feat(native): add JD read-only anchor HTTP service
This commit is contained in:
parent
22b834eb79
commit
f31c33e77a
7 changed files with 476 additions and 4 deletions
|
|
@ -43,6 +43,7 @@ while IFS= read -r argument; do layout_args+=("${argument}"); done \
|
|||
-dGHOS_PHYSICAL_CANDIDATE=1 \
|
||||
-dGHOS_NATIVE_RESIDENT=1 \
|
||||
-dGHOS_NATIVE_FINAL_RESIDENT=1 \
|
||||
-dGHOS_NATIVE_ANCHOR_SERVICE=1 \
|
||||
"${native_root}/boot.asm" \
|
||||
-o guanghu-os-x86_64-bios-final-resident.img
|
||||
)
|
||||
|
|
|
|||
|
|
@ -15,6 +15,17 @@ COMMIT_MAGIC = b"HLDP-CODE-COMMIT"
|
|||
BRANCH_MAGIC = b"HLDP-BRANCH-MOVE"
|
||||
RECOVERY_MAGIC = b"HLDP-RECOVER-OS!"
|
||||
NATIVE_ACK_MAGIC = b"HLDP-NATIVE-ACK!"
|
||||
ANCHOR_PORT = 3922
|
||||
ANCHOR_CLIENT_PORT = 40392
|
||||
ANCHOR_CLIENT_SEQUENCE = 0x10203040
|
||||
ANCHOR_BODY = (
|
||||
b'{"schema":"guanghu.native-public-anchor/v1",'
|
||||
b'"anchor_id":"GLW-PUBLIC-NAV-ANCHOR-001",'
|
||||
b'"entry_path":"LL-CMPN-0001","world_node_id":"SYS-GLW-0001",'
|
||||
b'"repository_id":"REPO-012","branch":"main",'
|
||||
b'"code_entry":"https://guanghulab.com/code/bingshuo/guanghu-ice-heart",'
|
||||
b'"runtime":"GUANGHU_OS_NATIVE"}'
|
||||
)
|
||||
|
||||
|
||||
def checksum(payload: bytes) -> int:
|
||||
|
|
@ -88,6 +99,62 @@ def authenticated_reply(frame: bytes, response_capability: bytes = NATIVE_ACK_MA
|
|||
return bytes(reply)
|
||||
|
||||
|
||||
def tcp_frame(
|
||||
flags: int,
|
||||
sequence: int,
|
||||
acknowledgement: int,
|
||||
payload: bytes = b"",
|
||||
) -> bytes:
|
||||
tcp = bytearray(
|
||||
struct.pack(
|
||||
"!HHIIBBHHH",
|
||||
ANCHOR_CLIENT_PORT,
|
||||
ANCHOR_PORT,
|
||||
sequence,
|
||||
acknowledgement,
|
||||
5 << 4,
|
||||
flags,
|
||||
16384,
|
||||
0,
|
||||
0,
|
||||
)
|
||||
+ payload
|
||||
)
|
||||
pseudo = GATEWAY_IP + GUEST_IP + b"\0\x06" + struct.pack("!H", len(tcp))
|
||||
tcp[16:18] = struct.pack("!H", checksum(pseudo + tcp))
|
||||
ip = bytearray(
|
||||
b"\x45\x00"
|
||||
+ struct.pack("!H", 20 + len(tcp))
|
||||
+ b"\x47\x41\x00\x00\x40\x06\x00\x00"
|
||||
+ GATEWAY_IP
|
||||
+ GUEST_IP
|
||||
)
|
||||
ip[10:12] = struct.pack("!H", checksum(ip))
|
||||
return GUEST_MAC + PEER_MAC + b"\x08\x00" + bytes(ip) + bytes(tcp)
|
||||
|
||||
|
||||
def verify_anchor_tcp(frame: bytes, expected_flags: int) -> tuple[int, int, bytes]:
|
||||
assert frame[0:6] == PEER_MAC
|
||||
assert frame[6:12] == GUEST_MAC
|
||||
assert frame[12:14] == b"\x08\x00"
|
||||
assert frame[23] == 6
|
||||
assert frame[26:30] == GUEST_IP
|
||||
assert frame[30:34] == GATEWAY_IP
|
||||
assert checksum(frame[14:34]) == 0
|
||||
total_length = int.from_bytes(frame[16:18], "big")
|
||||
tcp = frame[34 : 14 + total_length]
|
||||
assert int.from_bytes(tcp[0:2], "big") == ANCHOR_PORT
|
||||
assert int.from_bytes(tcp[2:4], "big") == ANCHOR_CLIENT_PORT
|
||||
assert tcp[13] == expected_flags
|
||||
pseudo = GUEST_IP + GATEWAY_IP + b"\0\x06" + struct.pack("!H", len(tcp))
|
||||
assert checksum(pseudo + tcp) == 0
|
||||
return (
|
||||
int.from_bytes(tcp[4:8], "big"),
|
||||
int.from_bytes(tcp[8:12], "big"),
|
||||
tcp[20:],
|
||||
)
|
||||
|
||||
|
||||
def main() -> None:
|
||||
global GUEST_IP, GATEWAY_IP, RELAY_IP
|
||||
parser = argparse.ArgumentParser()
|
||||
|
|
@ -98,6 +165,7 @@ def main() -> None:
|
|||
parser.add_argument("--final-resident", action="store_true")
|
||||
parser.add_argument("--recovery-token-file")
|
||||
parser.add_argument("--login-only", action="store_true")
|
||||
parser.add_argument("--anchor-http", action="store_true")
|
||||
parser.add_argument("--guest-ip", default="172.16.0.6")
|
||||
parser.add_argument("--peer-ip", default="172.16.0.1")
|
||||
parser.add_argument("--relay-ip", default="43.153.193.169")
|
||||
|
|
@ -127,6 +195,10 @@ def main() -> None:
|
|||
commit_verified = False
|
||||
branch_verified = False
|
||||
recovery_verified = False
|
||||
anchor_syn_sent = False
|
||||
anchor_syn_ack_verified = False
|
||||
anchor_get_sent = False
|
||||
anchor_http_verified = False
|
||||
|
||||
while time.monotonic() < deadline:
|
||||
try:
|
||||
|
|
@ -139,6 +211,36 @@ def main() -> None:
|
|||
continue
|
||||
if frame[12:14] != b"\x08\x00":
|
||||
continue
|
||||
if frame[23] == 6:
|
||||
if not anchor_syn_ack_verified:
|
||||
server_sequence, acknowledgement, payload = verify_anchor_tcp(frame, 0x12)
|
||||
assert acknowledgement == ANCHOR_CLIENT_SEQUENCE + 1
|
||||
assert payload == b""
|
||||
anchor_syn_ack_verified = True
|
||||
request = (
|
||||
b"GET /v1/anchor HTTP/1.1\r\n"
|
||||
b"Host: native.guanghulab.com\r\n"
|
||||
b"Connection: close\r\n\r\n"
|
||||
)
|
||||
peer.sendto(
|
||||
tcp_frame(
|
||||
0x18,
|
||||
ANCHOR_CLIENT_SEQUENCE + 1,
|
||||
server_sequence + 1,
|
||||
request,
|
||||
),
|
||||
qemu,
|
||||
)
|
||||
anchor_get_sent = True
|
||||
continue
|
||||
_, acknowledgement, payload = verify_anchor_tcp(frame, 0x19)
|
||||
assert acknowledgement > ANCHOR_CLIENT_SEQUENCE + 1
|
||||
header, body = payload.split(b"\r\n\r\n", 1)
|
||||
assert b"HTTP/1.1 200 OK" in header
|
||||
assert b"Content-Length: 286" in header
|
||||
assert body == ANCHOR_BODY
|
||||
anchor_http_verified = True
|
||||
continue
|
||||
sequence = int.from_bytes(frame[40:42], "big")
|
||||
if sequence <= 3:
|
||||
magic = LOGIN_MAGIC
|
||||
|
|
@ -164,7 +266,11 @@ def main() -> None:
|
|||
peer.sendto(ordinary_reply(frame), qemu)
|
||||
time.sleep(0.05)
|
||||
response_capability = NATIVE_ACK_MAGIC
|
||||
if args.final_resident and resident_login_count >= 3:
|
||||
if (
|
||||
args.final_resident
|
||||
and resident_login_count >= 3
|
||||
and (not args.anchor_http or anchor_http_verified)
|
||||
):
|
||||
response_capability = recovery_capability
|
||||
recovery_verified = True
|
||||
reply = authenticated_reply(frame, response_capability)
|
||||
|
|
@ -172,11 +278,19 @@ def main() -> None:
|
|||
peer.sendto(reply, qemu)
|
||||
if repetition < 3:
|
||||
time.sleep(0.01)
|
||||
if (
|
||||
args.anchor_http
|
||||
and args.final_resident
|
||||
and sequence == 6
|
||||
and not anchor_syn_sent
|
||||
):
|
||||
peer.sendto(tcp_frame(0x02, ANCHOR_CLIENT_SEQUENCE, 0), qemu)
|
||||
anchor_syn_sent = True
|
||||
|
||||
terminal = (
|
||||
sequence == 3
|
||||
if args.login_only
|
||||
else recovery_verified
|
||||
else recovery_verified and (not args.anchor_http or anchor_http_verified)
