@runuai/host 0.9.147 → 0.9.149

package/lib/secrets-proxy/task-scripts.ts

@@ -0,0 +1,262 @@
+/**
+ * The root-side steps that put a task behind the secrets proxy (ADR-153 §3
+ * "Redirect" and "Trust inside the task"): the pinned-names block in
+ * /etc/hosts, the Uai-owned NAT chain, and the CA in the system store.
+ *
+ * Each is a POSIX sh script the runner runs as root inside the task —
+ * `docker exec --privileged -u root` for the chain on Docker (only that one
+ * process gets NET_ADMIN), `container exec -u root` on Apple, the sidecar
+ * itself on machines. They are reconciliations, safe to run at every start
+ * and on every change: the hosts block is rewritten between its markers,
+ * the chain's contents are replaced, and nothing Docker owns is touched.
+ *
+ * Nothing a task controls is ever interpolated: domains must be canonical
+ * and proxiable, addresses must parse, ports and users are checked, and the
+ * CA arrives on stdin, never in argv.
+ */
+
+import { canonicalHostname, isProxiableDomain } from "./hostname";
+
+export const HOSTS_BLOCK_BEGIN = "# uai secrets proxy: begin (managed by the runner; do not edit)";
+export const HOSTS_BLOCK_END = "# uai secrets proxy: end";
+/** The task-side loopback address every proxied name resolves to. */
+export const PROXY_PIN_ADDRESS = "127.0.0.2";
+export const PROXY_CHAIN = "UAI_SECRETS";
+/** Where the system store picks up local CAs. Each proxy CA gets its own
+ *  file there: `openssl rehash` skips a file holding two certificates, and a
+ *  CA must be a new file name, not new content under an old one, for
+ *  `update-ca-certificates` to re-hash at all. */
+export const TASK_CA_DIR = "/usr/local/share/ca-certificates";
+/** Every proxy CA the task trusts, in one file: what NODE_EXTRA_CA_CERTS
+ *  names. Outside TASK_CA_DIR, so the store does not take it twice. */
+export const TASK_CA_BUNDLE_PATH = "/usr/local/share/uai/secrets-proxy-ca.pem";
+
+/** The only PATH these root scripts run with, whatever the exec inherited:
+ *  root-owned system directories only. The inherited one can start with
+ *  task-writable entries (Apple's asdf shims overlay), and anything found
+ *  there would run as root. /usr/sbin and /sbin hold Debian's
+ *  update-ca-certificates and iptables. */
+export const ROOT_SCRIPT_PATH = "/usr/sbin:/usr/bin:/sbin:/bin";
+
+/** Sets the PATH (tests pass a directory of fakes ahead of the system one)
+ *  and clears loader injection for every child the script starts. */
+function rootPrelude(path: string): string {
+  return `PATH=${shellQuote(path)}; export PATH; unset LD_PRELOAD LD_AUDIT LD_LIBRARY_PATH`;
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+function checkedDomains(domains: readonly string[]): string[] {
+  const unique = new Set<string>();
+  for (const domain of domains) {
+    if (canonicalHostname(domain) !== domain || !isProxiableDomain(domain)) {
+      throw new Error("refusing to pin a domain that is not canonical and proxiable");
+    }
+    unique.add(domain);
+  }
+  return [...unique].sort();
+}
+
+/**
+ * Rewrites the marked block of `hostsPath` so each domain resolves to the
+ * pin. With no domains the block is removed. Docker bind-mounts /etc/hosts,
+ * where a rename-over fails, so the file is rewritten in place.
+ */
+export function hostsReconcileScript(
+  domains: readonly string[],
+  hostsPath = "/etc/hosts",
+  options: {
+    path?: string;
+    /**
+     * Build the file from this one instead of itself: a task's own view of
+     * the hosts on a machine, the machine's file plus the block, which the
+     * machine's file never carries. Rebuilt from it each time, so it follows
+     * the machine's changes.
