Skip to content

chore: Limit port 19522 (SEV key exchange server) to be called by the peer VM only #11440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
frankdavid merged 1 commit into from
Sep 4, 2026
Merged

chore: Limit port 19522 (SEV key exchange server) to be called by the peer VM only #11440

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions rs/ic_os/config/tool/src/guestos/generate_ic_config.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,9 @@ pub struct IcConfigTemplate {
pub malicious_behavior: String,
/// Already JSON-encoded: either `null` or a quoted string.
pub extra_api_boundary_node_trust_anchors_pem: String,
/// IPv6 address of the peer Guest VM (the Upgrade VM inside the Default VM
/// and vice versa).
pub peer_guest_vm_address: Option<Ipv6Addr>,
}

/// Generate IC configuration from template and guestos config
Expand Down Expand Up @@ -214,6 +217,7 @@ fn get_config_vars(guestos_config: &GuestOSConfig) -> Result<IcConfigTemplate> {
node_reward_type,
malicious_behavior: with_default(malicious_behavior, "null"),
extra_api_boundary_node_trust_anchors_pem,
peer_guest_vm_address: guestos_config.upgrade_config.peer_guest_vm_address,
})
}

Expand Down Expand Up @@ -343,6 +347,12 @@ mod tests {
assert!(!output_content.contains("{{ query_stats_epoch_length }}"));
assert!(!output_content.contains("{{ node_reward_type }}"));
assert!(!output_content.contains("{{ jaeger_addr }}"));
assert!(!output_content.contains("{{ peer_guest_vm_address }}"));

// Without a peer Guest VM address in the config, the disk encryption
// key exchange port rule is omitted entirely, leaving the port closed.
// (19522 still appears in the ic-http-adapter output blacklist.)
assert!(!output_content.contains("tcp dport { 19522 }"));

// Verify that the expected values were substituted
assert!(output_content.contains("public_address: \"\""));
Expand Down Expand Up @@ -384,6 +394,21 @@ mod tests {
assert_eq!(tracing_config.jaeger_addr, Some("".to_string()));
}

#[test]
fn test_template_substitution_with_peer_guest_vm_address() {
let mut guestos_config = create_test_guestos_config();
guestos_config.upgrade_config.peer_guest_vm_address =
Some("2001:db8::6802:94ff:feef:2978".parse().unwrap());
let template = get_config_vars(&guestos_config).unwrap();
let output_content = render_ic_config(template).unwrap();

// With a peer Guest VM address in the config, the disk encryption key
// exchange port is opened to exactly that address.
assert!(output_content.contains(
"ip6 saddr { 2001:db8::6802:94ff:feef:2978 } ct state { new } tcp dport { 19522 } accept"
));
}

