mirror of
https://github.com/facebook/proxygen.git
synced 2026-10-24 01:33:54 +03:00
aff37b9380
Summary: # Context Fife authorizes connections for vDPUs, and callers punt the opening TCP SYN with `authorize` so Fife can forward it (D125621587). We need a simple client to inject that traffic by hand, and the vDPU-side client has to be open source, so this tool is too. # Product decisions 1. `askBarney --fife_ip X --fife_port Y --cert_path C [--key_path K] --ca_path A <host> <port>` works like netcat over TCP, except it first punts the connection's SYN to Fife. 2. The punt is `authorize(local_ip, dst_ip, syn)` over mTLS. askBarney prints Fife's `decision` and `forward` to stderr. Anything other than `ALLOWED` exits 1. If allowed, it relays stdin and stdout over the connection until the server closes it. # Code decisions - **The kernel owns the connection.** If askBarney made up its own SYN and only Fife sent it, the server's SYN-ACK would reach a kernel with no matching socket and be reset. So askBarney starts a normal non-blocking `connect()`, captures the SYN the kernel sends with an `AF_PACKET` socket, and punts those exact bytes. Because the punted SYN has the kernel's ports and sequence number, the server's SYN-ACK completes the kernel's connection whichever copy of the SYN reached the server. The kernel's own SYN also goes out directly. - Capturing needs `CAP_NET_RAW`, so run it as root. - **Open source only.** It uses folly, fbthrift, fmt, gflags and `folly::Init`, has Apache-2.0 headers, and doesn't depend on Fife's internal server code. That's why the SYN matcher (`TcpSyn`) is its own small parser rather than reusing `fife/server/IpPacket`. There are no Meta-specific default paths; the certificate, key and CA are required flags. Its only internal dependency is the generated client for `fife/if/fife.thrift`, which has to be published alongside it before it can ship. # Test listener `fife/askbarney/listen.py` (also `buck2 run fbcode//fife/askbarney:listen`) is a standard-library-only destination for askBarney tests. It listens on `--port` (default 17172, IPv6 and IPv4), replies to each connection with `--reply`, prints everything the peer sends, and keeps serving until Ctrl-C, or one connection with `--once`. It ships with askBarney in the open-source repo. # Open-source build - BUCK stays for the fbcode build. The open-source build is CMake plus getdeps, the standard pattern for Meta's open-source C++. All the dependencies (folly, fbthrift, fizz, wangle, fb303) are built and consumed that way, and a Makefile would mean hand-maintaining their include and link flags plus a Thrift code-generation rule. - `fife/askbarney/public_tld/CMakeLists.txt` becomes the open-source repo's top level. It finds the dependencies and generates the `Fife` client from `fife/if/fife.thrift` with `add_fbthrift_cpp_library`, depending on `fb303::fb303_thrift_cpp` for the `fb303_core.thrift` include. `fife/askbarney/CMakeLists.txt` builds `askBarney`, `askbarney_tcp_syn` and the test. - `opensource/fbcode_builder/manifests/askbarney` is the getdeps manifest. It maps `public_tld` to the repo root, ships `fife/askbarney/` and only `fife.thrift` from `fife/if`, and strips BUCK files. The open-source repo mirrors the fbcode layout so generated `#include` paths (`fife/if/gen-cpp2/...`) are the same in both builds. - Before publishing: there's no GitHub repo yet, so the manifest has no `[git]` section and only works inside fbsource. `fife.thrift` still has the internal "Confidential and proprietary" header and needs an open-source license header through the open-source review. Reviewed By: IvanTopolcic Differential Revision: D125707320 fbshipit-source-id: 74c83cf24f46c5b9028d662847f473afa2b3b053
Building using fbcode_builder
Continuous integration builds are powered by fbcode_builder, a tiny tool
shared by several Facebook projects. Its files are in ./fbcode_builder
(on Github) or in fbcode/opensource/fbcode_builder (inside Facebook's
repo).
Start with the READMEs in the fbcode_builder directory.
./fbcode_builder_config.py contains the project-specific configuration.