remoteenforcer_linux.go

// +build linux

package remoteenforcer

/*
#cgo CFLAGS: -Wall
#include <stdlib.h>
*/
import "C"

import (
	"context"
	"fmt"
	"os"
	"os/signal"
	"sync"
	"syscall"

	"github.com/blang/semver"
	"go.aporeto.io/trireme-lib/controller/constants"
	"go.aporeto.io/trireme-lib/controller/internal/enforcer"
	_ "go.aporeto.io/trireme-lib/controller/internal/enforcer/utils/nsenter" // nolint
	"go.aporeto.io/trireme-lib/controller/internal/enforcer/utils/rpcwrapper"
	"go.aporeto.io/trireme-lib/controller/internal/supervisor"
	provider "go.aporeto.io/trireme-lib/controller/pkg/aclprovider"
	"go.aporeto.io/trireme-lib/controller/pkg/ipsetmanager"
	"go.aporeto.io/trireme-lib/controller/pkg/packetprocessor"
	"go.aporeto.io/trireme-lib/controller/pkg/remoteenforcer/internal/client"
	reports "go.aporeto.io/trireme-lib/controller/pkg/remoteenforcer/internal/client/reportsclient"
	"go.aporeto.io/trireme-lib/controller/pkg/remoteenforcer/internal/client/statsclient"
	"go.aporeto.io/trireme-lib/controller/pkg/remoteenforcer/internal/statscollector"
	"go.aporeto.io/trireme-lib/controller/pkg/remoteenforcer/internal/tokenissuer"
	"go.aporeto.io/trireme-lib/controller/pkg/secrets"
	"go.aporeto.io/trireme-lib/policy"
	"go.uber.org/zap"
	"go.uber.org/zap/zapcore"
	"golang.org/x/sys/unix"
)

// Initialization functions as variables in order to enable testing.
var (
	createEnforcer = enforcer.New

	createSupervisor = supervisor.NewSupervisor
)

var cmdLock sync.Mutex

// newRemoteEnforcer starts a new server
func newRemoteEnforcer(
	ctx context.Context,
	cancel context.CancelFunc,
	service packetprocessor.PacketProcessor,
	rpcHandle rpcwrapper.RPCServer,
	secret string,
	statsClient client.Reporter,
	collector statscollector.Collector,
	reportsClient client.Reporter,
	tokenIssuer tokenissuer.TokenClient,
	zapConfig zap.Config,
	enforcerType policy.EnforcerType,
	agentVersion semver.Version,
) (*RemoteEnforcer, error) {

	var err error

	if collector == nil {
		collector = statscollector.NewCollector()
	}

	if statsClient == nil {
		statsClient, err = statsclient.NewStatsClient(collector)
		if err != nil {
			return nil, err
		}
	}

	if reportsClient == nil {
		reportsClient, err = reports.NewClient(collector)
		if err != nil {
			return nil, err
		}
	}

	if tokenIssuer == nil {
		tokenIssuer, err = tokenissuer.NewClient()
		if err != nil {
			return nil, err
		}

	}

	procMountPoint := os.Getenv(constants.EnvMountPoint)
	if procMountPoint == "" {
		procMountPoint = constants.DefaultProcMountPoint
	}

	ips := provider.NewGoIPsetProvider()
	aclmanager := ipsetmanager.CreateIPsetManager(ips, ips)

	return &RemoteEnforcer{
		collector:      collector,
		service:        service,
		rpcSecret:      secret,
		rpcHandle:      rpcHandle,
		procMountPoint: procMountPoint,
		statsClient:    statsClient,
		reportsClient:  reportsClient,
		ctx:            ctx,
		cancel:         cancel,
		exit:           make(chan bool),
		zapConfig:      zapConfig,
		tokenIssuer:    tokenIssuer,
		enforcerType:   enforcerType,
		aclmanager:     aclmanager,
		agentVersion:   agentVersion,
	}, nil
}

// InitEnforcer is a function called from the controller using RPC. It intializes
// data structure required by the remote enforcer
func (s *RemoteEnforcer) InitEnforcer(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	zap.L().Debug("Configuring remote enforcer")

