dst_port $CHAIN_ALWAYS_IN tcp $SSH_CONTROL_PORT "SSH control port"
25+
accept_dst_port $CHAIN_ALWAYS_IN udp $SEARCHER_INPUT_PORT "Searcher input channel"
26+
27+
# We drive op-geth in the searcher container from external op-node
28+
accept_src_ip_dst_port $CHAIN_ALWAYS_IN tcp "$METADATA_BOB_L2_OP_NODE_CIDR" $ENGINE_API_PORT "Engine API"
29+
30+
# CVM reverse-proxy serves server attestation
31+
# Also forwards request to ssh pubkey server on localhost:5001,
32+
# which serves searcher-container openssh server pubkey
33+
accept_dst_port $CHAIN_ALWAYS_IN tcp $CVM_REVERSE_PROXY_PORT "CVM reverse-proxy"
34+
35+
###########################################################################
36+
# (2) ALWAYS_OUT: Outbound rules that are always applied
37+
###########################################################################
38+
39+
# Note: this is accessible only from host, searcher netns has DROP on those
40+
# See also init-container.sh
41+
accept_dst_port $CHAIN_ALWAYS_OUT udp $NTP_PORT "NTP"
42+
43+
accept_dst_ip_port $CHAIN_ALWAYS_OUT tcp "$METADATA_BOB_L2_BACKRUNS_IP" $HTTP_PORT "bundle"
44+
45+
###########################################################################
46+
# (3) MAINTENANCE_IN: Inbound rules for Maintenance Mode
47+
###########################################################################
48+
49+
accept_dst_port $CHAIN_MAINTENANCE_IN tcp $SSH_DATA_PORT "SSH data plane"
50+
accept_dst_port $CHAIN_MAINTENANCE_IN tcp $SSH_REGISTER_PORT "SSH register service"
51+
52+
accept_dst_port $CHAIN_MAINTENANCE_IN tcp $OP_GETH_P2P_PORT "op-geth P2P (TCP)"
53+
accept_dst_port $CHAIN_MAINTENANCE_IN udp $OP_GETH_P2P_PORT "op-geth P2P (UDP)"
54+
55+
###########################################################################
56+
# (4) MAINTENANCE_OUT: Outbound rules for Maintenance Mode
57+
###########################################################################
58+
59+
# Block tx endpoint during maintenance
60+
drop_dst_ip $CHAIN_MAINTENANCE_OUT "$METADATA_BOB_L2_TX_STREAM_IP" "tx stream (DROP before accept-all rules)"
61+
62+
accept_dst_port $CHAIN_MAINTENANCE_OUT udp $DNS_PORT "DNS (UDP)"
63+
accept_dst_port $CHAIN_MAINTENANCE_OUT tcp $DNS_PORT "DNS (TCP)"
64+
65+
accept_dst_port $CHAIN_MAINTENANCE_OUT tcp $HTTP_PORT "HTTP"
66+
accept_dst_port $CHAIN_MAINTENANCE_OUT tcp $HTTPS_PORT "HTTPS"
67+
68+
accept_dst_port $CHAIN_MAINTENANCE_OUT tcp $OP_GETH_P2P_PORT "op-geth P2P (TCP)"
69+
accept_dst_port $CHAIN_MAINTENANCE_OUT udp $OP_GETH_P2P_PORT "op-geth P2P (UDP)"
70+
71+
###########################################################################
72+
# (5) PRODUCTION_IN: Inbound rules for Production Mode
73+
###########################################################################
74+
75+
# None at the moment
76+
77+
###########################################################################
78+
# (6) PRODUCTION_OUT: Outbound rules for Production Mode
79+
###########################################################################
80+
81+
accept_dst_ip_port $CHAIN_PRODUCTION_OUT tcp "$METADATA_BOB_L2_TX_STREAM_IP" $HTTP_PORT "tx stream"

‎bob-l2/mkosi.extra/etc/bob/searcher-container-after-init‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# This script is sourced from init-container.sh and contains image-specific stuff
2+
# See also: bob-common/mkosi.extra/usr/bin/init-container.sh
3+
4+
exec_in_container "
5+
cat <<EOF >> /etc/hosts
6+
$METADATA_BOB_L2_TX_STREAM_IP tx-stream.internal
7+
$METADATA_BOB_L2_BACKRUNS_IP backruns.internal
8+
EOF"
9+
10+
# Copy metadata into the container for transparency
11+
#
12+
# This might be implemented as bind read-only mount in the future,
13+
# but customizing container startup per bob-l2 is too complex for now
14+
cat /etc/metadata.env | exec_in_container "cat > /etc/metadata.env"

‎bob-l2/mkosi.extra/etc/searcher-container-init-extra‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# This script is sourced from init-container.sh and contains image-specific stuff
2+
# See also: bob-common/mkosi.extra/usr/bin/init-container.sh
3+
4+
echo "Injecting static hosts into searcher container..."
5+
exec_in_container '
6+
cat <<EOF >> /etc/hosts
7+
EOF'

‎bob-l2/mkosi.extra/etc/tdx-init/disk-glob‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/dev/disk/by-path/*nvme-2

0 commit comments

Comments
 (0)