feat: Restructure VSOCK code as a starting point for improvements

[Bownairo]

There should be very few real code changes. My goal was to simplify the structure to make the later changes easier to follow. I suggest reviewing by commit.

[zeropath-ai]

❌ 1 possible security or compliance issue detected. Reviewed everything up to f2bdd93.

The following issues were found:

• Issue 1: Improper Authentication

  • Location: rs/ic_os/vsock/src/server/mod.rs:26-95
  • Score: HIGH (78.0)
  • Description: The new VSOCK server accepts JSON commands from any guest VM that can reach the listener and executes powerful HostOS maintenance actions, including downloading an arbitrary upgrade payload, invoking the installer, and scheduling a reboot. The only gate is that the peer CID matches the request's guest_cid and equals the hard-coded first-guest CID; there is no cryptographic authentication, authorization token, or command allowlist beyond this transport-level check. A compromised or malicious guest VM on the same host can therefore issue Upgrade or StartUpgradeGuestVM commands and force HostOS to fetch attacker-chosen content and restart services.

Evidence: In process_connection, after parsing the untrusted request, the server only checks request.guest_cid != VIR_VSOCK_GUEST_CID_MIN and verify_sender_cid(stream, request.guest_cid) before dispatching to upgrade_hostos(upgrade_data) and start_upgrade_guest_vm().

Relevant code:

• if request.guest_cid != VIR_VSOCK_GUEST_CID_MIN { ... ConnectionRefused ... }
• if let Err(err) = verify_sender_cid(stream, request.guest_cid) { ... }
• Command::Upgrade(upgrade_data) => upgrade_hostos(upgrade_data),
• Command::StartUpgradeGuestVM => start_upgrade_guest_vm(),

upgrade_hostos then downloads from upgrade_data.url and runs /opt/ic/bin/install-upgrade.sh followed by shutdown --reboot.

• Link to UI: https://zeropath.com/app/issues/5464978d-b444-478e-a938-844b43ce4c69 (Issue 1, id: 5464978d-b444-478e-a938-844b43ce4c69)

Security Overview

• 🔎 Scanned files: 31 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6992424c-495e-4621-b441-efd6821a4be6?scanId=93d64766-16ab-4046-b913-b81ba2ec2311&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Refactor	► rs/ic_os/vsock/vsock_lib/BUILD.bazel     Rename and adjust VSock library build to reference new paths and targets
Refactor	► rs/ic_os/vsock/BUILD.bazel     Update VSock library dependency path references
Refactor	► rs/ic_os/vsock/vsock_lib/Cargo.toml     Move clap dependency to workspace context and adjust path reference for ic-http-utils
Refactor	► rs/ic_os/vsock/vsock_lib/src/guest/... (multiple files moved/renamed from vsock_lib to new vsock path structure)
Refactor	► rs/ic_os/vsock/vsock_lib/src/lib.rs     Remove old module structure references (guest, host, protocol) and adjust exports
Refactor	► rs/ic_os/vsock/vsock_lib/src/protocol/mod.rs     Remove module exports (structures, utils) and associated files moved to new location
Refactor	► rs/ic_os/vsock/vsock_lib/src/host/command_utilities.rs     Rename/move to vsock/src/server/command_utilities.rs
Refactor	► rs/ic_os/vsock/vsock_lib/src/host/hsm.rs     Rename/move to vsock/src/server/hsm.rs
Refactor	► rs/ic_os/vsock/vsock_lib/src/host/mod.rs     Remove and relocate host module contents; file deleted
Refactor	► rs/ic_os/vsock/vsock_lib/src/guest/client.rs     Delete and relocate guest client logic to new path (ladder of changes)
Refactor	► rs/ic_os/vsock/src/server/mod.rs     New server module with full server implementation (command dispatch, parse, verify, etc.)
Enhancement	► rs/ic_os/vsock/src/server/upgrade.rs     Add upgrade functionality for host OS upgrade flow
Enhancement	► rs/ic_os/vsock/src/server/misc.rs     Add host OS version and notify logic, plus miscellaneous helpers
Enhancement	► rs/ic_os/vsock/src/server/command_utilities.rs     Relocated and renamed command utilities functionality
Enhancement	► rs/ic_os/vsock/src/server/hsm.rs     Relocated HSM related logic to new server module
Enhancement	► rs/ic_os/vsock/src/lib.rs     Expose VSock client/server and protocol modules (new structure)
Bug Fix	(none explicitly)