DNS and TLS proxy

[kgrofelnik]

Overview

This PR introduces a host-side networking proxy that facilitates DNS resolution and traffic forwarding between a Nitro Enclave and external services. It ensures that:

• DNS queries from the enclave are forwarded via vsock to the host and then resolved using system DNS.
• TLS (HTTPS) requests from the enclave are forwarded to their original destinations using a host-side proxy.

Implementation details

DNS Forwarder (dns_forwarder.py)

• listens on vsock port 5053, receiving DNS queries from the enclave.
• extracts the system’s primary DNS server from /etc/resolv.conf.
• forwards DNS requests to a public DNS resolver (system-configured or Google 8.8.8.8).
• returns the resolved IP to the enclave via vsock.

Traffic Forwarder (traffic_forwarder.py)

• listens on vsock port 8001, handling HTTPS requests from the enclave.
• extracts the original IP and port from incoming packets (pre-pended by the enclave proxy).
• forwards traffic to its actual destination over the internet.

[h4n0]

How could the enclave CID be a constant? There should also be multiple CIDs for multiple enclaves, isn't it?

[kgrofelnik]

This is the host side.

The CID used by the parent instance is always 3.

[h4n0]

yep, but according to the usage, the vsock_server.bind((self.CID, self.PORT)) should be connecting to the enclave IIUC. so here shouldn't we provide the enclave CID?

[kgrofelnik]

Actually, this line doesn't open a connection to an enclave; instead, it binds the socket to a specific address pair (CID, PORT) so it can wait for incoming connections from enclaves.