move sidecar into uvm and remove hacks

Signed-off-by: Kirtana Ashok <[email protected]>

cmd/gcs-sidecar/main.go

@@ -170,16 +170,31 @@ func main() {
 		log.Printf("unexpected num of args: %v", len(os.Args))
 		return
 	}
-	uvmID, err := guid.FromString(os.Args[1])
+	/*
+		uvmID, err := guid.FromString(os.Args[1])
+		if err != nil {
+			log.Printf("error getting guid from string %v", os.Args[1])
+			return
+		}
+	*/
+
+	ctx := context.Background()
+	// 2. Setup connection with hcsshim external gcs connection
+	hvsockAddr := &winio.HvsockAddr{
+		VMID:      gcs.HV_GUID_PARENT,
+		ServiceID: gcs.WindowsSidecarGcsHvsockServiceID,
+	}
+	log.Printf("Dialing to hcsshim external bridge at address %v", hvsockAddr)
+
+	shimCon, err := winio.Dial(ctx, hvsockAddr)
 	if err != nil {
-		log.Printf("error getting guid from string %v", os.Args[1])
+		log.Printf("Error dialing hcsshim external bridge at address %v", hvsockAddr)
 		return
 	}
 
-	ctx := context.Background()
 	// 1. Start external server to connect with inbox GCS
 	listener, err := winio.ListenHvsock(&winio.HvsockAddr{
-		VMID: uvmID,
+		VMID: gcs.HV_GUID_LOOPBACK, // uvmID,
 		// TODO: Following line is commented out only for POC as we want to
 		// start gcs-sidecar.exe on the host (external to uvm).
 		// The VMID needs to be replaces with HV_GUID_PARENT in the
@@ -201,19 +216,6 @@ func main() {
 		return
 	}
 
-	// 2. Setup connection with hcsshim external gcs connection
-	hvsockAddr := &winio.HvsockAddr{
-		VMID:      gcs.HV_GUID_LOOPBACK,
-		ServiceID: gcs.WindowsSidecarGcsHvsockServiceID,
-	}
-	log.Printf("Dialing to hcsshim external bridge at address %v", hvsockAddr)
-
-	shimCon, err := winio.Dial(ctx, hvsockAddr)
-	if err != nil {
-		log.Printf("Error dialing hcsshim external bridge at address %v", hvsockAddr)
-		return
-	}
-
 	// set up our initial stance policy enforcer
 	var initialEnforcer windowssecuritypolicy.SecurityPolicyEnforcer
 	initialPolicyStance := "allow"

internal/uvm/create_wcow.go

@@ -66,27 +66,39 @@ func NewDefaultOptionsWCOW(id, owner string) *OptionsWCOW {
 func (uvm *UtilityVM) startExternalGcsListener(ctx context.Context) error {
 	log.G(ctx).WithField("vmID", uvm.runtimeID).Debug("Using external GCS bridge")
 
