Line data Source code
1 : #define _GNU_SOURCE
2 : #include "fd_bundle_tile_private.h"
3 : #include "fd_bundle_tile.h"
4 : #include "../fd_txn_m.h"
5 : #include "../metrics/fd_metrics.h"
6 : #include "../topo/fd_topo.h"
7 : #include "../keyguard/fd_keyload.h"
8 : #include "../../waltz/http/fd_url.h"
9 : #include "../../waltz/openssl/fd_openssl_tile.h"
10 :
11 : #if FD_HAS_OPENSSL
12 : #include <errno.h>
13 : #endif
14 :
15 : #include <dirent.h> /* opendir */
16 : #include <stdio.h> /* snprintf */
17 : #include <fcntl.h> /* F_SETFL */
18 : #include <unistd.h> /* close */
19 : #include <sys/mman.h> /* PROT_READ (seccomp) */
20 : #include <sys/uio.h> /* writev */
21 : #include <netinet/in.h> /* AF_INET */
22 : #include <netinet/tcp.h> /* TCP_FASTOPEN_CONNECT (seccomp) */
23 : #include "../../waltz/resolv/fd_netdb.h"
24 : #include "../../discof/replay/fd_replay_tile.h"
25 :
26 : #include "generated/fd_bundle_tile_seccomp.h"
27 :
28 6 : #define IN_KIND_REPLAY_OUT (1)
29 :
30 0 : #define STEM_BURST (5UL)
31 : FD_STATIC_ASSERT( FD_BUNDLE_CLIENT_MAX_TXN_PER_BUNDLE<=STEM_BURST, stem_burst );
32 :
33 : /* hysteresis thresholds to avoid bouncing (e.g. during forks) */
34 36 : #define FD_BUNDLE_SLEEP_THRESHOLD_SLOTS (450UL)
35 30 : #define FD_BUNDLE_WAKE_THRESHOLD_SLOTS (400UL)
36 69 : #define FD_BUNDLE_SLEEP_CHECK_INTERVAL_NS ((long)5e9)
37 :
38 : FD_FN_CONST static ulong
39 0 : scratch_align( void ) {
40 0 : return fd_ulong_max( fd_ulong_max( fd_ulong_max( alignof(fd_bundle_tile_t), fd_grpc_client_align() ), fd_alloc_align() ), pending_txn_align() );
41 0 : }
42 :
43 : FD_FN_CONST static ulong
44 0 : scratch_footprint( fd_topo_tile_t const * tile ) {
45 0 : ulong pending_max = tile->bundle.out_depth;
46 0 : ulong l = FD_LAYOUT_INIT;
47 0 : l = FD_LAYOUT_APPEND( l, alignof(fd_bundle_tile_t), sizeof(fd_bundle_tile_t) );
48 0 : l = FD_LAYOUT_APPEND( l, fd_grpc_client_align(), fd_grpc_client_footprint( tile->bundle.buf_sz ) );
49 0 : l = FD_LAYOUT_APPEND( l, fd_alloc_align(), fd_alloc_footprint() );
50 0 : l = FD_LAYOUT_APPEND( l, pending_txn_align(), pending_txn_footprint( pending_max ) );
51 0 : return FD_LAYOUT_FINI( l, scratch_align() );
52 0 : }
53 :
54 : FD_FN_CONST static inline ulong
55 0 : loose_footprint( fd_topo_tile_t const * tile ) {
56 : /* Leftover space for OpenSSL allocations */
57 0 : return tile->bundle.ssl_heap_sz;
58 0 : }
59 :
60 : static void
61 81 : fd_bundle_tile_maybe_sleep( fd_bundle_tile_t * ctx, long now_ns ) {
62 81 : if( FD_UNLIKELY( !ctx->replay_in.mem ) ) return;
63 69 : if( FD_LIKELY( now_ns < ctx->sleep_check_ns ) ) return;
64 66 : ctx->sleep_check_ns = now_ns + FD_BUNDLE_SLEEP_CHECK_INTERVAL_NS;
65 :
66 66 : ulong next_leader_slot = ctx->next_leader_slot;
67 66 : ulong reset_slot = ctx->reset_slot;
68 :
69 : /* Either don't know the leader schedule yet or have no upcoming
70 : leader slots. Sleep. */
71 66 : if( FD_UNLIKELY( next_leader_slot==ULONG_MAX || reset_slot==ULONG_MAX ) ) {
72 12 : if( !ctx->sleep_mode ) {
73 9 : ctx->sleep_mode = 1;
74 9 : FD_LOG_INFO(( "Bundle tile entering sleep mode: no upcoming leader slots" ));
75 9 : }
76 12 : return;
77 12 : }
78 :
79 54 : ulong slots_until_leader = fd_ulong_sat_sub( next_leader_slot, reset_slot );
80 :
81 54 : if( ctx->sleep_mode ) {
82 24 : if( slots_until_leader <= FD_BUNDLE_WAKE_THRESHOLD_SLOTS ) {
83 15 : ctx->sleep_mode = 0;
84 15 : ctx->last_bundle_status_log_nanos = now_ns;
