From c018b511f811477573cf3d2f5088c7798d486b72 Mon Sep 17 00:00:00 2001 From: Xynnn007 Date: Mon, 6 Jan 2025 15:37:04 +0800 Subject: [PATCH 1/3] Cargo.toml: format the toml file Signed-off-by: Xynnn007 --- Cargo.toml | 4 ++- attestation-agent/kbs_protocol/Cargo.toml | 8 ++--- confidential-data-hub/hub/Cargo.toml | 40 ++++++++++++++++++----- 3 files changed, 39 insertions(+), 13 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 220d61239..6e58b28ff 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -34,7 +34,9 @@ ctr = "0.9.2" env_logger = "0.11.6" hex = "0.4.3" hmac = "0.12.1" -jwt-simple = { version = "0.12", default-features = false, features = ["pure-rust"] } +jwt-simple = { version = "0.12", default-features = false, features = [ + "pure-rust", +] } kbs-types = "0.7.0" log = "0.4.22" nix = "0.29" diff --git a/attestation-agent/kbs_protocol/Cargo.toml b/attestation-agent/kbs_protocol/Cargo.toml index 667969a72..98837421d 100644 --- a/attestation-agent/kbs_protocol/Cargo.toml +++ b/attestation-agent/kbs_protocol/Cargo.toml @@ -16,7 +16,7 @@ env_logger = { workspace = true, optional = true } jwt-simple.workspace = true kbs-types.workspace = true log.workspace = true -protobuf = { workspace = true, optional = true} +protobuf = { workspace = true, optional = true } reqwest = { workspace = true, features = ["cookies", "json"], optional = true } resource_uri.path = "../deps/resource_uri" serde.workspace = true @@ -24,7 +24,7 @@ serde_json.workspace = true sha2.workspace = true thiserror.workspace = true tokio.workspace = true -ttrpc = { workspace = true, optional = true} +ttrpc = { workspace = true, optional = true } url.workspace = true zeroize.workspace = true @@ -33,7 +33,7 @@ rstest.workspace = true serial_test.workspace = true tempfile.workspace = true testcontainers.workspace = true -tokio = { workspace = true, features = [ "rt", "macros", "fs", "process" ]} +tokio = { workspace = true, features = ["rt", "macros", "fs", "process"] } [build-dependencies] ttrpc-codegen = { workspace = true, optional = true } @@ -58,7 +58,7 @@ az-tdx-vtpm-attester = ["attester/az-tdx-vtpm-attester"] snp-attester = ["attester/snp-attester"] csv-attester = ["attester/csv-attester"] cca-attester = ["attester/cca-attester"] -se-attester = ["attester/se-attester"] +se-attester = ["attester/se-attester"] rust-crypto = ["reqwest/rustls-tls", "crypto/rust-crypto"] openssl = ["reqwest/native-tls-vendored", "crypto/openssl"] diff --git a/confidential-data-hub/hub/Cargo.toml b/confidential-data-hub/hub/Cargo.toml index 817b5876f..fc9c96211 100644 --- a/confidential-data-hub/hub/Cargo.toml +++ b/confidential-data-hub/hub/Cargo.toml @@ -39,15 +39,21 @@ base64.workspace = true bincode = { workspace = true, optional = true } cfg-if = { workspace = true, optional = true } chrono = { workspace = true, optional = true } -clap = { workspace = true, features = [ "derive" ], optional = true } +clap = { workspace = true, features = ["derive"], optional = true } config = { workspace = true, optional = true } const_format.workspace = true crypto.path = "../../attestation-agent/deps/crypto" -ehsm_client = {git = "https://github.com/intel/ehsm", rev = "3454cac66b968a593c3edc43410c0b52416bbd3e", optional = true } +ehsm_client = { git = "https://github.com/intel/ehsm", rev = "3454cac66b968a593c3edc43410c0b52416bbd3e", optional = true } env_logger = { workspace = true, optional = true } hex = { workspace = true, optional = true } -image-rs = { path = "../../image-rs", default-features = false, features = ["kata-cc-rustls-tls"] } -kbs_protocol = { path = "../../attestation-agent/kbs_protocol", default-features = false, features = ["passport", "aa_token", "openssl"], optional = true } +image-rs = { path = "../../image-rs", default-features = false, features = [ + "kata-cc-rustls-tls", +] } +kbs_protocol = { path = "../../attestation-agent/kbs_protocol", default-features = false, features = [ + "passport", + "aa_token", + "openssl", +], optional = true } log.workspace = true p12 = { version = "0.6.3", optional = true } prost = { workspace = true, optional = true } @@ -63,7 +69,14 @@ sha2 = { workspace = true, optional = true } strum = { workspace = true, features = ["derive"] } tempfile = { workspace = true, optional = true } thiserror.workspace = true -tokio = { workspace = true, features = [ "fs", "macros", "io-util", "process", "rt-multi-thread", "sync" ] } +tokio = { workspace = true, features = [ + "fs", + "macros", + "io-util", + "process", + "rt-multi-thread", + "sync", +] } toml.workspace = true tonic = { workspace = true, optional = true } ttrpc = { workspace = true, features = ["async"], optional = true } @@ -84,13 +97,24 @@ nix.workspace = true rstest.workspace = true serial_test.workspace = true tempfile.workspace = true -tokio = { workspace = true, features = ["rt", "macros" ] } +tokio = { workspace = true, features = ["rt", "macros"] } [features] default = ["aliyun", "kbs", "bin", "ttrpc", "grpc", "cli"] # support aliyun stacks (KMS, ..) -aliyun = ["chrono", "hex", "p12", "prost", "reqwest/rustls-tls", "sha2", "tempfile", "tonic", "url", "yasna"] +aliyun = [ + "chrono", + "hex", + "p12", + "prost", + "reqwest/rustls-tls", + "sha2", + "tempfile", + "tonic", + "url", + "yasna", +] # support coco-KBS to provide confidential resources kbs = ["kbs_protocol"] @@ -102,7 +126,7 @@ sev = ["bincode", "dep:sev", "prost", "tonic", "uuid"] ehsm = ["ehsm_client"] # Binary RPC type -bin = [ "anyhow", "cfg-if", "clap", "config", "env_logger", "serde" ] +bin = ["anyhow", "cfg-if", "clap", "config", "env_logger", "serde"] ttrpc = ["dep:ttrpc", "protobuf", "ttrpc-codegen", "tokio/signal"] grpc = ["prost", "tonic", "tokio/signal"] From 3f168ccf7af61de32272018a20d6e4a5eaad1833 Mon Sep 17 00:00:00 2001 From: Xynnn007 Date: Mon, 6 Jan 2025 15:34:24 +0800 Subject: [PATCH 2/3] AA/kbs_protocol: rename feature name aa_token to aa_ttrpc This feature enables dependencies to leverage ttrpc capabilities to connect to AA via ttrpc, thus `aa_ttrpc` is a better name for future extension. Signed-off-by: Xynnn007 --- attestation-agent/kbs_protocol/Cargo.toml | 4 ++-- attestation-agent/kbs_protocol/build.rs | 2 +- attestation-agent/kbs_protocol/src/token_provider/mod.rs | 4 ++-- confidential-data-hub/hub/Cargo.toml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/attestation-agent/kbs_protocol/Cargo.toml b/attestation-agent/kbs_protocol/Cargo.toml index 98837421d..411f212f3 