tiiuae · brianmcgillion · Jun 7, 2024 · Apr 29, 2024
diff --git a/modules/common/default.nix b/modules/common/default.nix
@@ -17,5 +17,6 @@
     ./systemd
     ./services
     ./programs
+    ./networking
   ];
 }
diff --git a/modules/common/networking/default.nix b/modules/common/networking/default.nix
@@ -0,0 +1,7 @@
+# Copyright 2022-2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+{
+  imports = [
+    ./hosts.nix
+  ];
+}
diff --git a/modules/common/networking/hosts.nix b/modules/common/networking/hosts.nix
@@ -0,0 +1,74 @@
+# Copyright 2022-2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+{
+  config,
+  lib,
+  ...
+}: let
+  # please note that .100. network is not
+  # reachable from ghaf-host. It's only reachable
+  # guest-to-guest.
+  # Use to .101. (debug) to access guests from host.
+  # debug network hosts are post-fixed: <hostname>-debug
+  ipBase = "192.168.100";
+  debugBase = "192.168.101";
+  hostsEntries = [
+    {
+      ip = 1;
+      name = "net-vm";
+    }
+    {
+      ip = 2;
+      name = "ghaf-host";
+    }
+    {
+      ip = 3;
+      name = "gui-vm";
+    }
+    {
+      ip = 4;
+      name = "ids-vm";
+    }
+    {
+      ip = 5;
+      name = "audio-vm";
+    }
+    {
+      ip = 10;
+      name = "admin-vm";
+    }
+    {
+      ip = 100;
+      name = "chromium-vm";
+    }
+    {
+      ip = 101;
+      name = "gala-vm";
+    }
+    {
+      ip = 102;
+      name = "zathura-vm";
+    }
+    {
+      ip = 103;
+      name = "element-vm";
+    }
+    {
+      ip = 104;
+      name = "appflowy-vm";
+    }
+  ];
+  mkHostEntry = {
+    ip,
+    name,
+  }:
+    "${ipBase}.${toString ip}\t${name}\n"
+    + lib.optionalString config.ghaf.profiles.debug.enable
+    "${debugBase}.${toString ip}\t${name}-debug\n";
+  entries = map mkHostEntry hostsEntries;
+in {
+  environment.etc.hosts = lib.mkForce {
+    text = lib.foldl' (acc: x: acc + x) "127.0.0.1 localhost\n" entries;
+    mode = "0444";
+  };
+}
diff --git a/modules/microvm/virtualization/microvm/adminvm.nix b/modules/microvm/virtualization/microvm/adminvm.nix
@@ -11,10 +11,14 @@
 
   adminvmBaseConfiguration = {
     imports = [
-      (import ./common/vm-networking.nix {inherit vmName macAddress;})
+      (import ./common/vm-networking.nix {
+        inherit config lib vmName macAddress;
+        internalIP = 10;
+      })
       ({lib, ...}: {
         ghaf = {
           users.accounts.enable = lib.mkDefault configHost.ghaf.users.accounts.enable;
+          profiles.debug.enable = lib.mkDefault configHost.ghaf.profiles.debug.enable;
           development = {
             # NOTE: SSH port also becomes accessible on the network interface
             #       that has been passed through to VM
@@ -44,15 +48,6 @@
           enable = true;
           networks."10-ethint0" = {
             matchConfig.MACAddress = macAddress;
-            addresses = [
-              {
-                addressConfig.Address = "192.168.100.10/24";
-              }
-              {
-                # IP-address for debugging subnet
-                addressConfig.Address = "192.168.101.10/24";
-              }
-            ];
             linkConfig.ActivationPolicy = "always-up";
           };
         };

diff --git a/modules/microvm/virtualization/microvm/appvm.nix b/modules/microvm/virtualization/microvm/appvm.nix
@@ -28,8 +28,9 @@
     appvmConfiguration = {
       imports = [
         (import ./common/vm-networking.nix {
-          inherit vmName;
+          inherit config lib vmName;
           inherit (vm) macAddress;
+          internalIP = index + 100;
         })
         ({
           lib,
@@ -48,6 +49,7 @@
         in {
           ghaf = {
             users.accounts.enable = lib.mkDefault configHost.ghaf.users.accounts.enable;
+            profiles.debug.enable = lib.mkDefault configHost.ghaf.profiles.debug.enable;
 
             development = {
               ssh.daemon.enable = lib.mkDefault configHost.ghaf.development.ssh.daemon.enable;

diff --git a/modules/microvm/virtualization/microvm/audiovm.nix b/modules/microvm/virtualization/microvm/audiovm.nix
@@ -10,7 +10,10 @@
   macAddress = "02:00:00:03:03:03";
   audiovmBaseConfiguration = {
     imports = [
-      (import ./common/vm-networking.nix {inherit vmName macAddress;})
+      (import ./common/vm-networking.nix {
+        inherit config lib vmName macAddress;
+        internalIP = 5;
+      })
       ({
         lib,
         pkgs,

