[Pedro Henrique Penna (ppenna)]

Lets a microVM platform restore install a network policy of its own in place of the complete deny-all policy that its NIC template was captured with, before any vCPU runs, including private-network ingress, explicit host-loopback access, and host-loopback forwards, for microsoft/nvx#536. This is a new feature of the platform tier rather than a fixup.

Based on feature/microvm/dev. This branch is two commits directly on e68871cc6, the head of feature/microvm/dev and the revision that NVX's dev pins.

A NIC template is a platform NIC captured with a complete deny-all (3e3a454c5)

Restore required the policy that a snapshot recorded, because its endpoint may have held flows, listeners, and forwards under it, and its guest may have learned a DNS server and announced its listeners under it. A NIC captured with a complete deny-all policy is different: the policy denies every guest frame, host loopback, and inbound access, and keeps no proxy endpoint, so nothing in the snapshot depends on it beyond the NIC's identity.

microvm_network_template_policy binds that policy to a NIC's identity, as a capture with --network-egress deny and --host-loopback deny, without rules, a proxy, or ingress, records it. validate_microvm_network_replacement checks that a snapshot's network record is exactly that policy's for its own identity, in the encoding that the policy has today, version 3 without IPv6 or version 4 with it, and returns it for the restore contract. Versions 0 to 2 encode neither the host-loopback action nor the proxy endpoint, so no snapshot that records one is a template. A replacement keeps the captured identity, so it may name IPv6 destinations only when that identity has IPv6.

The manifest format does not change: a template is recognized from what every networked snapshot already records, including those captured before this change.

--restore-network-policy (57d0a18b3)

With the option, a platform restore installs the network policy of its own options in place of the template's deny-all:

• Identity. The NIC keeps its captured identity: the restore binds the policy to it, as it binds a matching policy today, and still rejects --net.
• Validation. The same code as at a cold boot validates the policy, so the checks of its proxy, endpoints, rules, ingress, and forwards are a cold boot's. Only the IPv6 rule above is new.
• Before any vCPU runs. The device installs the policy when it is built, and the endpoint binds its forwards when it is resolved, so the restored guest never runs under the template's policy or a partial one, and a forward that cannot bind its port fails the restore. A restore that wants no connectivity passes the template's deny-all.
• Contract. The restore contract still compares the whole network record exactly. It expects the template's deny-all, which the record must hold, rather than the installed policy, so the option admits only a platform snapshot, which prepare_restore checks, with a NIC, which effective_microvm_network checks, whose record is the complete deny-all of its identity.
• Live attachments. The snapshot refusals of --network-ingress allow, --host-loopback allow, and --host-loopback-forward admit such a restore, and keep refusing captures and every other restore. Every other restore, of any tier, keeps the same-policy rule, and so does a template's restore without the option.
• Refusals. The option is refused on a cold boot, explicitly, because clap's requirement of --restore-snapshot does not hold once --kernel is present, and on a standard machine.

The guest keeps its captured command line, which has no virtnet_dns= or virtnet_ingress= token under a deny-all policy, so it learns its DNS server and whether to announce its listeners from its host after the restore (microsoft/nvx#838 and microsoft/nvx#850).

Tests

• openvmm_helpers::snapshot::microvm: only_a_complete_deny_all_network_is_a_template (templates with and without IPv6; replacements that open every direction; deny-all egress with host loopback, a proxy, ingress, host-loopback ingress, rules that deny every destination, and allow-all egress; the legacy encodings, which the same-policy rule still accepts; a noncanonical identity) and a_template_replacement_names_ipv6_only_with_an_ipv6_identity.
• microvm::network: a_complete_deny_all_capture_records_a_template; a_template_restore_installs_a_new_policy_and_keeps_the_identity, which restores one template with eight policies (the template's deny-all, allow-all egress, IPv4 and IPv6 rules, exact endpoints, a proxy, explicit host loopback with TCP and UDP forwards, and private-network ingress with and without host loopback), each installing the requested policy, keeping the identity, and expecting the template's contract, and checks that a template's restore without the option keeps its policy; only_a_template_admits_a_new_policy; and a_template_restore_binds_its_policy_to_the_captured_identity (a proxy or endpoint that does not suit the identity, a new address, IPv6 rules on a template that predates IPv6).
• microvm::restore: only_a_platform_restore_replaces_the_network_policy, for every tier.
• cli_args::microvm: test_microvm_restore_network_policy_requires_a_microvm_restore, and the snapshot cases of test_microvm_host_loopback_allow_publishes_guest_listeners and test_microvm_private_network_ingress_publishes_guest_listeners, which now cover the restore with the option, including the early check that runs before the snapshot is opened.

Validation

• On this branch, on Windows: cargo clippy --all-targets and cargo doc --no-deps for openvmm_helpers and openvmm_entry; cargo nextest run --profile agent for both (335 passed); and cargo xtask fmt --fix (clean).
• Bare metal, with openvmm: let a platform restore install a new network policy on a NIC template nvx#931, which pins this branch and adds the platform-network-policy microVM scenario, on Linux/MSHV, Linux/KVM, and Windows/WHP hosts: the scenario, which restores one NIC template with the template's deny-all, egress rules, explicit host loopback with a forward and private-network ingress, and a proxy, passes in 16.2, 13.6, and 37.6 s, and NVX's default microVM suite passes 40/40 on each. Every clone keeps the template's MAC, IPv4, and IPv6 addresses and reaches exactly what its policy admits, and the refused restores fail before the guest runs, the busy forward port with failed to create socket for port forward. With the unpatched e68871cc6 on KVM, the template's capture succeeds and the first clone's restore fails at unexpected argument '--restore-network-policy'.
• Not run locally: the VMM tests. The management RPC refuses snapshots with a NIC, so no VMM test reaches these paths; NVX's scenarios cover them through the CLI.

Notes

• The management RPC still refuses snapshots that have a NIC; the option is a CLI restore option only.
• Restore-time validation of the policy is a cold boot's, so the checks that microVM: reject explicit host-loopback access on a /30 IPv4 network nvx#553 and microVM: keep guests from reaching loopback-TCP console listeners through host loopback nvx#551 ask of cold boots will apply to these restores too once they land.

[github-actions]

4 Petri tests failed (1 unstable)