forked from confidential-containers/guest-components
-
Notifications
You must be signed in to change notification settings - Fork 0
/
rcar_client.rs
371 lines (328 loc) · 13 KB
/
rcar_client.rs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
// Copyright (c) 2023 Alibaba Cloud
//
// SPDX-License-Identifier: Apache-2.0
//
use std::time::Duration;
use anyhow::{bail, Context};
use async_trait::async_trait;
use base64::{engine::general_purpose::STANDARD, Engine};
use kbs_types::{Attestation, Challenge, ErrorInformation, Request, Response, Tee};
use log::{debug, warn};
use resource_uri::ResourceUri;
use serde::Deserialize;
use serde_json::json;
use sha2::{Digest, Sha384};
use crate::{
api::KbsClientCapabilities,
client::{
ClientTee, KbsClient, KBS_GET_RESOURCE_MAX_ATTEMPT, KBS_PREFIX, KBS_PROTOCOL_VERSION,
},
evidence_provider::EvidenceProvider,
keypair::TeeKeyPair,
token_provider::Token,
Error, Result,
};
/// When executing get token, RCAR handshake should retry if failed to
/// make the logic robust. This constant is the max retry times.
const RCAR_MAX_ATTEMPT: i32 = 5;
/// The interval (seconds) between RCAR handshake retries.
const RCAR_RETRY_TIMEOUT_SECOND: u64 = 1;
#[derive(Deserialize, Debug, Clone)]
struct AttestationResponseData {
// Attestation token in JWT format
token: String,
}
impl KbsClient<Box<dyn EvidenceProvider>> {
/// Get a [`TeeKeyPair`] and a [`Token`] that certifies the [`TeeKeyPair`].
/// It will check if the client already has a valid token. If so, return
/// the token. If not, the client will generate a new key pair and do a new
/// RCAR handshaking.
pub async fn get_token(&mut self) -> Result<(Token, TeeKeyPair)> {
if let Some(token) = &self.token {
if token.check_valid().is_err() {
let mut retry_times = 1;
loop {
let res = self
.rcar_handshake()
.await
.map_err(|e| Error::RcarHandshake(e.to_string()));
match res {
Ok(_) => break,
Err(e) => {
if retry_times >= RCAR_MAX_ATTEMPT {
return Err(Error::RcarHandshake(format!("Get token failed because of RCAR handshake retried {RCAR_MAX_ATTEMPT} times.")));
} else {
warn!("RCAR handshake failed: {e}, retry {retry_times}...");
retry_times += 1;
tokio::time::sleep(Duration::from_secs(RCAR_RETRY_TIMEOUT_SECOND))
.await;
}
}
}
}
}
} else {
let mut retry_times = 1;
loop {
let res = self
.rcar_handshake()
.await
.map_err(|e| Error::RcarHandshake(e.to_string()));
match res {
Ok(_) => break,
Err(e) => {
if retry_times >= RCAR_MAX_ATTEMPT {
return Err(Error::RcarHandshake(format!("Get token failed because of RCAR handshake retried {RCAR_MAX_ATTEMPT} times.")));
} else {
warn!("RCAR handshake failed: {e}, retry {retry_times}...");
retry_times += 1;
tokio::time::sleep(Duration::from_secs(RCAR_RETRY_TIMEOUT_SECOND))
.await;
}
}
}
}
}
assert!(self.token.is_some());
let token = self.token.clone().unwrap();
let tee_key = self.tee_key.clone();
Ok((token, tee_key))
}
/// Perform RCAR handshake with the given kbs host. If succeeds, the client will
/// store the token.
///
/// Note: if RCAR succeeds, the http client will record the cookie with the kbs server,
/// which means that this client can be then used to retrieve resources.
async fn rcar_handshake(&mut self) -> anyhow::Result<()> {
let auth_endpoint = format!("{}/{KBS_PREFIX}/auth", self.kbs_host_url);
let tee = match &self._tee {
ClientTee::Unitialized => {
let tee = self.provider.get_tee_type().await?;
self._tee = ClientTee::_Initializated(tee);
tee
}
ClientTee::_Initializated(tee) => *tee,
};
let request = Request {
version: String::from(KBS_PROTOCOL_VERSION),
tee,
extra_params: String::new(),
};
debug!("send auth request to {auth_endpoint}");
let challenge = self
.http_client
.post(auth_endpoint)
.header("Content-Type", "application/json")
.json(&request)
.send()
.await?
.json::<Challenge>()
.await?;
debug!("get challenge: {challenge:#?}");
let tee_pubkey = self.tee_key.export_pubkey()?;
let runtime_data = json!({
"tee-pubkey": tee_pubkey,
"nonce": challenge.nonce,
});
let runtime_data =
serde_json::to_string(&runtime_data).context("serialize runtime data failed")?;
let evidence = self
.generate_evidence(tee, runtime_data, challenge.nonce)
.await?;
debug!("get evidence with challenge: {evidence}");
let attest_endpoint = format!("{}/{KBS_PREFIX}/attest", self.kbs_host_url);
let attest = Attestation {
tee_pubkey,
tee_evidence: evidence,
};
debug!("send attest request.");
let attest_response = self
.http_client
.post(attest_endpoint)
.header("Content-Type", "application/json")
.json(&attest)
.send()
.await?;
match attest_response.status() {
reqwest::StatusCode::OK => {
let resp = attest_response.json::<AttestationResponseData>().await?;
let token = Token::new(resp.token)?;
self.token = Some(token);
}
reqwest::StatusCode::UNAUTHORIZED => {
let error_info = attest_response.json::<ErrorInformation>().await?;
bail!("KBS attest unauthorized, Error Info: {:?}", error_info);
}
_ => {
bail!(
"KBS Server Internal Failed, Response: {:?}",
attest_response.text().await?