85 15 : FD_LOG_INFO(( "Bundle tile waking up: next leader slot %lu (~%lu slots away)", next_leader_slot, slots_until_leader ));
86 15 : }
87 30 : } else {
88 : /* reset_slot stays at/near next_leader_slot throughout a leader
89 : rotation and only jumps to the next rotation after leadership
90 : ends, so this cannot trigger mid-rotation. */
91 30 : if( slots_until_leader > FD_BUNDLE_SLEEP_THRESHOLD_SLOTS ) {
92 18 : ctx->sleep_mode = 1;
93 18 : FD_LOG_INFO(( "Bundle tile entering sleep mode: next leader slot %lu (~%lu slots away)", next_leader_slot, slots_until_leader ));
94 18 : }
95 30 : }
96 54 : }
97 :
98 : static inline void
99 0 : metrics_write( fd_bundle_tile_t * ctx ) {
100 0 : FD_MCNT_SET( BUNDLE, TXN_RX, ctx->metrics.txn_received_cnt );
101 0 : FD_MCNT_SET( BUNDLE, BUNDLE_RX, ctx->metrics.bundle_received_cnt );
102 0 : FD_MCNT_SET( BUNDLE, PKT_RX, ctx->metrics.packet_received_cnt );
103 0 : FD_MCNT_SET( BUNDLE, PROTOBUF_RX_BYTES, ctx->metrics.proto_received_bytes );
104 0 : FD_MCNT_SET( BUNDLE, SHREDSTREAM_HEARTBEAT_SENT, ctx->metrics.shredstream_heartbeat_cnt );
105 0 : FD_MCNT_SET( BUNDLE, PING_ACKED, ctx->metrics.ping_ack_cnt );
106 0 : FD_MCNT_SET( BUNDLE, CONN_ERROR_PROTOBUF, ctx->metrics.decode_fail_cnt );
107 0 : FD_MCNT_SET( BUNDLE, CONN_ERROR_TRANSPORT, ctx->metrics.transport_fail_cnt );
108 0 : FD_MCNT_SET( BUNDLE, CONN_ERROR_NO_FEE_INFO, ctx->metrics.missing_builder_info_fail_cnt );
109 0 : FD_MGAUGE_SET( BUNDLE, TXN_PENDING, pending_txn_cnt( ctx->pending_txns ) );
110 0 : FD_MCNT_SET ( BUNDLE, TXN_BUFFER_FULL, ctx->metrics.backpressure_drop_cnt );
111 0 : #if FD_HAS_OPENSSL
112 0 : FD_MCNT_SET( BUNDLE, CONN_ERROR_SSL_ALLOC, fd_ossl_alloc_errors );
113 0 : #endif
114 :
115 0 : FD_MGAUGE_SET( BUNDLE, RTT_SAMPLE_NANOS, (ulong)ctx->rtt->latest_rtt );
116 0 : FD_MGAUGE_SET( BUNDLE, RTT_SMOOTHED_NANOS, (ulong)ctx->rtt->smoothed_rtt );
117 0 : FD_MGAUGE_SET( BUNDLE, RTT_VARIANCE_NANOS, (ulong)ctx->rtt->var_rtt );
118 :
119 0 : FD_MHIST_COPY( BUNDLE, MESSAGE_RX_DELAY_NANOS, ctx->metrics.msg_rx_delay );
120 :
121 0 : fd_wksp_t * wksp = fd_wksp_containing( ctx );
122 0 : fd_wksp_usage_t usage[1];
123 0 : ulong const free_tag = 0UL;
124 0 : if( FD_UNLIKELY( !fd_wksp_usage( wksp, &free_tag, 1UL, usage ) ) ) {
125 0 : FD_LOG_ERR(( "fd_wksp_usage failed" )); /* unreachable */
126 0 : }
127 0 : FD_MGAUGE_SET( BUNDLE, HEAP_SIZE_BYTES, usage->total_sz );
128 0 : FD_MGAUGE_SET( BUNDLE, HEAP_FREE_BYTES, usage->free_sz );
129 :
130 0 : int status = fd_bundle_client_status( ctx );
131 0 : ulong state = (ulong)status;
132 0 : if( FD_UNLIKELY( ctx->sleep_mode ) ) state = FD_BUNDLE_STATE_SLEEPING;
133 :
134 0 : FD_MGAUGE_SET( BUNDLE, STATE, state );
135 0 : ctx->bundle_status_recent = (uchar)state;
136 0 : }
137 :
138 : void
139 9 : fd_bundle_tile_housekeeping( fd_bundle_tile_t * ctx ) {
140 9 : long log_interval_ns = (long)30e9;
141 9 : int status = fd_bundle_client_status( ctx );
142 9 : long log_next_ns = ctx->last_bundle_status_log_nanos + log_interval_ns;
143 9 : long now_ns = fd_log_wallclock();
144 :
145 9 : if( FD_UNLIKELY( !ctx->sleep_mode && status!=FD_BUNDLE_STATE_CONNECTED && now_ns>log_next_ns ) ) {
146 3 : FD_LOG_WARNING(( "No bundle server connection in the last %ld seconds", log_interval_ns/(long)1e9 ) );
147 3 : ctx->last_bundle_status_log_nanos = now_ns;
148 3 : }
149 :
150 9 : if( FD_UNLIKELY( fd_keyswitch_state_query( ctx->keyswitch )==FD_KEYSWITCH_STATE_SWITCH_PENDING ) ) {