	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = fmt.Sprintf("init message authentication failed")
		return fmt.Errorf(resp.Status)
	}
	cmdLock.Lock()
	defer cmdLock.Unlock()

	payload, ok := req.Payload.(rpcwrapper.InitRequestPayload)
	if !ok {
		resp.Status = fmt.Sprintf("invalid request payload")
		return fmt.Errorf(resp.Status)
	}

	if s.supervisor != nil || s.enforcer != nil {
		resp.Status = fmt.Sprintf("remote enforcer is already initialized")
		return fmt.Errorf(resp.Status)
	}

	var err error

	defer func() {
		if err != nil {
			s.cleanup()
		}
	}()

	if err = s.setupEnforcer(&payload); err != nil {
		resp.Status = err.Error()
		return fmt.Errorf(resp.Status)
	}

	if err = s.setupSupervisor(&payload); err != nil {
		resp.Status = err.Error()
		return fmt.Errorf(resp.Status)
	}

	if err = s.enforcer.Run(s.ctx); err != nil {
		resp.Status = err.Error()
		return fmt.Errorf(resp.Status)
	}

	if err = s.statsClient.Run(s.ctx); err != nil {
		resp.Status = err.Error()
		return fmt.Errorf(resp.Status)
	}

	if err = s.supervisor.Run(s.ctx); err != nil {
		resp.Status = err.Error()
		return fmt.Errorf(resp.Status)
	}

	if err = s.reportsClient.Run(s.ctx); err != nil {
		resp.Status = "ReportsClient" + err.Error()
		return fmt.Errorf(resp.Status)
	}

	if err = s.tokenIssuer.Run(s.ctx); err != nil {
		resp.Status = "TokenIssuer" + err.Error()
		return fmt.Errorf(resp.Status)
	}

	resp.Status = ""

	return nil
}

// Enforce this method calls the enforce method on the enforcer created during initenforcer
func (s *RemoteEnforcer) Enforce(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "enforce message auth failed"
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()

	payload, ok := req.Payload.(rpcwrapper.EnforcePayload)
	if !ok {
		resp.Status = "invalid enforcer payload"
		return fmt.Errorf(resp.Status)
	}

	plc, err := payload.Policy.ToPrivatePolicy(true)
	if err != nil {
		return err
	}

	puInfo := &policy.PUInfo{
		ContextID: payload.ContextID,
		Policy:    plc,
		Runtime:   policy.NewPURuntimeWithDefaults(),
	}

	if s.enforcer == nil || s.supervisor == nil {
		resp.Status = "enforcer not initialized - cannot enforce"
		return fmt.Errorf(resp.Status)
	}

	// If any error happens, cleanup everything on exit so that we can recover
	// by launcing a new remote.
	defer func() {
		if err != nil {
			s.cleanup()
		}
	}()

	if err = s.supervisor.Supervise(payload.ContextID, puInfo); err != nil {
		resp.Status = err.Error()
		return err
	}

	if err = s.enforcer.Enforce(payload.ContextID, puInfo); err != nil {
		resp.Status = err.Error()
		return err
	}

	resp.Status = ""

	return nil
}

// Unenforce this method calls the unenforce method on the enforcer created from initenforcer
func (s *RemoteEnforcer) Unenforce(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "unenforce message auth failed"
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()

	s.statsClient.Send() // nolint:errcheck

	payload, ok := req.Payload.(rpcwrapper.UnEnforcePayload)
	if !ok {
		resp.Status = "invalid unenforcer payload"
		return fmt.Errorf(resp.Status)
	}

	var err error

	// If any error happens, cleanup everything on exit so that we can recover
	// by launcing a new remote.
	defer func() {
		if err != nil {
			s.cleanup()
		}
	}()

	if err = s.supervisor.Unsupervise(payload.ContextID); err != nil {
		resp.Status = err.Error()
		return fmt.Errorf("unable to clean supervisor: %s", err)
	}

	if err = s.enforcer.Unenforce(payload.ContextID); err != nil {
		resp.Status = err.Error()
		return fmt.Errorf("unable to stop enforcer: %s", err)
	}

	return nil
}

// SetTargetNetworks calls the same method on the actual enforcer
func (s *RemoteEnforcer) SetTargetNetworks(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	var err error
	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "SetTargetNetworks message auth failed" //nolint
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()

	if s.enforcer == nil || s.supervisor == nil {
		return fmt.Errorf(resp.Status)
	}

	payload := req.Payload.(rpcwrapper.SetTargetNetworksPayload)

	// If any error happens, cleanup everything on exit so that we can recover
	// by launcing a new remote.
	defer func() {
		if err != nil {
			s.cleanup()
		}
	}()

	if err = s.enforcer.SetTargetNetworks(payload.Configuration); err != nil {
		return err
	}

	err = s.supervisor.SetTargetNetworks(payload.Configuration)

	return err
}

// EnforcerExit is processing messages from the remote that are requesting an exit. In this
// case we simply cancel the context.
func (s *RemoteEnforcer) EnforcerExit(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	s.cleanup()

	s.exit <- true

	return nil
}

// UpdateSecrets updates the secrets used by the remote enforcer
func (s *RemoteEnforcer) UpdateSecrets(req rpcwrapper.Request, resp *rpcwrapper.Response) error {
	var err error
	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "updatesecrets auth failed"
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()
	if s.enforcer == nil {
		return fmt.Errorf(resp.Status)
	}