|
||||
if args.final_resident
|
||||
else sequence == 16
|
||||
if args.resident
|
||||
|
|
@ -199,6 +313,10 @@ def main() -> None:
|
|||
f"resident_login_reply_count: {resident_login_count}\n"
|
||||
f"recovery_reply_verified: {str(recovery_verified).lower()}\n"
|
||||
f"final_resident_control: {str(args.final_resident).lower()}\n"
|
||||
f"anchor_syn_sent: {str(anchor_syn_sent).lower()}\n"
|
||||
f"anchor_syn_ack_verified: {str(anchor_syn_ack_verified).lower()}\n"
|
||||
f"anchor_get_sent: {str(anchor_get_sent).lower()}\n"
|
||||
f"anchor_http_verified: {str(anchor_http_verified).lower()}\n"
|
||||
"recovery_selected_by_native: false\n"
|
||||
"login_magic: HLDP-GHOS-LOGIN!\n"
|
||||
)
|
||||
|
|
|
|||
|
|
@ -50,6 +50,7 @@ python3 "${source_root}/scripts/qemu-native-net-peer.py" \
|
|||
--qemu-port "${qemu_port}" \
|
||||
--receipt "${test_root}/peer.hldp" \
|
||||
--final-resident \
|
||||
--anchor-http \
|
||||
--recovery-token-file "${token_file}" >"${test_root}/peer.log" 2>&1 &
|
||||
peer_pid=$!
|
||||
set +e
|
||||
|
|
@ -71,9 +72,13 @@ wait "${peer_pid}"
|
|||
peer_pid=
|
||||
|
||||
grep -q '^final_resident_control: true$' "${test_root}/peer.hldp"
|
||||
grep -q '^resident_login_reply_count: 3$' "${test_root}/peer.hldp"
|
||||
awk -F': ' '$1 == "resident_login_reply_count" { found = 1; if ($2 < 3) exit 1 } END { if (!found) exit 1 }' \
|
||||
"${test_root}/peer.hldp"
|
||||
grep -q '^recovery_reply_verified: true$' "${test_root}/peer.hldp"
|
||||
grep -q '^recovery_selected_by_native: false$' "${test_root}/peer.hldp"
|
||||
grep -q '^anchor_syn_ack_verified: true$' "${test_root}/peer.hldp"
|
||||
grep -q '^anchor_http_verified: true$' "${test_root}/peer.hldp"
|
||||
grep -q '^GHOS_NATIVE_ANCHOR_HTTP=RESPONSE_TX' "${test_root}/serial.log"
|
||||
grep -q '^GHOS_NATIVE_RECOVERY_BEACON=WRITE_READ_VERIFIED' "${test_root}/serial.log"
|
||||
grep -q '^GHOS_DISK_PROOF_OBSERVED_AFTER_RESET=LBA134' "${test_root}/serial.log"
|
||||
|
||||
|
|
@ -158,6 +163,15 @@ resident_runtime:
|
|||
code_commit_reply_verified: true
|
||||
branch_move_reply_verified: true
|
||||
sustained_login_replies_before_recovery: 2
|
||||
native_anchor_service:
|
||||
tcp_syn_ack: PASS_100
|
||||
http_get_v1_anchor: PASS_100
|
||||
response_schema: guanghu.native-public-anchor/v1
|
||||
anchor_id: GLW-PUBLIC-NAV-ANCHOR-001
|
||||
entry_path: LL-CMPN-0001
|
||||
world_node_id: SYS-GLW-0001
|
||||
repository_id: REPO-012
|
||||
runtime: GUANGHU_OS_NATIVE
|
||||
recovery_control:
|
||||
selected_by_native_runtime: false
|
||||
per_deployment_capability_required: true
|
||||
|
|
@ -167,6 +181,9 @@ recovery_control:
|
|||
boundary:
|
||||
qemu_capability: 100
|
||||
physical_server_capability: 0
|
||||
native_anchor_http_qemu_capability: 100
|
||||
native_anchor_http_physical_capability: 0
|
||||
code_channel_service_equivalence: 0
|
||||
final_native_residency_proven: false
|
||||
next_action: PHYSICAL_ONE_TIME_FINAL_RESIDENCY_AND_PROTECTED_RECOVERY_GATE
|
||||
next_action: PHYSICAL_ONE_TIME_NATIVE_ANCHOR_HTTP_GATE_WITH_PROTECTED_RECOVERY
|
||||
EOF
|
||||
|
|
|
|||
Loading…
Reference in a new issue