151 3 : if( ctx->tcp_sock>=0 ) fd_bundle_client_reset( ctx );
152 3 : ctx->halt_signing = 1;
153 3 : fd_memcpy( ctx->auther.pubkey, ctx->keyswitch->bytes, 32UL );
154 3 : fd_keyswitch_state( ctx->keyswitch, FD_KEYSWITCH_STATE_COMPLETED );
155 3 : }
156 :
157 9 : if( FD_UNLIKELY( fd_keyswitch_state_query( ctx->keyswitch )==FD_KEYSWITCH_STATE_UNHALT_PENDING ) ) {
158 3 : ctx->defer_reset = 1;
159 3 : ctx->sleep_check_ns = 0;
160 3 : ctx->halt_signing = 0;
161 3 : fd_keyswitch_state( ctx->keyswitch, FD_KEYSWITCH_STATE_COMPLETED );
162 3 : }
163 :
164 9 : fd_bundle_tile_maybe_sleep( ctx, now_ns );
165 9 : }
166 :
167 : static void
168 : fd_bundle_tile_publish_block_engine_update(
169 : fd_bundle_tile_t * ctx,
170 : fd_stem_context_t * stem
171 0 : ) {
172 0 : fd_bundle_block_engine_update_t * update =
173 0 : fd_chunk_to_laddr( ctx->plugin_out.mem, ctx->plugin_out.chunk );
174 0 : memset( update, 0, sizeof(fd_bundle_block_engine_update_t) );
175 :
176 0 : strncpy( update->name, "jito", sizeof(update->name) );
177 :
178 : /* Deliberately silently truncates */
179 0 : snprintf( update->url, sizeof(update->url), "%s://%.*s:%u",
180 0 : ctx->is_ssl ? "https" : "http",
181 0 : (int)ctx->server_fqdn_len,
182 0 : ctx->server_fqdn,
183 0 : ctx->server_tcp_port );
184 :
185 : /* Format IPv4 string */
186 0 : snprintf( update->ip_cstr, sizeof(update->ip_cstr),
187 0 : FD_IP4_ADDR_FMT,
188 0 : FD_IP4_ADDR_FMT_ARGS( ctx->server_ip4_addr ) );
189 :
190 0 : ulong tspub = (ulong)fd_frag_meta_ts_comp( fd_bundle_now() );
191 0 : fd_stem_publish(
192 0 : stem,
193 0 : ctx->plugin_out.idx,
194 0 : (ulong)ctx->bundle_status_recent,
195 0 : ctx->plugin_out.chunk,
196 0 : sizeof(fd_bundle_block_engine_update_t),
197 0 : 0UL, /* ctl */
198 0 : 0UL, /* seq */
199 0 : tspub
200 0 : );
201 0 : ctx->plugin_out.chunk = fd_dcache_compact_next( ctx->plugin_out.chunk, sizeof(fd_bundle_block_engine_update_t), ctx->plugin_out.chunk0, ctx->plugin_out.wmark );
202 0 : }
203 :
204 : static void
205 : during_frag( fd_bundle_tile_t * ctx,
206 : ulong in_idx,
207 : ulong seq FD_PARAM_UNUSED,
208 : ulong sig,
209 : ulong chunk,
210 : ulong sz FD_PARAM_UNUSED,
211 21 : ulong ctl FD_PARAM_UNUSED ) {
212 :
213 21 : if( FD_UNLIKELY( ctx->in_kind[ in_idx ]==IN_KIND_REPLAY_OUT ) ) {
214 18 : if( FD_LIKELY( sig!=REPLAY_SIG_RESET ) ) return;
215 15 : if( FD_UNLIKELY( chunk<ctx->replay_in.chunk0 || chunk>ctx->replay_in.wmark || sz!=sizeof(fd_poh_reset_t) ) )
216 0 : FD_LOG_ERR(( "chunk %lu %lu corrupt, not in range [%lu,%lu]", chunk, sz, ctx->replay_in.chunk0, ctx->replay_in.wmark ));
217 :
218 15 : fd_poh_reset_t const * reset = fd_chunk_to_laddr_const( ctx->replay_in.mem, chunk );
219 15 : ctx->next_leader_slot_staged = reset->next_leader_slot;
220 15 : ctx->reset_slot_staged = reset->completed_slot;
221 15 : }
222 21 : }
223 :
224 : static void
225 : after_frag( fd_bundle_tile_t * ctx,
226 : ulong in_idx,
227 : ulong seq FD_PARAM_UNUSED,
228 : ulong sig,
229 : ulong sz FD_PARAM_UNUSED,
230 : ulong tsorig FD_PARAM_UNUSED,
231 : ulong tspub FD_PARAM_UNUSED,
232 21 : fd_stem_context_t * stem FD_PARAM_UNUSED ) {
233 :
234 21 : if( FD_UNLIKELY( ctx->in_kind[ in_idx ]==IN_KIND_REPLAY_OUT ) ) {
235 18 : if( FD_LIKELY( sig!=REPLAY_SIG_RESET ) ) return;
236 15 : ctx->next_leader_slot = ctx->next_leader_slot_staged;
237 15 : ctx->reset_slot = ctx->reset_slot_staged;
238 15 : }
239 21 : }
240 :
241 : static void
242 : before_credit( fd_bundle_tile_t * ctx,
243 : fd_stem_context_t * stem,