100644 --- a/attestation-agent/kbs_protocol/Cargo.toml +++ b/attestation-agent/kbs_protocol/Cargo.toml @@ -46,8 +46,8 @@ required-features = ["bin"] default = ["background_check", "passport", "rust-crypto", "all-attesters"] passport = [] -# use a client of attestation-agent to get token for kbs -aa_token = ["ttrpc-codegen", "passport", "ttrpc/async", "protobuf"] +# Allow to connect Attestation-Agent with TTRPC to get evidence, token, etc. +aa_ttrpc = ["ttrpc-codegen", "passport", "ttrpc/async", "protobuf"] background_check = ["tokio/time"] all-attesters = ["attester/all-attesters"] diff --git a/attestation-agent/kbs_protocol/build.rs b/attestation-agent/kbs_protocol/build.rs index 5bb896da4..4e28c31e6 100644 --- a/attestation-agent/kbs_protocol/build.rs +++ b/attestation-agent/kbs_protocol/build.rs @@ -4,7 +4,7 @@ // fn main() -> Result<(), Box> { - #[cfg(feature = "aa_token")] + #[cfg(feature = "aa_ttrpc")] { use std::fs::File; use std::io::{Read, Write}; diff --git a/attestation-agent/kbs_protocol/src/token_provider/mod.rs b/attestation-agent/kbs_protocol/src/token_provider/mod.rs index 8f4d7ae88..6648e89c5 100644 --- a/attestation-agent/kbs_protocol/src/token_provider/mod.rs +++ b/attestation-agent/kbs_protocol/src/token_provider/mod.rs @@ -6,9 +6,9 @@ pub mod test; pub use test::*; -#[cfg(feature = "aa_token")] +#[cfg(feature = "aa_ttrpc")] pub mod aa; -#[cfg(feature = "aa_token")] +#[cfg(feature = "aa_ttrpc")] pub use aa::*; use anyhow::*; diff --git a/confidential-data-hub/hub/Cargo.toml b/confidential-data-hub/hub/Cargo.toml index fc9c96211..a36a569f8 100644 --- a/confidential-data-hub/hub/Cargo.toml +++ b/confidential-data-hub/hub/Cargo.toml @@ -51,7 +51,7 @@ image-rs = { path = "../../image-rs", default-features = false, features = [ ] } kbs_protocol = { path = "../../attestation-agent/kbs_protocol", default-features = false, features = [ "passport", - "aa_token", + "aa_ttrpc", "openssl", ], optional = true } log.workspace = true From 198e196a952f1849060fbdb3fcb295bca9d75b45 Mon Sep 17 00:00:00 2001 From: Xynnn007 Date: Mon, 6 Jan 2025 15:39:28 +0800 Subject: [PATCH 3/3] AA/kbs_protocol: add AAEvidenceProvider AAEvidenceProvider gets evidence via ttrpc from AA. This patch also does some refactoring upon the code structure of ttrpc to avoid duplication of ttrpc files. Signed-off-by: Xynnn007 --- attestation-agent/kbs_protocol/build.rs | 4 +- attestation-agent/kbs_protocol/src/error.rs | 3 + .../kbs_protocol/src/evidence_provider/aa.rs | 70 +++++++++++++++++++ .../kbs_protocol/src/evidence_provider/mod.rs | 5 ++ attestation-agent/kbs_protocol/src/lib.rs | 2 + .../kbs_protocol/src/token_provider/aa/mod.rs | 12 ++-- .../aa => ttrpc_protos}/attestation_agent.rs | 0 .../attestation_agent_ttrpc.rs | 0 .../kbs_protocol/src/ttrpc_protos/mod.rs | 7 ++ 9 files changed, 94 insertions(+), 9 deletions(-) create mode 100644 attestation-agent/kbs_protocol/src/evidence_provider/aa.rs rename attestation-agent/kbs_protocol/src/{token_provider/aa => ttrpc_protos}/attestation_agent.rs (100%) rename attestation-agent/kbs_protocol/src/{token_provider/aa => ttrpc_protos}/attestation_agent_ttrpc.rs (100%) create mode 100644 attestation-agent/kbs_protocol/src/ttrpc_protos/mod.rs