	// If any error happens, cleanup everything on exit so that we can recover
	// by launcing a new remote.
	defer func() {
		if err != nil {
			s.cleanup()
		}
	}()

	payload := req.Payload.(rpcwrapper.UpdateSecretsPayload)
	s.secrets, err = secrets.NewSecrets(payload.Secrets)
	if err != nil {
		return err
	}

	err = s.enforcer.UpdateSecrets(s.secrets)

	return err
}

// EnableDatapathPacketTracing enable nfq datapath packet tracing
func (s *RemoteEnforcer) EnableDatapathPacketTracing(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "enable datapath packet tracing auth failed"
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()

	payload := req.Payload.(rpcwrapper.EnableDatapathPacketTracingPayLoad)

	if err := s.enforcer.EnableDatapathPacketTracing(context.TODO(), payload.ContextID, payload.Direction, payload.Interval); err != nil {
		resp.Status = err.Error()
		return err
	}

	resp.Status = ""
	return nil
}

// EnableIPTablesPacketTracing enables iptables trace packet tracing
func (s *RemoteEnforcer) EnableIPTablesPacketTracing(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "enable iptable packet tracing auth failed"
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()

	payload := req.Payload.(rpcwrapper.EnableIPTablesPacketTracingPayLoad)

	if err := s.supervisor.EnableIPTablesPacketTracing(context.Background(), payload.ContextID, payload.Interval); err != nil {
		resp.Status = err.Error()
		return err
	}

	resp.Status = ""
	return nil
}

// Ping runs ping to the given config
func (s *RemoteEnforcer) Ping(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "ping auth failed"
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()

	payload := req.Payload.(rpcwrapper.PingPayload)

	if err := s.enforcer.Ping(context.TODO(), payload.ContextID, payload.PingConfig); err != nil {
		resp.Status = err.Error()
		return err
	}

	resp.Status = ""
	return nil
}

// SetLogLevel sets log level.
func (s *RemoteEnforcer) SetLogLevel(req rpcwrapper.Request, resp *rpcwrapper.Response) error {

	if !s.rpcHandle.CheckValidity(&req, s.rpcSecret) {
		resp.Status = "set log level auth failed"
		return fmt.Errorf(resp.Status)
	}

	cmdLock.Lock()
	defer cmdLock.Unlock()
	if s.enforcer == nil {
		return fmt.Errorf(resp.Status)
	}

	payload := req.Payload.(rpcwrapper.SetLogLevelPayload)

	if payload.Level != "" && s.logLevel != payload.Level {
		s.configureZapLogLevel(payload.Level)

		if err := s.enforcer.SetLogLevel(payload.Level); err != nil {
			resp.Status = err.Error()
			return err
		}
	}

	resp.Status = ""
	return nil
}

func (s *RemoteEnforcer) configureZapLogLevel(level constants.LogLevel) {

	zapLogLevel := triremeLogLevelToZapLogLevel(level)
	s.zapConfig.Level = zap.NewAtomicLevelAt(zapLogLevel)
	l, err := s.zapConfig.Build()
	if err != nil {
		zap.L().Warn("unable to build logger", zap.Error(err))
		return
	}

	zap.ReplaceGlobals(l)
	s.logLevel = level
}

// triremeLogLevelToZapLogLevel converts trireme log level to zap log level.
func triremeLogLevelToZapLogLevel(level constants.LogLevel) zapcore.Level {

	switch level {
	case constants.Debug, constants.Trace:
		return zap.DebugLevel
	case constants.Error:
		return zap.ErrorLevel
	case constants.Info:
		return zap.InfoLevel
	case constants.Warn:
		return zap.WarnLevel
	default:
		return zap.InfoLevel
	}
}

// setup an enforcer
func (s *RemoteEnforcer) setupEnforcer(payload *rpcwrapper.InitRequestPayload) error {

	var err error

	s.secrets, err = secrets.NewSecrets(payload.Secrets)
	if err != nil {
		return err
	}