diff --git a/modules/microvm/virtualization/microvm/common/vm-networking.nix b/modules/microvm/virtualization/microvm/common/vm-networking.nix
@@ -1,8 +1,12 @@
 # Copyright 2022-2024 TII (SSRC) and the Ghaf contributors
 # SPDX-License-Identifier: Apache-2.0
 {
+  config,
+  lib,
   vmName,
   macAddress,
+  internalIP,
+  gateway ? ["192.168.100.1"],
   ...
 }: let
   networkName = "ethint0";
@@ -35,12 +39,25 @@ in {
       matchConfig.PermanentMACAddress = macAddress;
       linkConfig.Name = networkName;
     };
-    networks."10-${networkName}" = {
-      matchConfig.MACAddress = macAddress;
-      DHCP = "yes";
-      linkConfig.RequiredForOnline = "routable";
-      linkConfig.ActivationPolicy = "always-up";
-    };
+    networks."10-${networkName}" =
+      {
+        matchConfig.MACAddress = macAddress;
+        addresses =
+          [
+            {
+              addressConfig.Address = "192.168.100.${toString internalIP}/24";
+            }
+          ]
+          ++ lib.optionals config.ghaf.profiles.debug.enable [
+            {
+              # IP-address for debugging subnet
+              addressConfig.Address = "192.168.101.${toString internalIP}/24";
+            }
+          ];
+        linkConfig.RequiredForOnline = "routable";
+        linkConfig.ActivationPolicy = "always-up";
+      }
+      // lib.optionalAttrs (gateway != []) {inherit gateway;};
   };
 
   # systemd-resolved does not support local names resolution

diff --git a/modules/microvm/virtualization/microvm/guivm.nix b/modules/microvm/virtualization/microvm/guivm.nix
@@ -12,7 +12,10 @@
   inherit (import ../../../../lib/launcher.nix {inherit pkgs lib;}) rmDesktopEntries;
   guivmBaseConfiguration = {
     imports = [
-      (import ./common/vm-networking.nix {inherit vmName macAddress;})
+      (import ./common/vm-networking.nix {
+        inherit config lib vmName macAddress;
+        internalIP = 3;
+      })
       ({
         lib,
         pkgs,
@@ -127,27 +130,18 @@
         ];
 
         # Waypipe service runs in the GUIVM and listens for incoming connections from AppVMs
-        systemd = {
-          user.services.waypipe = {
-            enable = true;
-            description = "waypipe";
-            after = ["labwc.service"];
-            serviceConfig = {
-              Type = "simple";
-              ExecStart = "${pkgs.waypipe}/bin/waypipe --vsock -s ${toString cfg.waypipePort} client";
-              Restart = "always";
-              RestartSec = "1";
-            };
-            startLimitIntervalSec = 0;
-            wantedBy = ["ghaf-session.target"];
+        systemd.user.services.waypipe = {
+          enable = true;
+          description = "waypipe";
+          after = ["labwc.service"];
+          serviceConfig = {
+            Type = "simple";
+            ExecStart = "${pkgs.waypipe}/bin/waypipe --vsock -s ${toString cfg.waypipePort} client";
+            Restart = "always";
+            RestartSec = "1";
           };
-
-          # Fixed IP-address for debugging subnet
-          network.networks."10-ethint0".addresses = [
-            {
-              addressConfig.Address = "192.168.101.3/24";
-            }
-          ];
+          startLimitIntervalSec = 0;
+          wantedBy = ["ghaf-session.target"];
         };
       })
     ];

diff --git a/modules/microvm/virtualization/microvm/idsvm/idsvm.nix b/modules/microvm/virtualization/microvm/idsvm/idsvm.nix
@@ -9,13 +9,16 @@
   configHost = config;
   vmName = "ids-vm";
   macAddress = "02:00:00:01:01:02";
-  networkName = "ethint0";
   idsvmBaseConfiguration = {
     imports = [
-      (import ../common/vm-networking.nix {inherit vmName macAddress;})
+      (import ../common/vm-networking.nix {
+        inherit config lib vmName macAddress;
+        internalIP = 4;
+      })
       ({lib, ...}: {
         ghaf = {
           users.accounts.enable = lib.mkDefault configHost.ghaf.users.accounts.enable;
+          profiles.debug.enable = lib.mkDefault configHost.ghaf.profiles.debug.enable;
 
           virtualization.microvm.idsvm.mitmproxy.enable = configHost.ghaf.virtualization.microvm.idsvm.mitmproxy.enable;
 
@@ -41,18 +44,6 @@
           ]
           ++ (lib.optional configHost.ghaf.profiles.debug.enable pkgs.tcpdump);
 