244 0 : int * charge_busy ) {
245 0 : if( FD_UNLIKELY( !ctx->stem ) ) {
246 0 : ctx->stem = stem;
247 0 : }
248 :
249 0 : if( FD_UNLIKELY( ctx->halt_signing ) ) return;
250 :
251 0 : if( FD_UNLIKELY( ctx->sleep_mode ) ) {
252 0 : if( ctx->tcp_sock>=0 ) {
253 0 : fd_bundle_client_reset( ctx );
254 : /* Override backoff so we don't treat this as an error */
255 0 : ctx->backoff_until = 0;
256 0 : ctx->backoff_iter = 0;
257 0 : }
258 0 : return;
259 0 : }
260 :
261 0 : if( pending_txn_empty( ctx->pending_txns ) ) {
262 0 : fd_bundle_client_step( ctx, charge_busy );
263 0 : }
264 0 : }
265 :
266 : static void
267 : after_credit( fd_bundle_tile_t * ctx,
268 : fd_stem_context_t * stem,
269 : int * opt_poll_in,
270 0 : int * charge_busy ) {
271 0 : if( !pending_txn_empty( ctx->pending_txns ) ) {
272 0 : fd_bundle_pending_txn_t * head = pending_txn_peek_head( ctx->pending_txns );
273 0 : ulong drain_seq = head->bundle_seq;
274 0 : ulong drain_sig = head->sig;
275 0 : ulong drain_cnt = 0UL;
276 :
277 0 : do {
278 0 : fd_bundle_pending_txn_t const * txn = pending_txn_peek_head( ctx->pending_txns );
279 :
280 0 : fd_txn_m_t * txnm = fd_chunk_to_laddr( ctx->verify_out.mem, ctx->verify_out.chunk );
281 0 : *txnm = (fd_txn_m_t) {
282 0 : .reference_slot = 0UL,
283 0 : .payload_sz = txn->payload_sz,
284 0 : .txn_t_sz = 0U,
285 0 : .source_ipv4 = txn->source_ipv4,
286 0 : .source_tpu = FD_TXN_M_TPU_SOURCE_BUNDLE,
287 0 : .block_engine = {
288 0 : .bundle_id = txn->bundle_seq,
289 0 : .bundle_txn_cnt = txn->bundle_txn_cnt,
290 0 : .commission = txn->commission,
291 0 : },
292 0 : };
293 0 : fd_memcpy( txnm->block_engine.commission_pubkey, txn->commission_pubkey, 32UL );
294 0 : fd_memcpy( fd_txn_m_payload( txnm ), txn->payload, txn->payload_sz );
295 :
296 0 : ulong sz = fd_txn_m_realized_footprint( txnm, 0, 0 );
297 0 : ulong tspub = (ulong)fd_frag_meta_ts_comp( fd_bundle_now() );
298 0 : fd_stem_publish( stem, ctx->verify_out.idx, txn->sig, ctx->verify_out.chunk, sz, 0UL, 0UL, tspub );
299 0 : ctx->verify_out.chunk = fd_dcache_compact_next( ctx->verify_out.chunk, sz, ctx->verify_out.chunk0, ctx->verify_out.wmark );
300 :
301 0 : pending_txn_remove_head( ctx->pending_txns );
302 0 : drain_cnt++;
303 0 : } while( fd_bundle_drain_continue( ctx->pending_txns, drain_sig, drain_seq, drain_cnt, STEM_BURST ) );
304 :
305 0 : *charge_busy = 1;
306 0 : *opt_poll_in = 0;
307 0 : }
308 :
309 0 : if( ctx->plugin_out.mem ) {
310 0 : if( FD_UNLIKELY( ctx->bundle_status_recent != ctx->bundle_status_plugin ) ) {
311 0 : fd_bundle_tile_publish_block_engine_update( ctx, stem );
312 0 : ctx->bundle_status_plugin = (uchar)ctx->bundle_status_recent;
313 0 : *charge_busy = 1;
314 0 : }
315 0 : }
316 0 : }
317 :
318 : #ifndef FD_TILE_TEST
319 : static void
320 : fd_bundle_tile_parse_endpoint( fd_bundle_tile_t * ctx,
321 0 : fd_topo_tile_t const * tile ) {
322 0 : fd_url_t url[1];
323 0 : _Bool is_ssl = 0;
324 0 : if( FD_UNLIKELY( fd_url_parse_endpoint( url,
325 0 : tile->bundle.url,
326 0 : tile->bundle.url_len,
327 0 : &ctx->server_tcp_port,
328 0 : &is_ssl,
329 0 : "[tiles.bundle.url]" ) ) ) {
330 0 : FD_LOG_ERR(( "Could not parse [tiles.bundle.url]" ));
331 0 : }
332 0 : if( FD_UNLIKELY( url->host_len > 255 ) ) {
333 0 : FD_LOG_CRIT(( "Invalid url->host_len" )); /* unreachable */
334 0 : }
335 0 : fd_cstr_fini( fd_cstr_append_text( fd_cstr_init( ctx->server_fqdn ), url->host, url->host_len ) );