fn create_test_guestos_config() -> GuestOSConfig {
GuestOSConfig {
network_settings: NetworkSettings {
Expand Down
18 changes: 15 additions & 3 deletions rs/ic_os/config/tool/templates/ic.json5.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -280,7 +280,11 @@ table ip6 filter {\n\
# DHCPv6\n\
udp dport { 546 } accept\n\
# TCP ports required for GuestOS functionality\n\
ip6 saddr { {{ ipv6_prefix }} } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 19531, 19100, 19522 } accept\n\
ip6 saddr { {{ ipv6_prefix }} } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 19531, 19100 } accept\n\
{%- if let Some(peer_guest_vm_address) = peer_guest_vm_address %}
# Disk encryption key exchange: only the peer Guest VM may connect\n\
ip6 saddr { {{ peer_guest_vm_address }} } ct state { new } tcp dport { 19522 } accept\n\
{%- endif %}
# Allow access from HostOS metrics-proxy so GuestOS metrics-proxy can proxy certain metrics to HostOS\n\
ip6 saddr { hostos } ct state { new } tcp dport { 42372 } accept\n\
# Custom templated rules\n\
Expand Down Expand Up @@ -430,7 +434,11 @@ table ip6 filter {\n\
# DHCPv6\n\
udp dport { 546 } accept\n\
# TCP ports required for GuestOS functionality\n\
ip6 saddr { {{ ipv6_prefix }} } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 9314, 19531, 19100, 19522 } accept\n\
ip6 saddr { {{ ipv6_prefix }} } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 9314, 19531, 19100 } accept\n\
{%- if let Some(peer_guest_vm_address) = peer_guest_vm_address %}
# Disk encryption key exchange: only the peer Guest VM may connect\n\
ip6 saddr { {{ peer_guest_vm_address }} } ct state { new } tcp dport { 19522 } accept\n\
{%- endif %}
# Allow access from HostOS metrics-proxy so GuestOS metrics-proxy can proxy certain metrics to HostOS\n\
ip6 saddr { hostos } ct state { new } tcp dport { 42372 } accept\n\
ip6 saddr { ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff } ct state new tcp dport 80 accept\n\
Expand Down Expand Up @@ -575,7 +583,11 @@ table ip6 filter {\n\
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept\n\
ct state { invalid } drop\n\
ct state { established, related } accept\n\
ip6 saddr { {{ ipv6_prefix }} } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100, 19522 } accept\n\
ip6 saddr { {{ ipv6_prefix }} } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100 } accept\n\
{%- if let Some(peer_guest_vm_address) = peer_guest_vm_address %}
# Disk encryption key exchange: only the peer Guest VM may connect\n\
ip6 saddr { {{ peer_guest_vm_address }} } ct state { new } tcp dport { 19522 } accept\n\
{%- endif %}
ip6 saddr { ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff } ct state new tcp dport 443 accept\n\
\n\
<<IPv6_TCP_RULES>>\n\
Expand Down
1 change: 1 addition & 0 deletions rs/orchestrator/src/firewall.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1405,6 +1405,7 @@ mod tests {
node_reward_type: "".to_string(),
malicious_behavior: "null".to_string(),
extra_api_boundary_node_trust_anchors_pem: "null".to_string(),
peer_guest_vm_address: Some("2001:db8::6802:94ff:feef:2978".parse().unwrap()),
};

let ic_json = generate_ic_config::render_ic_config(template)
Expand Down
4 changes: 3 additions & 1 deletion rs/orchestrator/testdata/nftables_assigned_cloud_engine.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,9 @@ table ip6 filter {
# DHCPv6
udp dport { 546 } accept
# TCP ports required for GuestOS functionality
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 9314, 19531, 19100, 19522 } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 9314, 19531, 19100 } accept
# Disk encryption key exchange: only the peer Guest VM may connect
ip6 saddr { 2001:db8::6802:94ff:feef:2978 } ct state { new } tcp dport { 19522 } accept
# Allow access from HostOS metrics-proxy so GuestOS metrics-proxy can proxy certain metrics to HostOS
ip6 saddr { hostos } ct state { new } tcp dport { 42372 } accept
ip6 saddr { ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff } ct state new tcp dport 80 accept
Expand Down
4 changes: 3 additions & 1 deletion rs/orchestrator/testdata/nftables_assigned_replica.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,9 @@ table ip6 filter {
# DHCPv6
udp dport { 546 } accept
# TCP ports required for GuestOS functionality
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 19531, 19100, 19522 } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 19531, 19100 } accept
# Disk encryption key exchange: only the peer Guest VM may connect
ip6 saddr { 2001:db8::6802:94ff:feef:2978 } ct state { new } tcp dport { 19522 } accept
# Allow access from HostOS metrics-proxy so GuestOS metrics-proxy can proxy certain metrics to HostOS
ip6 saddr { hostos } ct state { new } tcp dport { 42372 } accept
# Custom templated rules
Expand Down
4 changes: 3 additions & 1 deletion rs/orchestrator/testdata/nftables_boundary_node_app_subnet.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,9 @@ table ip6 filter {
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept
ct state { invalid } drop
ct state { established, related } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100, 19522 } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100 } accept
# Disk encryption key exchange: only the peer Guest VM may connect
ip6 saddr { 2001:db8::6802:94ff:feef:2978 } ct state { new } tcp dport { 19522 } accept
ip6 saddr { ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff } ct state new tcp dport 443 accept