	// we are usually always starting RemoteContainer enforcers,
	// however, if envoy is requested, we change the mode to RemoteContainerEnvoyAuthorizer
	mode := constants.RemoteContainer
	if s.enforcerType == policy.EnvoyAuthorizerEnforcer {
		mode = constants.RemoteContainerEnvoyAuthorizer
	}

	if s.enforcer, err = createEnforcer(
		payload.MutualAuth,
		payload.FqConfig,
		s.collector,
		s.service,
		s.secrets,
		payload.ServerID,
		payload.Validity,
		mode,
		s.procMountPoint,
		payload.ExternalIPCacheTimeout,
		payload.PacketLogs,
		payload.Configuration,
		s.tokenIssuer,
		payload.BinaryTokens,
		s.aclmanager,
		payload.IsBPFEnabled,
		s.agentVersion,
	); err != nil || s.enforcer == nil {
		return fmt.Errorf("Error while initializing remote enforcer, %s", err)
	}

	return nil
}

func (s *RemoteEnforcer) setupSupervisor(payload *rpcwrapper.InitRequestPayload) error {

	// we are usually always starting RemoteContainer enforcers,
	// however, if envoy is requested, we change the mode to RemoteContainerEnvoyAuthorizer
	mode := constants.RemoteContainer
	if s.enforcerType == policy.EnvoyAuthorizerEnforcer {
		mode = constants.RemoteContainerEnvoyAuthorizer
	}

	h, err := createSupervisor(
		s.collector,
		s.enforcer,
		mode,
		payload.Configuration,
		s.service,
		s.aclmanager,
		payload.IPv6Enabled,
	)
	if err != nil {
		return fmt.Errorf("unable to setup supervisor: %s", err)
	}
	s.supervisor = h

	return nil
}

// cleanup cleans all the acls and any state of the local enforcer.
func (s *RemoteEnforcer) cleanup() {

	if s.supervisor != nil {
		if err := s.supervisor.CleanUp(); err != nil {
			zap.L().Error("unable to clean supervisor state", zap.Error(err))
		}
	}

	if s.enforcer != nil {
		if err := s.enforcer.CleanUp(); err != nil {
			zap.L().Error("unable to clean enforcer state", zap.Error(err))
		}
	}

	if s.service != nil {
		if err := s.service.Stop(); err != nil {
			zap.L().Error("unable to clean service state", zap.Error(err))
		}
	}

	s.cancel()
}

// LaunchRemoteEnforcer launches a remote enforcer
func LaunchRemoteEnforcer(service packetprocessor.PacketProcessor, zapConfig zap.Config, agentVersion semver.Version) error {

	// Before doing anything validate that we are in the right namespace.
	if err := validateNamespace(); err != nil {
		return err
	}

	ctx, cancelMainCtx := context.WithCancel(context.Background())
	defer cancelMainCtx()

	namedPipe := os.Getenv(constants.EnvContextSocket)
	secret := os.Getenv(constants.EnvRPCClientSecret)
	if secret == "" {
		zap.L().Fatal("No secret found")
	}

	flag := unix.SIGHUP
	if err := unix.Prctl(unix.PR_SET_PDEATHSIG, uintptr(flag), 0, 0, 0); err != nil {
		return err
	}

	enforcerType, err := policy.EnforcerTypeFromString(os.Getenv(constants.EnvEnforcerType))
	if err != nil {
		return err
	}

	rpcHandle := rpcwrapper.NewRPCServer()
	re, err := newRemoteEnforcer(ctx, cancelMainCtx, service, rpcHandle, secret, nil, nil, nil, nil, zapConfig, enforcerType, agentVersion)
	if err != nil {
		return err
	}

	go func() {
		if err := rpcHandle.StartServer(ctx, "unix", namedPipe, re); err != nil {
			zap.L().Fatal("Failed to start the server", zap.Error(err))
		}
	}()

	c := make(chan os.Signal, 1)
	signal.Notify(c, syscall.SIGTERM, syscall.SIGINT, syscall.SIGQUIT)

	select {

	case <-c:
		re.cleanup()

	case <-re.exit:
		zap.L().Info("Remote enforcer exiting ...")
	}

	return nil
}

// getCEnvVariable returns an environment variable set in the c context
func getCEnvVariable(name string) string {

	val := C.getenv(C.CString(name))
	if val == nil {
		return ""
	}

	return C.GoString(val)
}

func validateNamespace() error {
	// Check if successfully switched namespace
	nsEnterState := getCEnvVariable(constants.EnvNsenterErrorState)
	nsEnterLogMsg := getCEnvVariable(constants.EnvNsenterLogs)
	if nsEnterState != "" {
		return fmt.Errorf("nsErr: %s nsLogs: %s", nsEnterState, nsEnterLogMsg)
	}

	return nil
}