-	l, err := winio.ListenHvsock(&winio.HvsockAddr{
-		// 1. TODO:
-		// Following line is only temporary for POC and ease of developement.
-		// "VMID: gcs.HV_GUID_LOOPBACK" means that we are trying to start sidecar
-		// outside of the UVM, that is in the host itself. This is only for
-		// easy developement.
-		VMID: gcs.HV_GUID_LOOPBACK,
-		// ORIGINAL: uvm.runtimeID,
-		ServiceID: gcs.WindowsSidecarGcsHvsockServiceID,
-		// 2. TODO:
-		// Following line can be uncommented after POC to ensure that
-		// hcsshim connects to gcs-sidecar.exe GUID and NOT to the windows GCS
-		// directly and this change should ONLY be for C-WCOW cases.
-		// We can base the decision of which GUID the external GCS listener should
-		// connect to based on annotations.WindowsSecurityPolicy annotation in pod.json.
-		// gcs.WindowsGcsHvsockServiceID,
-	})
-	if err != nil {
-		return err
+	if uvm.WCOWconfidentialUVMOptions.WCOWSecurityPolicy != "" {
+		l, err := winio.ListenHvsock(&winio.HvsockAddr{
+			// 1. TODO:
+			// Following line is only temporary for POC and ease of developement.
+			// "VMID: gcs.HV_GUID_LOOPBACK" means that we are trying to start sidecar
+			// outside of the UVM, that is in the host itself. This is only for
+			// easy developement.
+			VMID:      uvm.runtimeID,
+			ServiceID: gcs.WindowsSidecarGcsHvsockServiceID,
+			// 2. TODO:
+			// Following line can be uncommented after POC to ensure that
+			// hcsshim connects to gcs-sidecar.exe GUID and NOT to the windows GCS
+			// directly and this change should ONLY be for C-WCOW cases.
+			// We can base the decision of which GUID the external GCS listener should
+			// connect to based on annotations.WindowsSecurityPolicy annotation in pod.json.
+			// gcs.WindowsGcsHvsockServiceID,
+		})
+		if err != nil {
+			return err
+		}
+
+		uvm.gcListener = l
+	} else { // non confidential case
+		l, err := winio.ListenHvsock(&winio.HvsockAddr{
+			VMID:      uvm.runtimeID,
+			ServiceID: gcs.WindowsGcsHvsockServiceID,
+		})
+		if err != nil {
+			return err
+		}
+
+		uvm.gcListener = l
 	}
-	uvm.gcListener = l
 	return nil
 }
 

internal/uvm/start.go

@@ -11,9 +11,6 @@ import (
 	"fmt"
 	"io"
 	"net"
-	"os"
-	"os/exec"
-	"syscall"
 	"time"
 
 	"github.com/sirupsen/logrus"
@@ -254,28 +251,29 @@ func (uvm *UtilityVM) Start(ctx context.Context) (err error) {
 		// development. After dev work, it can be easily tested
 		// by minor tweaks to hvsockAddress to run inside the uvm
 		// + inbox gcs to listen on HV_SOCK_LOOPBACK.
-		sidecarPath := "C:\\gcs-sidecar.exe"
-		//sidecarCmd := fmt.Sprintf("%s %s", sidecarPath, uvm.runtimeID)
-		cmd := exec.Command(sidecarPath, uvm.runtimeID.String())
-
-		// Set the Pdeathsig field to 0 to prevent the subprocess from being terminated
-		// when the parent process exits
-		cmd.SysProcAttr = &syscall.SysProcAttr{
-			ParentProcess: 0,
-		}
-		// Redirect stdout to a file
-		outfile, err := os.Create("C:\\gcs-sidecar-logs-redirect.log")
-		if err != nil {
-			return fmt.Errorf("error create sidecar log file")
-		}
-		// defer outfile.Close()
-		cmd.Stdout = outfile
-
-		err = cmd.Start()
-		if err != nil {
-			return fmt.Errorf("failed to do start gcs-sidecar: %w", err)
-		}
+		/*
+			sidecarPath := "C:\\gcs-sidecar.exe"
+			//sidecarCmd := fmt.Sprintf("%s %s", sidecarPath, uvm.runtimeID)
+			cmd := exec.Command(sidecarPath, uvm.runtimeID.String())
+
+			// Set the Pdeathsig field to 0 to prevent the subprocess from being terminated
+			// when the parent process exits
+			cmd.SysProcAttr = &syscall.SysProcAttr{
+				ParentProcess: 0,
+			}
+			// Redirect stdout to a file
+			outfile, err := os.Create("C:\\gcs-sidecar-logs-redirect.log")
+			if err != nil {
+				return fmt.Errorf("error create sidecar log file")
+			}
+			// defer outfile.Close()
+			cmd.Stdout = outfile
 
+			err = cmd.Start()
+			if err != nil {
+				return fmt.Errorf("failed to do start gcs-sidecar: %w", err)
+			}
+		*/
 		// Accept the GCS connection.
 		conn, err := uvm.acceptAndClose(ctx, uvm.gcListener)
 		uvm.gcListener = nil