diff --git a/attestation-agent/kbs_protocol/build.rs b/attestation-agent/kbs_protocol/build.rs index 4e28c31e6..4998a27cc 100644 --- a/attestation-agent/kbs_protocol/build.rs +++ b/attestation-agent/kbs_protocol/build.rs @@ -28,7 +28,7 @@ fn main() -> Result<(), Box> { } ttrpc_codegen::Codegen::new() - .out_dir("src/token_provider/aa") + .out_dir("src/ttrpc_protos") .include("../protos") .inputs(["../protos/attestation-agent.proto"]) .rust_protobuf() @@ -42,7 +42,7 @@ fn main() -> Result<(), Box> { // Fix clippy warnings of code generated from ttrpc_codegen replace_text_in_file( - "src/token_provider/aa/attestation_agent_ttrpc.rs", + "src/ttrpc_protos/attestation_agent_ttrpc.rs", "client: client", "client", )?; diff --git a/attestation-agent/kbs_protocol/src/error.rs b/attestation-agent/kbs_protocol/src/error.rs index 5a75d59cb..15cbb4fac 100644 --- a/attestation-agent/kbs_protocol/src/error.rs +++ b/attestation-agent/kbs_protocol/src/error.rs @@ -9,6 +9,9 @@ pub type Result = std::result::Result; #[derive(Error, Debug)] pub enum Error { + #[error("Attestation Agent evidence provider error: {0}")] + AAEvidenceProvider(String), + #[error("Attestation Agent token provider error: {0}")] AATokenProvider(String), diff --git a/attestation-agent/kbs_protocol/src/evidence_provider/aa.rs b/attestation-agent/kbs_protocol/src/evidence_provider/aa.rs new file mode 100644 index 000000000..0fbc2c74f --- /dev/null +++ b/attestation-agent/kbs_protocol/src/evidence_provider/aa.rs @@ -0,0 +1,70 @@ +// Copyright (c) 2024 Alibaba Cloud +// +// SPDX-License-Identifier: Apache-2.0 +// + +use async_trait::async_trait; +use kbs_types::Tee; +use serde_json::json; +use ttrpc::context; + +use crate::{ + ttrpc_protos::{ + attestation_agent::{GetEvidenceRequest, GetTeeTypeRequest}, + attestation_agent_ttrpc::AttestationAgentServiceClient, + }, + Error, Result, +}; + +use super::EvidenceProvider; + +const AA_SOCKET_FILE: &str = + "unix:///run/confidential-containers/attestation-agent/attestation-agent.sock"; + +pub struct AAEvidenceProvider { + client: AttestationAgentServiceClient, +} + +impl AAEvidenceProvider { + pub async fn new() -> Result { + let c = ttrpc::r#async::Client::connect(AA_SOCKET_FILE) + .map_err(|e| Error::AATokenProvider(format!("ttrpc connect failed {e}")))?; + let client = AttestationAgentServiceClient::new(c); + Ok(Self { client }) + } +} + +#[async_trait] +impl EvidenceProvider for AAEvidenceProvider { + /// Get evidence with as runtime data (report data, challege) + async fn get_evidence(&self, runtime_data: Vec) -> Result { + let req = GetEvidenceRequest { + RuntimeData: runtime_data, + ..Default::default() + }; + let res = self + .client + .get_evidence(context::with_timeout(50 * 1000 * 1000 * 1000), &req) + .await + .map_err(|e| Error::AAEvidenceProvider(format!("call ttrpc failed: {e}")))?; + let evidence = String::from_utf8(res.Evidence) + .map_err(|e| Error::AAEvidenceProvider(format!("non-utf8 evidence: {e}")))?; + Ok(evidence) + } + + /// Get the underlying Tee type + async fn get_tee_type(&self) -> Result { + let req = GetTeeTypeRequest { + ..Default::default() + }; + let res = self + .client + .get_tee_type(context::with_timeout(50 * 1000 * 1000 * 1000), &req) + .await + .map_err(|e| Error::AAEvidenceProvider(format!