336 0 : ctx->server_fqdn_len = url->host_len;
337 :
338 0 : if( FD_UNLIKELY( tile->bundle.sni_len ) ) {
339 0 : fd_cstr_fini( fd_cstr_append_text( fd_cstr_init( ctx->server_sni ), tile->bundle.sni, tile->bundle.sni_len ) );
340 0 : ctx->server_sni_len = tile->bundle.sni_len;
341 0 : } else {
342 0 : fd_cstr_fini( fd_cstr_append_text( fd_cstr_init( ctx->server_sni ), url->host, url->host_len ) );
343 0 : ctx->server_sni_len = url->host_len;
344 0 : }
345 :
346 0 : ctx->is_ssl = !!is_ssl;
347 : #if !FD_HAS_OPENSSL
348 : if( FD_UNLIKELY( is_ssl ) ) {
349 : FD_LOG_ERR(( "This build does not include OpenSSL. To install OpenSSL, re-run ./deps.sh and do a clean re build." ));
350 : }
351 : #endif
352 0 : }
353 :
354 : #if FD_HAS_OPENSSL
355 :
356 : static void
357 : fd_ossl_keylog_callback( SSL const * ssl,
358 0 : char const * line ) {
359 0 : SSL_CTX * ssl_ctx = SSL_get_SSL_CTX( ssl );
360 0 : fd_bundle_tile_t * ctx = SSL_CTX_get_ex_data( ssl_ctx, 0 );
361 0 : ulong line_len = strlen( line );
362 0 : struct iovec iovs[2] = {
363 0 : { .iov_base=(void *)line, .iov_len=line_len },
364 0 : { .iov_base=(void *)"\n", .iov_len=1UL }
365 0 : };
366 0 : if( FD_UNLIKELY( writev( ctx->keylog_fd, iovs, 2 )!=(long)line_len+1 ) ) {
367 0 : FD_LOG_WARNING(( "write(keylog) failed (%i-%s)", errno, fd_io_strerror( errno ) ));
368 0 : }
369 0 : }
370 :
371 : static void
372 : fd_bundle_tile_init_openssl( fd_bundle_tile_t * ctx,
373 : void * alloc_mem,
374 0 : int tls_cert_verify ) {
375 0 : fd_alloc_t * alloc = fd_alloc_join( fd_alloc_new( alloc_mem, 1UL ), 1UL );
376 0 : if( FD_UNLIKELY( !alloc ) ) {
377 0 : FD_LOG_ERR(( "fd_alloc_new failed" ));
378 0 : }
379 0 : ctx->ssl_alloc = alloc;
380 0 : fd_ossl_tile_init( alloc );
381 :
382 0 : SSL_CTX * ssl_ctx = SSL_CTX_new( TLS_client_method() );
383 0 : if( FD_UNLIKELY( !ssl_ctx ) ) {
384 0 : FD_LOG_ERR(( "SSL_CTX_new failed" ));
385 0 : }
386 :
387 0 : if( FD_UNLIKELY( !SSL_CTX_set_ex_data( ssl_ctx, 0, ctx ) ) ) {
388 0 : FD_LOG_ERR(( "SSL_CTX_set_ex_data failed" ));
389 0 : }
390 :
391 0 : if( FD_UNLIKELY( !SSL_CTX_set_mode( ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE|SSL_MODE_AUTO_RETRY ) ) ) {
392 0 : FD_LOG_ERR(( "SSL_CTX_set_mode failed" ));
393 0 : }
394 :
395 0 : if( FD_UNLIKELY( !SSL_CTX_set_min_proto_version( ssl_ctx, TLS1_3_VERSION ) ) ) {
396 0 : FD_LOG_ERR(( "SSL_CTX_set_min_proto_version(ssl_ctx,TLS1_3_VERSION) failed" ));
397 0 : }
398 :
399 0 : if( FD_UNLIKELY( 0!=SSL_CTX_set_alpn_protos( ssl_ctx, (const unsigned char *)"\x02h2", 3 ) ) ) {
400 0 : FD_LOG_ERR(( "SSL_CTX_set_alpn_protos failed" ));
401 0 : }
402 :
403 0 : if( tls_cert_verify ) {
404 0 : fd_ossl_load_certs( ssl_ctx );
405 0 : }
406 :
407 0 : if( FD_LIKELY( ctx->keylog_fd >= 0 ) ) {
408 0 : SSL_CTX_set_keylog_callback( ssl_ctx, fd_ossl_keylog_callback );
409 0 : }
410 :
411 0 : ctx->ssl_ctx = ssl_ctx;
412 0 : }
413 :
414 : #endif /* FD_HAS_OPENSSL */
415 :
416 : static void
417 : privileged_init( fd_topo_t const * topo,
418 0 : fd_topo_tile_t const * tile ) {
419 0 : void * scratch = fd_topo_obj_laddr( topo, tile->tile_obj_id );
420 :
421 0 : ulong const pending_max = tile->bundle.out_depth;
422 :
423 0 : FD_SCRATCH_ALLOC_INIT( l, scratch );
424 0 : fd_bundle_tile_t * ctx = FD_SCRATCH_ALLOC_APPEND( l, alignof(fd_bundle_tile_t), sizeof(fd_bundle_tile_t) );
425 0 : void * grpc_mem = FD_SCRATCH_ALLOC_APPEND( l, fd_grpc_client_align(), fd_grpc_client_footprint( tile->bundle.buf_sz ) );
