chore: add TUN interface to enclave + NAT on parent#212
Draft
Conversation
mkmks
added
the
devops
mkmks
force-pushed
the
fix/enclave/transparent-vsock-proxy
branch
2 times, most recently
from
3be7c65 to
25c3181
Compare
Vulnerability Scan ResultsDetails |
Consolidated Tests Results 2026-04-02 - 12:51:48Test Results
Details
test-reporter: Run #3726
🎉 All tests passed!TestsView All Tests
🍂 No flaky tests in this run. Github Test Reporter by CTRF 💚 🔄 This comment has been updated |
mkmks
added
the
docker
mkmks
force-pushed
the
fix/enclave/transparent-vsock-proxy
branch
from
25c3181 to
d8209e3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes
Currently, we use chains of proxies to enable network access in the enclave. Thus, it takes
kms-servertwo hops (TCP→vsock→TCP) to communicate with an external API (e.g., AWS) and three hops (TCP→vsock→TCP→vsock→TCP) to communicate with another MPC peer.We began investigating the move to direct IP connectivity as a solution to the performance issues observed in enclave deployments (https://github.com/zama-ai/kms-internal/issues/2633) and while the root cause wasn't the network, we still might want to ditch TCP-vsock proxies in favor of proxying IP.
The advantages are the following:
This PR makes outgoing vsock proxies unneeded by adding a TUN interface in the enclave and on the parent instance joined through vsock and enabling a masquerading NAT. Making it work in a real k8s cluster would probably require creating the parent TUN interface in a privileged container.
Supporting incoming connections would require adding DNAT rules, however, additional work would be probably needed to make them play along with k8s Service declarations.
Issue ticket number and link
Closes https://github.com/zama-ai/kms-internal/issues/2778
PR Checklist
chore: ...).TODO(#issue).unwrap/expect/paniconly in tests or for invariant bugs (documented if present).devopslabel + infra notified + infra-team reviewer assigned.!and affected teams notified.Zeroize+ZeroizeOnDropimplemented.unsafe; if unavoidable: minimal, justified, documented, and test/fuzz covered.