("call ttrpc failed: {e}")))?; + + let tee = serde_json::from_value(json!(res.tee)) + .map_err(|e| Error::AAEvidenceProvider(format!("failed to parse Tee type: {e}")))?; + Ok(tee) + } +} diff --git a/attestation-agent/kbs_protocol/src/evidence_provider/mod.rs b/attestation-agent/kbs_protocol/src/evidence_provider/mod.rs index 51b8fea33..c13b9a647 100644 --- a/attestation-agent/kbs_protocol/src/evidence_provider/mod.rs +++ b/attestation-agent/kbs_protocol/src/evidence_provider/mod.rs @@ -9,6 +9,11 @@ pub use native::*; pub mod mock; pub use mock::*; +#[cfg(feature = "aa_ttrpc")] +pub mod aa; +#[cfg(feature = "aa_ttrpc")] +pub use aa::*; + use crate::Result; use async_trait::async_trait; use kbs_types::Tee; diff --git a/attestation-agent/kbs_protocol/src/lib.rs b/attestation-agent/kbs_protocol/src/lib.rs index eb4bd6d0b..59cd5b1aa 100644 --- a/attestation-agent/kbs_protocol/src/lib.rs +++ b/attestation-agent/kbs_protocol/src/lib.rs @@ -77,6 +77,8 @@ pub mod error; pub mod evidence_provider; pub mod keypair; pub mod token_provider; +#[cfg(feature = "aa_ttrpc")] +pub mod ttrpc_protos; pub use api::*; pub use builder::KbsClientBuilder; diff --git a/attestation-agent/kbs_protocol/src/token_provider/aa/mod.rs b/attestation-agent/kbs_protocol/src/token_provider/aa/mod.rs index 94593fbb3..970666287 100644 --- a/attestation-agent/kbs_protocol/src/token_provider/aa/mod.rs +++ b/attestation-agent/kbs_protocol/src/token_provider/aa/mod.rs @@ -5,17 +5,15 @@ //! This is a token provider which connects the attestation-agent -mod attestation_agent; -mod attestation_agent_ttrpc; - use async_trait::async_trait; use serde::Deserialize; use ttrpc::context; -use crate::{Error, Result, TeeKeyPair, Token}; - -use self::{ - attestation_agent::GetTokenRequest, attestation_agent_ttrpc::AttestationAgentServiceClient, +use crate::{ + ttrpc_protos::{ + attestation_agent::GetTokenRequest, attestation_agent_ttrpc::AttestationAgentServiceClient, + }, + Error, Result, TeeKeyPair, Token, }; use super::TokenProvider; diff --git a/attestation-agent/kbs_protocol/src/token_provider/aa/attestation_agent.rs b/attestation-agent/kbs_protocol/src/ttrpc_protos/attestation_agent.rs similarity index 100% rename from attestation-agent/kbs_protocol/src/token_provider/aa/attestation_agent.rs rename to attestation-agent/kbs_protocol/src/ttrpc_protos/attestation_agent.rs diff --git a/attestation-agent/kbs_protocol/src/token_provider/aa/attestation_agent_ttrpc.rs b/attestation-agent/kbs_protocol/src/ttrpc_protos/attestation_agent_ttrpc.rs similarity index 100% rename from attestation-agent/kbs_protocol/src/token_provider/aa/attestation_agent_ttrpc.rs rename to attestation-agent/kbs_protocol/src/ttrpc_protos/attestation_agent_ttrpc.rs diff --git a/attestation-agent/kbs_protocol/src/ttrpc_protos/mod.rs b/attestation-agent/kbs_protocol/src/ttrpc_protos/mod.rs new file mode 100644 index 000000000..318ec1468 --- /dev/null +++ b/attestation-agent/kbs_protocol/src/ttrpc_protos/mod.rs @@ -0,0 +1,7 @@ +// Copyright (c) 2024 Alibaba Cloud +// +// SPDX-License-Identifier: Apache-2.0 +// + +pub mod attestation_agent; +pub mod attestation_agent_ttrpc;