ip6 saddr {2001:db8:85a3::8a2e:1370:7334,3fda:92b7:4c1e:8a23:7d61:2f9c:ab42:19e5,3fda:92b7:4c1e:8a23:7d61:2f9c:ab42:19e6,3fda:92b7:4c1e:8a23:7d61:2f9c:ab42:19e7} ct state { new } tcp dport {1080} accept # nodes for SOCKS proxy
Expand Down
4 changes: 3 additions & 1 deletion rs/orchestrator/testdata/nftables_boundary_node_system_subnet.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,9 @@ table ip6 filter {
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query } accept
ct state { invalid } drop
ct state { established, related } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100, 19522 } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9091, 9100, 9324, 19531, 19100 } accept
# Disk encryption key exchange: only the peer Guest VM may connect
ip6 saddr { 2001:db8::6802:94ff:feef:2978 } ct state { new } tcp dport { 19522 } accept
ip6 saddr { ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff } ct state new tcp dport 443 accept

ip6 saddr {a4c2:7f91:3db6:1e8c:5a4f:cc92:b37:6e41} ct state { new } tcp dport {1080} accept # nodes for SOCKS proxy
Expand Down
4 changes: 3 additions & 1 deletion rs/orchestrator/testdata/nftables_unassigned_cloud_engine.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,9 @@ table ip6 filter {
# DHCPv6
udp dport { 546 } accept
# TCP ports required for GuestOS functionality
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 19531, 19100, 19522 } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 19531, 19100 } accept
# Disk encryption key exchange: only the peer Guest VM may connect
ip6 saddr { 2001:db8::6802:94ff:feef:2978 } ct state { new } tcp dport { 19522 } accept
# Allow access from HostOS metrics-proxy so GuestOS metrics-proxy can proxy certain metrics to HostOS
ip6 saddr { hostos } ct state { new } tcp dport { 42372 } accept
# Custom templated rules
Expand Down
4 changes: 3 additions & 1 deletion rs/orchestrator/testdata/nftables_unassigned_replica.conf.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,9 @@ table ip6 filter {
# DHCPv6
udp dport { 546 } accept
# TCP ports required for GuestOS functionality
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 19531, 19100, 19522 } accept
ip6 saddr { ::/64 } ct state { new } tcp dport { 7070, 9090, 9091, 9100, 19531, 19100 } accept
# Disk encryption key exchange: only the peer Guest VM may connect
ip6 saddr { 2001:db8::6802:94ff:feef:2978 } ct state { new } tcp dport { 19522 } accept
# Allow access from HostOS metrics-proxy so GuestOS metrics-proxy can proxy certain metrics to HostOS
ip6 saddr { hostos } ct state { new } tcp dport { 42372 } accept
# Custom templated rules
Expand Down
8 changes: 4 additions & 4 deletions rs/tests/driver/src/driver/ic.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,10 +252,10 @@ impl InternetComputer {
///
/// Needed by tests that have a VM other than the driver talk to a node. Such
/// a VM shares the nodes' `/64`, which the GuestOS firewall already accepts
/// on 7070, 9090, 9091, 9100, 19100, 19522 and 19531 (plus 9314 on cloud
/// engines and 9324 on API boundary nodes) — so this is only required to
/// reach a node on one of the *other* whitelisted ports: 22, 2497, 4100,
/// 8080 and 19523.
/// on 7070, 9090, 9091, 9100, 19100 and 19531 (plus 9314 on cloud
/// engines and 9324 on API boundary nodes; 19522 is restricted to the peer
/// Guest VM) — so this is only required to reach a node on one of the
/// *other* whitelisted ports: 22, 2497, 4100, 8080 and 19523.
///
/// The prefixes and ports are added to the driver's, never replace them, so
/// a caller cannot lock the driver out. Ignored on the Farm backend, whose
Expand Down
1 change: 1 addition & 0 deletions rs/tests/driver/src/util.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1575,6 +1575,7 @@ pub fn get_config() -> ConfigOptional {
node_reward_type: "".to_string(),
malicious_behavior: "null".to_string(),
extra_api_boundary_node_trust_anchors_pem: "null".to_string(),
peer_guest_vm_address: None,
};

let ic_json =
Expand Down
Loading