426 0 : void * alloc_mem = FD_SCRATCH_ALLOC_APPEND( l, fd_alloc_align(), fd_alloc_footprint() );
427 0 : void * deque_mem = FD_SCRATCH_ALLOC_APPEND( l, pending_txn_align(), pending_txn_footprint( pending_max ) );
428 0 : (void)alloc_mem; /* potentially unused */
429 :
430 0 : ulong scratch_top = FD_SCRATCH_ALLOC_FINI( l, scratch_align() );
431 0 : if( FD_UNLIKELY( scratch_top > (ulong)scratch + scratch_footprint( tile ) ) )
432 0 : FD_LOG_ERR(( "scratch overflow %lu %lu %lu", scratch_top - (ulong)scratch - scratch_footprint( tile ), scratch_top, (ulong)scratch + scratch_footprint( tile ) ));
433 :
434 0 : memset( ctx, 0, sizeof(fd_bundle_tile_t) );
435 0 : ctx->grpc_client_mem = grpc_mem;
436 0 : ctx->grpc_buf_max = tile->bundle.buf_sz;
437 0 : ctx->tcp_sock = -1;
438 0 : ctx->pending_txns = pending_txn_join( pending_txn_new( deque_mem, pending_max ) );
439 :
440 0 : fd_bundle_auther_init( &ctx->auther );
441 0 : uchar const * public_key = fd_keyload_load( tile->bundle.identity_key_path, 1 /* public key only */ );
442 0 : fd_memcpy( ctx->auther.pubkey, public_key, 32UL );
443 :
444 0 : ctx->keylog_fd = -1;
445 :
446 0 : # if FD_HAS_OPENSSL
447 :
448 0 : if( FD_UNLIKELY( tile->bundle.key_log_path[0] ) ) {
449 0 : ctx->keylog_fd = open( tile->bundle.key_log_path, O_WRONLY|O_APPEND|O_CREAT, 0644 );
450 0 : if( FD_UNLIKELY( ctx->keylog_fd < 0 ) ) {
451 0 : FD_LOG_ERR(( "open(%s) failed (%i-%s)", tile->bundle.key_log_path, errno, fd_io_strerror( errno ) ));
452 0 : }
453 0 : }
454 :
455 : /* OpenSSL goes and tries to read files and allocate memory and
456 : other dumb things on a thread local basis, so we need a special
457 : initializer to do it before seccomp happens in the process. */
458 0 : fd_bundle_tile_init_openssl( ctx, alloc_mem, tile->bundle.tls_cert_verify );
459 :
460 0 : # endif /* FD_HAS_OPENSSL */
461 :
462 : /* Init resolver */
463 0 : if( FD_UNLIKELY( !fd_netdb_open_fds( ctx->netdb_fds ) ) ) {
464 0 : FD_LOG_ERR(( "fd_netdb_open_fds failed" ));
465 0 : }
466 :
467 : /* Random seed for header hashmap */
468 0 : if( FD_UNLIKELY( !fd_rng_secure( &ctx->map_seed, sizeof(ulong) ) ) ) {
469 0 : FD_LOG_CRIT(( "fd_rng_secure failed" ));
470 0 : }
471 :
472 : /* Random seed for timing RNG */
473 0 : uint rng_seed;
474 0 : if( FD_UNLIKELY( !fd_rng_secure( &rng_seed, sizeof(uint) ) ) ) {
475 0 : FD_LOG_CRIT(( "fd_rng_secure failed" ));
476 0 : }
477 0 : if( FD_UNLIKELY( !fd_rng_join( fd_rng_new( &ctx->rng, rng_seed, 0UL ) ) ) ) {
478 0 : FD_LOG_CRIT(( "fd_rng_join failed" )); /* unreachable */
479 0 : }
480 0 : }
481 :
482 : static fd_bundle_out_ctx_t
483 : bundle_out_link( fd_topo_t const * topo,
484 : fd_topo_link_t const * link,
485 0 : ulong out_link_idx ) {
486 0 : fd_bundle_out_ctx_t out = {0};
487 0 : out.idx = out_link_idx;
488 0 : out.mem = topo->workspaces[ topo->objs[ link->dcache_obj_id ].wksp_id ].wksp;
489 0 : out.chunk0 = fd_dcache_compact_chunk0( out.mem, link->dcache );
490 0 : out.wmark = fd_dcache_compact_wmark ( out.mem, link->dcache, link->mtu );
491 0 : out.chunk = out.chunk0;
492 0 : return out;
493 0 : }
494 :
495 : static void
496 : unprivileged_init( fd_topo_t const * topo,
497 0 : fd_topo_tile_t const * tile ) {
498 0 : fd_bundle_tile_t * ctx = fd_topo_obj_laddr( topo, tile->tile_obj_id );
499 0 : if( FD_UNLIKELY( tile->kind_id!=0 ) ) {
500 0 : FD_LOG_ERR(( "There can only be one bundle tile" ));
501 0 : }
502 :
503 0 : ulong sign_in_idx = fd_topo_find_tile_in_link( topo, tile, "sign_bundle", tile->kind_id );