-        systemd.network = {
-          networks."10-${networkName}" = {
-            gateway = ["192.168.100.1"];
-            addresses = [
-              {
-                # IP-address for debugging subnet
-                addressConfig.Address = "192.168.101.4/24";
-              }
-            ];
-          };
-        };
-
         microvm = {
           optimize.enable = true;
           shares = [

diff --git a/modules/microvm/virtualization/microvm/netvm.nix b/modules/microvm/virtualization/microvm/netvm.nix
@@ -19,10 +19,15 @@
 
   netvmBaseConfiguration = {
     imports = [
-      (import ./common/vm-networking.nix {inherit vmName macAddress;})
+      (import ./common/vm-networking.nix {
+        inherit config lib vmName macAddress;
+        internalIP = 1;
+        gateway = [];
+      })
       ({lib, ...}: {
         ghaf = {
           users.accounts.enable = lib.mkDefault configHost.ghaf.users.accounts.enable;
+          profiles.debug.enable = lib.mkDefault configHost.ghaf.profiles.debug.enable;
           development = {
             # NOTE: SSH port also becomes accessible on the network interface
             #       that has been passed through to NetVM
@@ -34,6 +39,7 @@
             enable = true;
             withName = "netvm-systemd";
             withPolkit = true;
+            withResolved = true;
             withDebug = configHost.ghaf.profiles.debug.enable;
             withHardenedConfigs = true;
           };
@@ -54,46 +60,6 @@
         # Add simple wi-fi connection helper
         environment.systemPackages = lib.mkIf config.ghaf.profiles.debug.enable [pkgs.wifi-connector];
 
-        # Dnsmasq is used as a DHCP/DNS server inside the NetVM
-        services = {
-          dnsmasq = {
-            enable = true;
-            resolveLocalQueries = true;
-            settings = {
-              server = ["8.8.8.8"];
-              dhcp-range = ["192.168.100.2,192.168.100.254"];
-              dhcp-sequential-ip = true;
-              dhcp-authoritative = true;
-              domain = "ghaf";
-              listen-address = ["127.0.0.1,192.168.100.1"];
-              expand-hosts = true;
-              domain-needed = true;
-              bogus-priv = true;
-            };
-          };
-
-          # Disable resolved since we are using Dnsmasq
-          resolved.enable = false;
-          openssh = lib.mkIf isGuiVmEnabled configHost.ghaf.security.sshKeys.sshAuthorizedKeysCommand;
-        };
-
-        systemd.network = {
-          enable = true;
-          networks."10-ethint0" = {
-            matchConfig.MACAddress = macAddress;
-            addresses = [
-              {
-                addressConfig.Address = "192.168.100.1/24";
-              }
-              {
-                # IP-address for debugging subnet
-                addressConfig.Address = "192.168.101.1/24";
-              }
-            ];
-            linkConfig.ActivationPolicy = "always-up";
-          };
-        };
-
         microvm = {
           optimize.enable = true;
           hypervisor = "qemu";

diff --git a/packages/mitmweb-ui/default.nix b/packages/mitmweb-ui/default.nix
@@ -7,29 +7,29 @@
   ...
 }: let
   waypipePort = 1100; # TODO: remove hardcoded port number
-  idsvmIP = "192.168.100.4";
+  idsvmIP = "ids-vm";
   mitmwebUI =
     pkgs.writeShellScript
     "mitmweb-ui"
     ''
       # Create ssh-tunnel between chromium-vm and ids-vm
       ${pkgs.openssh}/bin/ssh -i /run/waypipe-ssh/id_ed25519 \
           -o StrictHostKeyChecking=no \
-          -t ghaf@chromium-vm.ghaf \
+          -t ghaf@chromium-vm \
               ${pkgs.openssh}/bin/ssh -M -S /tmp/control_socket \
               -f -N -L 8081:localhost:8081 ghaf@${idsvmIP}
       # TODO: check pipe creation failures
 
       # Launch chromium application and open mitmweb page
-      ${pkgs.openssh}/bin/ssh -i /run/waypipe-ssh/id_ed25519 -o StrictHostKeyChecking=no chromium-vm.ghaf \
+      ${pkgs.openssh}/bin/ssh -i /run/waypipe-ssh/id_ed25519 -o StrictHostKeyChecking=no chromium-vm \
           ${pkgs.waypipe}/bin/waypipe --border=#ff5733,5 --vsock -s ${toString waypipePort} server \
           chromium --enable-features=UseOzonePlatform --ozone-platform=wayland \
           http://localhost:8081
 
       # Use the control socket to close the ssh tunnel between chromium-vm and ids-vm
       ${pkgs.openssh}/bin/ssh -i /run/waypipe-ssh/id_ed25519 \
           -o StrictHostKeyChecking=no \
-          -t ghaf@chromium-vm.ghaf \
+          -t ghaf@chromium-vm \
               ${pkgs.openssh}/bin/ssh -q -S /tmp/control_socket -O exit ghaf@${idsvmIP}
     '';
 in