+     */
+    sourcePath?: string;
+  } = {},
+): string {
+  // An AAAA lookup of a name the file only pins for IPv4 falls through to DNS
+  // and reaches the real upstream. The IPv4-mapped form answers it; a
+  // dual-stack socket connects to it over IPv4, into the same chain, and a
+  // v6-only socket fails fast rather than going around the proxy.
+  const lines = checkedDomains(domains).flatMap((domain) => [
+    `${PROXY_PIN_ADDRESS} ${domain}`,
+    `::ffff:${PROXY_PIN_ADDRESS} ${domain}`,
+  ]);
+  const block = lines.length === 0 ? [] : [HOSTS_BLOCK_BEGIN, ...lines, HOSTS_BLOCK_END];
+  const source = options.sourcePath ?? hostsPath;
+  return [
+    "set -eu",
+    rootPrelude(options.path ?? ROOT_SCRIPT_PATH),
+    `hosts=${shellQuote(hostsPath)}`,
+    `from=${shellQuote(source)}`,
+    'kept=$(mktemp) && next=$(mktemp)',
+    'trap \'rm -f "$kept" "$next"\' EXIT',
+    // Everything outside a previous block survives, byte for byte.
+    `awk -v begin=${shellQuote(HOSTS_BLOCK_BEGIN)} -v end=${shellQuote(HOSTS_BLOCK_END)} ` +
+      `'$0 == begin { skip = 1; next } $0 == end { skip = 0; next } !skip { print }' "$from" > "$kept"`,
+    `{ cat "$kept"; ${block.map((line) => `printf '%s\\n' ${shellQuote(line)}; `).join("")}} > "$next"`,
+    // A view of its own is root's, readable by all; rewritten in place, so
+    // a process that has it bind-mounted sees each change.
+    ...(source === hostsPath ? [] : ['umask 022', 'mkdir -p "$(dirname "$hosts")"']),
+    'cat "$next" > "$hosts"',
+  ].join("\n");
+}
+
+/**
+ * Replaces the contents of the Uai-owned NAT chain and makes sure OUTPUT
+ * jumps to it exactly once. TCP 443 to the pin goes to the task-local
+ * listener; on machines `uidOwner` limits it to the task user's traffic so
+ * the root sidecar's own upstream connections are never redirected. With
+ * `enabled: false` the chain is emptied (nothing is pinned any more).
+ */
+export function redirectChainScript(options: {
+  toPort: number;
+  uidOwner?: string;
+  enabled: boolean;
+  path?: string;
+  /**
+   * The task's capabilities were fixed when it was created (an Apple VM), so
+   * a root exec without NET_ADMIN proves nothing in it ever had it. Never
+   * for Docker, where NET_ADMIN comes with each privileged exec: one without
+   * it proves nothing about an earlier one.
+   */
+  netAdminFromCreation?: boolean;
+  /** Where this process's capabilities are read; a test seam. */
+  capStatusPath?: string;
+}): string {
+  const { toPort, uidOwner, enabled } = options;
+  if (!Number.isInteger(toPort) || toPort < 1 || toPort > 65_535) throw new Error("invalid redirect port");
+  if (uidOwner !== undefined && !/^[a-z_][a-z0-9_-]{0,31}$/.test(uidOwner)) throw new Error("invalid task user");
+  const owner = uidOwner === undefined ? "" : ` -m owner --uid-owner ${uidOwner}`;
+  return [
+    "set -eu",
+    rootPrelude(options.path ?? ROOT_SCRIPT_PATH),
+    // An image without iptables cannot have a chain to empty: with nothing to
+    // pin there is nothing to do, and a pin needs it.
+    "if ! command -v iptables >/dev/null 2>&1 && ! command -v iptables-legacy >/dev/null 2>&1; then",
+    `  ${enabled ? 'echo "iptables is not installed" >&2; exit 1' : "exit 0"}`,
+    "fi",
+    // Debian's iptables is the nf_tables backend; a kernel without it still
+    // has the legacy tables.