504 0 : if( FD_UNLIKELY( sign_in_idx==ULONG_MAX ) ) FD_LOG_ERR(( "Missing sign_bundle link" ));
505 0 : fd_topo_link_t const * sign_in = &topo->links[ tile->in_link_id[ sign_in_idx ] ];
506 :
507 0 : ulong sign_out_idx = fd_topo_find_tile_out_link( topo, tile, "bundle_sign", tile->kind_id );
508 0 : if( FD_UNLIKELY( sign_out_idx==ULONG_MAX ) ) FD_LOG_ERR(( "Missing bundle_sign link" ));
509 0 : fd_topo_link_t const * sign_out = &topo->links[ tile->out_link_id[ sign_out_idx ] ];
510 :
511 0 : if( FD_UNLIKELY( !fd_keyguard_client_join( fd_keyguard_client_new(
512 0 : ctx->keyguard_client,
513 0 : sign_out->mcache,
514 0 : sign_out->dcache,
515 0 : sign_in->mcache,
516 0 : sign_in->dcache,
517 0 : sign_out->mtu
518 0 : ) ) ) ) {
519 0 : FD_LOG_ERR(( "fd_keyguard_client_join failed" )); /* unreachable */
520 0 : }
521 :
522 0 : ctx->keyswitch = fd_keyswitch_join( fd_topo_obj_laddr( topo, tile->id_keyswitch_obj_id ) );
523 0 : FD_TEST( ctx->keyswitch );
524 :
525 0 : ulong verify_out_idx = fd_topo_find_tile_out_link( topo, tile, "bundle_verif", tile->kind_id );
526 0 : if( FD_UNLIKELY( verify_out_idx==ULONG_MAX ) ) FD_LOG_ERR(( "Missing bundle_verif link" ));
527 0 : ctx->verify_out = bundle_out_link( topo, &topo->links[ tile->out_link_id[ verify_out_idx ] ], verify_out_idx );
528 :
529 0 : ulong plugin_out_idx = fd_topo_find_tile_out_link( topo, tile, "bundle_status", tile->kind_id );
530 0 : if( plugin_out_idx!=ULONG_MAX ) {
531 0 : ctx->plugin_out = bundle_out_link( topo, &topo->links[ tile->out_link_id[ plugin_out_idx ] ], plugin_out_idx );
532 0 : } else {
533 0 : ctx->plugin_out = (fd_bundle_out_ctx_t){ .idx=ULONG_MAX };
534 0 : }
535 :
536 : /* Set socket receive buffer size */
537 0 : ulong so_rcvbuf = tile->bundle.buf_sz;
538 0 : if( FD_UNLIKELY( so_rcvbuf < 2048UL ) ) FD_LOG_ERR(( "Invalid [development.bundle.buffer_size_kib]: too small" ));
539 0 : if( FD_UNLIKELY( so_rcvbuf > INT_MAX ) ) FD_LOG_ERR(( "Invalid [development.bundle.buffer_size_kib]: too large" ));
540 0 : ctx->so_rcvbuf = (int)so_rcvbuf;
541 :
542 : /* Set idle ping timer */
543 0 : ctx->keepalive_interval = (long)tile->bundle.keepalive_interval_nanos;
544 :
545 0 : ctx->bundle_status_plugin = 127;
546 0 : ctx->bundle_status_recent = (uchar)FD_BUNDLE_STATE_DISCONNECTED;
547 0 : ctx->last_bundle_status_log_nanos = fd_log_wallclock();
548 :
549 0 : FD_TEST( tile->in_cnt<=sizeof(ctx->in_kind)/sizeof(ctx->in_kind[0]) );
550 0 : int has_replay_in = 0;
551 0 : ulong polled_in_idx = 0UL;
552 0 : for( ulong i=0UL; i<tile->in_cnt; i++ ) {
553 0 : if( FD_UNLIKELY( !tile->in_link_poll[ i ] ) ) continue;
554 :
555 0 : fd_topo_link_t const * link = &topo->links[ tile->in_link_id[ i ] ];
556 0 : if( !strcmp( link->name, "replay_out" ) ) {
557 0 : ctx->in_kind[ polled_in_idx ] = IN_KIND_REPLAY_OUT;
558 0 : fd_topo_wksp_t const * link_wksp = &topo->workspaces[ topo->objs[ link->dcache_obj_id ].wksp_id ];
559 0 : ctx->replay_in.mem = link_wksp->wksp;
560 0 : ctx->replay_in.chunk0 = fd_dcache_compact_chunk0( ctx->replay_in.mem, link->dcache );
561 0 : ctx->replay_in.wmark = fd_dcache_compact_wmark ( ctx->replay_in.mem, link->dcache, link->mtu );
562 0 : has_replay_in = 1;
563 0 : }
564 0 : polled_in_idx++;
565 0 : }
566 :
567 0 : ctx->next_leader_slot = ULONG_MAX;
568 0 : ctx->reset_slot = ULONG_MAX;
569 0 : ctx->sleep_mode = has_replay_in; /* start asleep until we learn leader schedule */
