Add vsock-relay and fixed kernel to nitro-shim for star-randsrv

nitro-shim/Dockerfile

@@ -1,11 +1,17 @@
 # Build proxies that facilitate communication with the enclave.
-FROM golang:1.20 as builder
+FROM golang:1.20 as go-builder
 
 WORKDIR /src
 COPY tools/ ./
 RUN make -C ./viproxy/ viproxy
 RUN make -C ./gvproxy/ gvproxy
 
+FROM rust:1.71-alpine as rust-builder
+
+RUN apk add musl-dev
+
+RUN cargo install vsock-relay
+
 FROM amazonlinux:2.0.20230207.0
 
 RUN echo "timeout=60.0" >> /etc/yum.conf
@@ -18,7 +24,8 @@ RUN amazon-linux-extras install aws-nitro-enclaves-cli -y && \
 
 WORKDIR /enclave
 
-COPY --from=builder /src/viproxy/viproxy /enclave/
-COPY --from=builder /src/gvproxy/gvproxy /enclave/
+COPY --from=go-builder /src/viproxy/viproxy /enclave/
+COPY --from=go-builder /src/gvproxy/gvproxy /enclave/
+COPY --from=rust-builder /usr/local/cargo/bin/vsock-relay /enclave/
 
 COPY scripts/ /enclave/

nitro-shim/scripts/start-proxies.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+set -eux
+
 service="${1}"
 CID="${2}"
 PARENT_CID="3" # the CID of the EC2 instance
@@ -21,10 +23,12 @@ elif [ "${service}" = "/star-randsrv" ]; then
         -listen "unix://${domain_socket}" &
     # give gvproxy a second to start
     sleep 1
-    # instruct gvproxy to forward port 443 to the enclave
+    # instruct gvproxy to forward port 9090 to the enclave
     curl \
         -X POST \
         --unix-socket "$domain_socket" \
-        -d '{"local":":443","remote":"192.168.127.2:443"}' \
+        -d '{"local":":9090","remote":"192.168.127.2:9090"}' \
         "http:/unix/services/forwarder/expose"
+    # run vsock relay to proxy incoming requests
+    /enclave/vsock-relay -s "0.0.0.0:443" -l "4:443" -c 1000 &
 fi