+    // Only where the task's capabilities were fixed at its creation: proof
+    // that nothing in it can ever have filled the chain, CAP_NET_ADMIN
+    // (0x1000) missing from this root exec's effective set. An Apple VM
+    // started before it was given the capability never had it: nothing to
+    // empty, and no pin possible. An unknown or malformed set proves
+    // nothing, and neither does a nat table out of reach: both go on to the
+    // tables below, which fail the step, and it is retried.
+    ...(options.netAdminFromCreation === true
+      ? [
+          `cap_eff=$(awk '$1 == "CapEff:" { print $2 }' ${options.capStatusPath === undefined ? "/proc/$$/status" : shellQuote(options.capStatusPath)} 2>/dev/null || true)`,
+          'case "$cap_eff" in',
+          "  ''|*[!0-9a-fA-F]*) ;;",
+          `  *) if [ $(( 0x$cap_eff & 0x1000 )) -eq 0 ]; then ${enabled ? 'echo "this task has no NET_ADMIN" >&2; exit 1' : "exit 0"}; fi ;;`,
+          "esac",
+        ]
+      : []),
+    'ipt=iptables',
+    'if ! iptables -t nat -S OUTPUT >/dev/null 2>&1; then ipt=iptables-legacy; fi',
+    `"$ipt" -t nat -N ${PROXY_CHAIN} 2>/dev/null || true`,
+    `"$ipt" -t nat -F ${PROXY_CHAIN}`,
+    ...(enabled
+      ? [
+          `"$ipt" -t nat -A ${PROXY_CHAIN} -d ${PROXY_PIN_ADDRESS}/32 -p tcp --dport 443${owner} ` +
+            `-j REDIRECT --to-ports ${toPort}`,
+        ]
+      : []),
+    `"$ipt" -t nat -C OUTPUT -j ${PROXY_CHAIN} 2>/dev/null || "$ipt" -t nat -I OUTPUT 1 -j ${PROXY_CHAIN}`,
+  ].join("\n");
+}
+
+/**
+ * Installs the CA bundle read from stdin — the signing CA and, inside its
+ * last 90 days, its successor — into the task's trust: one
+ * `uai-secrets-proxy-<checksum>.crt` per certificate in the system store
+ * (stale ones removed) and the whole bundle at the NODE_EXTRA_CA_CERTS path,
+ * then rebuilds the store. Anything but one or two distinct PEM certificates
+ * is refused before anything is touched; a run with nothing to change exits
+ * without rebuilding.
+ */
+export function caInstallScript(
+  options: { caDir?: string; bundlePath?: string; systemBundle?: string; path?: string } = {},
+): string {
+  const {
+    caDir = TASK_CA_DIR,
+    bundlePath = TASK_CA_BUNDLE_PATH,
+    systemBundle = "/etc/ssl/certs/ca-certificates.crt",
+    path = ROOT_SCRIPT_PATH,
+  } = options;
+  return [
+    "set -eu",
+    rootPrelude(path),
+    "umask 022",
+    `dir=${shellQuote(caDir)}`,
+    `out=${shellQuote(bundlePath)}`,
+    `bundle=${shellQuote(systemBundle)}`,
+    // Present from the first change until a rebuild succeeds: a run that
+    // removed a retired CA's file and then failed to rebuild leaves a store
+    // that still trusts it, which nothing in the files themselves shows.