570 0 : ctx->sleep_check_ns = 0;
571 0 : ctx->halt_signing = 0;
572 0 : if( !has_replay_in ) memset( &ctx->replay_in, 0, sizeof(ctx->replay_in) );
573 :
574 0 : fd_bundle_tile_parse_endpoint( ctx, tile );
575 :
576 0 : ctx->grpc_client = fd_grpc_client_new( ctx->grpc_client_mem, &fd_bundle_client_grpc_callbacks, ctx->grpc_metrics, ctx, ctx->grpc_buf_max, ctx->map_seed );
577 0 : if( FD_UNLIKELY( !ctx->grpc_client ) ) {
578 0 : FD_LOG_CRIT(( "fd_grpc_client_new failed" )); /* unreachable */
579 0 : }
580 0 : fd_grpc_client_set_version( ctx->grpc_client, fd_version_cstr, strlen( fd_version_cstr ) );
581 0 : fd_grpc_client_set_authority( ctx->grpc_client, ctx->server_sni, ctx->server_sni_len, ctx->server_tcp_port );
582 :
583 0 : fd_histf_new( ctx->metrics.msg_rx_delay,
584 0 : FD_MHIST_MIN( BUNDLE, MESSAGE_RX_DELAY_NANOS ),
585 0 : FD_MHIST_MAX( BUNDLE, MESSAGE_RX_DELAY_NANOS ) );
586 0 : }
587 :
588 : static ulong
589 : populate_allowed_seccomp( fd_topo_t const * topo,
590 : fd_topo_tile_t const * tile,
591 : ulong out_cnt,
592 0 : struct sock_filter * out ) {
593 0 : fd_bundle_tile_t * ctx = fd_topo_obj_laddr( topo, tile->tile_obj_id );
594 :
595 0 : populate_sock_filter_policy_fd_bundle_tile(
596 0 : out_cnt, out,
597 0 : (uint)fd_log_private_logfile_fd(),
598 0 : (uint)ctx->keylog_fd,
599 0 : (uint)ctx->netdb_fds->etc_hosts,
600 0 : (uint)ctx->netdb_fds->etc_resolv_conf
601 0 : );
602 0 : return sock_filter_policy_fd_bundle_tile_instr_cnt;
603 0 : }
604 :
605 : static ulong
606 : populate_allowed_fds( fd_topo_t const * topo,
607 : fd_topo_tile_t const * tile,
608 : ulong out_fds_cnt,
609 0 : int * out_fds ) {
610 0 : fd_bundle_tile_t * ctx = fd_topo_obj_laddr( topo, tile->tile_obj_id );
611 :
612 0 : if( FD_UNLIKELY( out_fds_cnt<5UL ) ) FD_LOG_ERR(( "out_fds_cnt %lu", out_fds_cnt ));
613 :
614 0 : ulong out_cnt = 0UL;
615 0 : out_fds[ out_cnt++ ] = 2; /* stderr */
616 0 : if( FD_LIKELY( -1!=fd_log_private_logfile_fd() ) )
617 0 : out_fds[ out_cnt++ ] = fd_log_private_logfile_fd(); /* logfile */
618 0 : if( FD_LIKELY( ctx->netdb_fds->etc_hosts >= 0 ) )
619 0 : out_fds[ out_cnt++ ] = ctx->netdb_fds->etc_hosts;
620 0 : out_fds[ out_cnt++ ] = ctx->netdb_fds->etc_resolv_conf;
621 0 : if( FD_UNLIKELY( ctx->keylog_fd>=0 ) )
622 0 : out_fds[ out_cnt++ ] = ctx->keylog_fd;
623 0 : return out_cnt;
624 0 : }
625 :
626 0 : #define STEM_LAZY ((long)10e6)
627 :
628 0 : #define STEM_CALLBACK_CONTEXT_TYPE fd_bundle_tile_t
629 0 : #define STEM_CALLBACK_CONTEXT_ALIGN alignof(fd_bundle_tile_t)
630 :
631 0 : #define STEM_CALLBACK_DURING_HOUSEKEEPING fd_bundle_tile_housekeeping
632 0 : #define STEM_CALLBACK_METRICS_WRITE metrics_write
633 0 : #define STEM_CALLBACK_DURING_FRAG during_frag
634 0 : #define STEM_CALLBACK_AFTER_FRAG after_frag
635 0 : #define STEM_CALLBACK_BEFORE_CREDIT before_credit
636 0 : #define STEM_CALLBACK_AFTER_CREDIT after_credit
637 :
638 : #include "../stem/fd_stem.c"
639 :
640 : fd_topo_run_tile_t fd_tile_bundle = {
641 : .name = "bundle",
642 : .populate_allowed_seccomp = populate_allowed_seccomp,
643 : .populate_allowed_fds = populate_allowed_fds,
644 : .scratch_align = scratch_align,
645 : .scratch_footprint = scratch_footprint,
646 : .loose_footprint = loose_footprint,
647 : .privileged_init = privileged_init,
648 : .unprivileged_init = unprivileged_init,
649 : .run = stem_run,
650 : .rlimit_file_cnt = 64,
651 : .keep_host_networking = 1,
652 : .allow_connect = 1
653 : };
654 : #endif
|