);
}
}
Ok(())
}
async fn generate_evidence(
&self,
tee: Tee,
runtime_data: String,
nonce: String,
) -> Result<String> {
debug!("Challenge nonce: {nonce}");
let mut hasher = Sha384::new();
hasher.update(runtime_data);
let ehd = match tee {
// IBM SE uses nonce as runtime_data to pass attestation_request
Tee::Se => STANDARD
.decode(nonce)
.map_err(|e| Error::GetEvidence(e.to_string()))?,
_ => hasher.finalize().to_vec(),
};
let tee_evidence = self
.provider
.get_evidence(ehd)
.await
.context("Get TEE evidence failed")
.map_err(|e| Error::GetEvidence(e.to_string()))?;
Ok(tee_evidence)
}
}
#[async_trait]
impl KbsClientCapabilities for KbsClient<Box<dyn EvidenceProvider>> {
async fn get_resource(&mut self, resource_uri: ResourceUri) -> Result<Vec<u8>> {
let remote_url = format!(
"{}/{KBS_PREFIX}/resource/{}/{}/{}",
self.kbs_host_url, resource_uri.repository, resource_uri.r#type, resource_uri.tag
);
for attempt in 1..=KBS_GET_RESOURCE_MAX_ATTEMPT {
debug!("KBS client: trying to request KBS, attempt {attempt}");
let res = self
.http_client
.get(&remote_url)
.send()
.await
.map_err(|e| Error::HttpError(format!("get failed: {e}")))?;
match res.status() {
reqwest::StatusCode::OK => {
let response = res
.json::<Response>()
.await
.map_err(|e| Error::KbsResponseDeserializationFailed(e.to_string()))?;
let payload_data = self
.tee_key
.decrypt_response(response)
.map_err(|e| Error::DecryptResponseFailed(e.to_string()))?;
return Ok(payload_data);
}
reqwest::StatusCode::UNAUTHORIZED => {
warn!(
"Authenticating with KBS failed. Perform a new RCAR handshake: {:#?}",
res.json::<ErrorInformation>()
.await
.map_err(|e| Error::KbsResponseDeserializationFailed(e.to_string()))?,
);
self.rcar_handshake()
.await
.map_err(|e| Error::RcarHandshake(e.to_string()))?;
continue;
}
reqwest::StatusCode::NOT_FOUND => {
let errorinfo = format!(
"KBS resource Not Found (Error 404): {:#?}",
res.json::<ErrorInformation>()
.await
.map_err(|e| Error::KbsResponseDeserializationFailed(e.to_string()))?
);
return Err(Error::ResourceNotFound(errorinfo));
}
_ => {
let errorinfo = format!(
"KBS Server Internal Failed, Response: {:#?}",
res.json::<ErrorInformation>()
.await
.map_err(|e| Error::KbsResponseDeserializationFailed(e.to_string()))?
);
return Err(Error::KbsInternalError(errorinfo));
}
}
}
Err(Error::UnAuthorized)
}
}
#[cfg(test)]
mod test {
use std::{env, path::PathBuf, time::Duration};
use testcontainers::{clients, images::generic::GenericImage};
use tokio::fs;
use crate::{
evidence_provider::NativeEvidenceProvider, KbsClientBuilder, KbsClientCapabilities,
};
const CONTENT: &[u8] = b"test content";
#[tokio::test]
#[serial_test::serial]
async fn test_client() {
// prepare test resource
let tmp = tempfile::tempdir().expect("create tempdir");
let mut resource_path = PathBuf::new();
resource_path.push(tmp.path());
resource_path.push("default/key");
fs::create_dir_all(resource_path.clone())
.await
.expect("create resource path");
resource_path.push("testfile");
fs::write(resource_path.clone(), CONTENT)
.await
.expect("write content");
// launch kbs
let docker = clients::Cli::default();
// we should change the entrypoint of the kbs image by using
// a start script
let mut start_kbs_script = env::current_dir().expect("get cwd");
let mut kbs_config = start_kbs_script.clone();
let mut policy = start_kbs_script.clone();
start_kbs_script.push("test/start_kbs.sh");
kbs_config.push("test/kbs-config.toml");
policy.push("test/policy.rego");
let image = GenericImage::new(
"ghcr.io/confidential-containers/staged-images/kbs",
"latest",
)
.with_exposed_port(8085)
.with_volume(
tmp.path().as_os_str().to_string_lossy(),
"/opt/confidential-containers/kbs/repository",
)
.with_volume(
start_kbs_script.into_os_string().to_string_lossy(),
"/usr/local/bin/start_kbs.sh",
)
.with_volume(
kbs_config.into_os_string().to_string_lossy(),
"/etc/kbs-config.toml",
)
.with_volume(
policy.into_os_string().to_string_lossy(),
"/opa/confidential-containers/kbs/policy.rego",
)
.with_entrypoint("/usr/local/bin/start_kbs.sh");
let kbs = docker.run(image);
tokio::time::sleep(Duration::from_secs(10)).await;
let port = kbs.get_host_port_ipv4(8085);
let kbs_host_url = format!("http://127.0.0.1:{port}");
let evidence_provider = Box::new(NativeEvidenceProvider::new().unwrap());
let mut client = KbsClientBuilder::with_evidence_provider(evidence_provider, &kbs_host_url)
.build()
.expect("client create");
let resource_uri = "kbs:///default/key/testfile"
.try_into()
.expect("resource uri");
let resource = client
.get_resource(resource_uri)
.await
.expect("get resource");
assert_eq!(resource, CONTENT);
let (token, key) = client.get_token().await.expect("get token");
println!("Get token : {token:?}");
println!("Get key: {key:?}");
}
}