+    'pending="$out.rebuilding"',
+    "stage=$(mktemp -d)",
+    'trap \'rm -rf "$stage"\' EXIT',
+    'cat > "$stage/in"',
+    'begins=$(grep -c -- "-----BEGIN CERTIFICATE-----" "$stage/in" || true)',
+    'ends=$(grep -c -- "-----END CERTIFICATE-----" "$stage/in" || true)',
+    'case "$begins" in 1|2) ;; *) echo "not a CA bundle" >&2; exit 65 ;; esac',
+    '[ "$ends" = "$begins" ] || { echo "not a CA bundle" >&2; exit 65; }',
+    // Each certificate's first base64 line carries its random serial, so it
+    // names that certificate in the system bundle.
+    'firsts=$(awk \'prev == "-----BEGIN CERTIFICATE-----" { print } { prev = $0 }\' "$stage/in")',
+    '[ "$(printf \'%s\\n\' "$firsts" | grep -c .)" = "$begins" ] || { echo "not a CA bundle" >&2; exit 65; }',
+    '[ -z "$(printf \'%s\\n\' "$firsts" | sort | uniq -d)" ] || { echo "not a CA bundle" >&2; exit 65; }',
+    // One file per certificate, named by its checksum.
+    "awk -v stage=\"$stage\" '/^-----BEGIN CERTIFICATE-----$/ { n++; file = stage \"/cert.\" n } " +
+      "file != \"\" { print > file } /^-----END CERTIFICATE-----$/ { close(file); file = \"\" }' \"$stage/in\"",
+    'names=""',
+    ': > "$stage/bundle"',
+    'for cert in "$stage"/cert.*; do',
+    '  name="uai-secrets-proxy-$(cksum < "$cert" | awk \'{ print $1 }\').crt"',
+    '  mv "$cert" "$stage/$name"',
+    '  cat "$stage/$name" >> "$stage/bundle"',
+    '  names="$names $name"',
+    "done",
+    // Up to date: the same files, no stale ones, the same NODE_EXTRA_CA_CERTS
+    // bundle, and every certificate already in the system bundle. A run that
+    // placed the files but whose rebuild failed is repaired here.
+    "current=1",
+    'for name in $names; do cmp -s "$stage/$name" "$dir/$name" || current=0; done',
+    'for existing in "$dir"/uai-secrets-proxy*.crt; do',
+    '  [ -e "$existing" ] || continue',
+    '  case " $names " in *" ${existing##*/} "*) ;; *) current=0 ;; esac',
+    "done",
+    'cmp -s "$stage/bundle" "$out" 2>/dev/null || current=0',
+    '[ -f "$bundle" ] || current=0',
+    '[ ! -e "$pending" ] || current=0',
+    'if [ "$current" = 1 ]; then',
+    '  for first in $firsts; do grep -qxF -- "$first" "$bundle" || current=0; done',
+    "fi",
+    '[ "$current" = 0 ] || exit 0',
+    'mkdir -p "$dir" "$(dirname "$out")"',
+    // A rebuild left pending by an earlier run may hide a removal: rebuild
+    // everything, as for one.
+    "fresh=0",
+    '[ ! -e "$pending" ] || fresh=1',
+    ': > "$pending"',
+    'for existing in "$dir"/uai-secrets-proxy*.crt; do',
+    '  [ -e "$existing" ] || continue',
+    '  case " $names " in *" ${existing##*/} "*) ;; *) rm -f "$existing"; fresh=1 ;; esac',
+    "done",
+    // Renamed into place, so no reader ever sees a half-written file.
+    'for name in $names; do cp "$stage/$name" "$dir/$name.uai-tmp" && mv "$dir/$name.uai-tmp" "$dir/$name"; done',
+    'cp "$stage/bundle" "$out.uai-tmp" && mv "$out.uai-tmp" "$out"',
+    // A removal alone adds no link, so the tool would neither re-hash nor
+    // clear the retired CA's links; --fresh rebuilds them all (under a
+    // second, once per rotation).
+    'if [ "$fresh" = 1 ]; then update-ca-certificates --fresh >/dev/null; else update-ca-certificates >/dev/null; fi',
+    'rm -f "$pending"',
+  ].join("\n");
+}