Virtualize broker TCP ports

dev_bench/src/main.rs

@@ -712,15 +712,20 @@ fn run_rewritten_iperf3(ctx: BenchCtx<'_>) -> Result<()> {
         let client_sh = xshell::Shell::new()?;
         let max_server_attempts = 5;
         let max_client_attempts = 50;
+        let guest_port = "5201";
         let mut last_failure = "sandboxed server did not become ready".to_owned();
 
         for server_attempt in 1..=max_server_attempts {
-            let port = TcpListener::bind((Ipv4Addr::LOCALHOST, 0))?
+            let host_port = TcpListener::bind((Ipv4Addr::LOCALHOST, 0))?
                 .local_addr()?
                 .port()
                 .to_string();
             let mut server_command = std::process::Command::new(&broker);
             server_command
+                .arg("--broker-ipv4-address")
+                .arg("127.0.0.1")
+                .arg("--tcp-port-mapping")
+                .arg(format!("{host_port}:{guest_port}"))
                 .arg("--runner")
                 .arg(&runner)
                 .arg("--")
@@ -733,7 +738,7 @@ fn run_rewritten_iperf3(ctx: BenchCtx<'_>) -> Result<()> {
                 ])
                 .arg(&tar_file)
                 .arg(&iperf3_rewritten)
-                .args(["-s", "-1", "-B", "127.0.0.1", "-p", &port]);
+                .args(["-s", "-1", "-B", "127.0.0.1", "-p", guest_port]);
             if COMMAND_EXECUTION_IS_QUIET.load(Relaxed) {
                 server_command
                     .stdout(std::process::Stdio::null())
@@ -749,7 +754,7 @@ fn run_rewritten_iperf3(ctx: BenchCtx<'_>) -> Result<()> {
             for client_attempt in 1..=max_client_attempts {
                 let result = cmd!(
                     client_sh,
-                    "{iperf3_host} -c 127.0.0.1 -p {port} --bytes 1G --connect-timeout 50"
+                    "{iperf3_host} -c 127.0.0.1 -p {host_port} --bytes 1G --connect-timeout 50"
                 )
                 .quiet()
                 .ignore_stdout()

litebox_broker_core/src/lib.rs

@@ -40,7 +40,7 @@ pub use policy::{
 };
 use session::ObjectReference;
 pub use session::{BrokerSession, CallerCredential, ObjectRights, SessionId};
-use socket::SocketProvider;
+use socket::{BrokerSocketPorts, SocketProvider, TcpPortMappingConfig};
 
 /// BrokerCore result type.
 pub type Result<T> = core::result::Result<T, BrokerError>;
@@ -117,6 +117,8 @@ pub struct BrokerCore {
     pub(crate) reserved_pipe_capacity: Arc<AtomicUsize>,
     pub(crate) reserved_sockets: Arc<AtomicUsize>,
     pub(crate) socket_provider: Arc<dyn SocketProvider>,
+    pub(crate) tcp_port_mapping_config: TcpPortMappingConfig,
+    pub(crate) socket_ports: BrokerSocketPorts,
 }
 
 static BROKER_CORE_CREATED: AtomicBool = AtomicBool::new(false);
@@ -133,6 +135,8 @@ impl BrokerCore {
         limits: BrokerCoreLimits,
         socket_provider: Arc<dyn SocketProvider>,
     ) -> Result<Self> {
+        let tcp_port_mapping_config =
+            TcpPortMappingConfig::new(socket_provider.tcp_port_mappings())?;
         BROKER_CORE_CREATED
             .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
             .map_err(|_| BrokerError::BrokerCoreAlreadyExists)?;
@@ -147,6 +151,8 @@ impl BrokerCore {
             reserved_pipe_capacity: Arc::new(AtomicUsize::new(0)),
             reserved_sockets: Arc::new(AtomicUsize::new(0)),
             socket_provider,
+            tcp_port_mapping_config,
+            socket_ports: BrokerSocketPorts::default(),
         })
     }
 

litebox_broker_core/src/policy.rs

@@ -466,16 +466,17 @@ impl PolicyEngine {
         address: SocketAddrV4,
     ) -> Result<(), BrokerError> {
         self.principal_object_rights(caller_credential)?;
-        // Egress rules do not describe local listener authority. Socket
-        // creation admission plus this fixed loopback boundary governs binds.
-        let supported_socket = matches!(
-            (request.socket_type, request.protocol),
-            (SocketType::Stream, IpProtocol::Tcp) | (SocketType::Datagram, IpProtocol::Udp)
-        );
-        if request.address_family == AddressFamily::Ipv4
-            && supported_socket
-            && address.ip().is_loopback()
-        {
+        // Egress rules do not describe local listener authority. TCP may bind
+        // loopback for a private endpoint or unspecified for the broker's
+        // configured external interface. UDP remains loopback-only.
+        let permitted_address = match (request.socket_type, request.protocol) {
+            (SocketType::Stream, IpProtocol::Tcp) => {
+                address.ip().is_loopback() || address.ip().is_unspecified()
+            }
+            (SocketType::Datagram, IpProtocol::Udp) => address.ip().is_loopback(),
+            _ => false,
+        };
+        if request.address_family == AddressFamily::Ipv4 && permitted_address {
             Ok(())
         } else {
             Err(BrokerError::PolicyDenied)
@@ -787,5 +788,13 @@ mod tests {
             ),
             Err(BrokerError::PolicyDenied)
         );
+        assert_eq!(
+            policy.authorize_socket_bind(
+                CallerCredential::Unauthenticated,
+                IPV4_TCP,
+                address([0, 0, 0, 0], 0),
+            ),
+            Ok(())
+        );
     }
 }