Confidential DataHub Part 4: CDH binary & Attestation API for AA

attestation-agent/app/build.rs

@@ -11,11 +11,16 @@ fn main() -> std::io::Result<()> {
     {
         tonic_build::compile_protos("../protos/keyprovider.proto")?;
         tonic_build::compile_protos("../protos/getresource.proto")?;
+        tonic_build::compile_protos("../protos/attestation-agent.proto")?;
     }
 
     #[cfg(feature = "ttrpc")]
     {
-        let protos = vec!["../protos/keyprovider.proto", "../protos/getresource.proto"];
+        let protos = vec![
+            "../protos/keyprovider.proto",
+            "../protos/getresource.proto",
+            "../protos/attestation-agent.proto",
+        ];
         let protobuf_customized = ProtobufCustomize::default().gen_mod_rs(false);
 
         Codegen::new()

attestation-agent/app/src/grpc.rs

@@ -10,6 +10,7 @@ use std::net::SocketAddr;
 
 const DEFAULT_KEYPROVIDER_ADDR: &str = "127.0.0.1:50000";
 const DEFAULT_GETRESOURCE_ADDR: &str = "127.0.0.1:50001";
+const DEFAULT_ATTESTATION_AGENT_ADDR: &str = "127.0.0.1:50002";
 
 lazy_static! {
     pub static ref ASYNC_ATTESTATION_AGENT: Arc<tokio::sync::Mutex<AttestationAgent>> =
@@ -28,14 +29,23 @@ struct Cli {
     #[arg(default_value_t = DEFAULT_KEYPROVIDER_ADDR.to_string(), short, long = "keyprovider_sock")]
     keyprovider_sock: String,
 
-    /// GetResource ttRPC Unix socket addr.
+    /// GetResource gRPC Unix socket addr.
     ///
     /// This socket address which the GetResource gRPC service
     /// will listen to, for example:
     ///
     /// `--getresource_sock 127.0.0.1:11223`
     #[arg(default_value_t = DEFAULT_GETRESOURCE_ADDR.to_string(), short, long = "getresource_sock")]
     getresource_sock: String,
+
+    /// Attestation gRPC Unix socket addr.
+    ///
+    /// This Unix socket address which the Attestation ttRPC service
+    /// will listen to, for example:
+    ///
+    /// `--attestation_sock 127.0.0.1:11223`
+    #[arg(default_value_t = DEFAULT_ATTESTATION_AGENT_ADDR.to_string(), short, long = "attestation_sock")]
+    attestation_sock: String,
 }
 
 pub async fn grpc_main() -> Result<()> {
@@ -45,6 +55,8 @@ pub async fn grpc_main() -> Result<()> {
 
     let getresource_socket = cli.getresource_sock.parse::<SocketAddr>()?;
 
+    let attestation_socket = cli.attestation_sock.parse::<SocketAddr>()?;
+
     debug!(
         "KeyProvider gRPC service listening on: {:?}",
         cli.keyprovider_sock
@@ -53,8 +65,14 @@ pub async fn grpc_main() -> Result<()> {
         "GetResource gRPC service listening on: {:?}",
         cli.getresource_sock
     );
+    debug!(
+        "Attestation gRPC service listening on: {:?}",
+        cli.attestation_sock
+    );
 
     let keyprovider_server = rpc::keyprovider::grpc::start_grpc_service(keyprovider_socket);
     let getresource_server = rpc::getresource::grpc::start_grpc_service(getresource_socket);
-    tokio::join!(keyprovider_server, getresource_server).0
+    let attestation_server = rpc::attestation::grpc::start_grpc_service(attestation_socket);
+
+    tokio::join!(keyprovider_server, getresource_server, attestation_server).0
 }

attestation-agent/app/src/rpc/attestation/mod.rs

@@ -0,0 +1,188 @@
+// Copyright (c) 2023 Alibaba Cloud
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+use attestation_agent::AttestationAPIs;
+use log::*;
+use std::sync::Arc;
+
+use crate::rpc::AGENT_NAME;
+
+#[derive(Debug, Default)]
+pub struct Attestation {}
+
+#[cfg(feature = "grpc")]
+pub mod grpc {
+    use super::*;
+    use crate::grpc::ASYNC_ATTESTATION_AGENT;
+    use anyhow::*;
+    use attestation::attestation_agent_service_server::{
+        AttestationAgentService, AttestationAgentServiceServer,
+    };
+    use attestation::{GetEvidenceRequest, GetEvidenceResponse, GetTokenRequest, GetTokenResponse};
+    use std::net::SocketAddr;
+    use tonic::{transport::Server, Request, Response, Status};
+
+    mod attestation {
+        tonic::include_proto!("attestation_agent");
+    }
+
+    #[tonic::async_trait]
+    impl AttestationAgentService for Attestation {
+        async fn get_token(
+            &self,
+            request: Request<GetTokenRequest>,
+        ) -> Result<Response<GetTokenResponse>, Status> {
+            let request = request.into_inner();
+
+            let attestation_agent_mutex_clone = Arc::clone(&ASYNC_ATTESTATION_AGENT);
+            let mut attestation_agent = attestation_agent_mutex_clone.lock().await;
+
+            debug!("Call AA to get token ...");
+
+            let token = attestation_agent
+                .get_token(&request.token_type)
+                .await
+                .map_err(|e| {
+                    error!("Call AA to get token failed: {}", e);
+                    Status::internal(format!("[ERROR:{}] AA get token failed: {}", AGENT_NAME, e))
+                })?;
+
+            debug!("Get token successfully!");
+
+            let reply = GetTokenResponse { token };
+
+            Result::Ok(Response::new(reply))
+        }
+
+        async fn get_evidence(
+            &self,
+            request: Request<GetEvidenceRequest>,
+        ) -> Result<Response<GetEvidenceResponse>, Status> {
+            let request = request.into_inner();
+
+            let attestation_agent_mutex_clone = Arc::clone(&ASYNC_ATTESTATION_AGENT);
+            let mut attestation_agent = attestation_agent_mutex_clone.lock().await;
+
+            debug!("Call AA to get evidence ...");
+
+            let evidence = attestation_agent
+                .get_evidence(&request.runtime_data)
+                .await
+                .map_err(|e| {
+                    error!("Call AA to get evidence failed: {}", e);
+                    Status::internal(format!(
+                        "[ERROR:{}] AA get evidence failed: {}",
+                        AGENT_NAME, e
+                    ))
+                })?;
+
+            debug!("Get evidence successfully!");
+
+            let reply = GetEvidenceResponse { evidence };
+
+            Result::Ok(Response::new(reply))
+        }
+    }
+
+    pub async fn start_grpc_service(socket: SocketAddr) -> Result<()> {
+        let service = Attestation::default();
+        Server::builder()
+            .add_service(AttestationAgentServiceServer::new(service))
+            .serve(socket)
+            .await?;
+        Ok(())
+    }
+}
+
+#[cfg(feature = "ttrpc")]
+pub mod ttrpc {
+    use super::*;
+    use crate::rpc::ttrpc_protocol::attestation_agent_ttrpc::{
+        create_attestation_agent_service, AttestationAgentService,
+    };
+    use crate::rpc::ttrpc_protocol::{attestation_agent, attestation_agent_ttrpc};
+    use crate::ttrpc::ASYNC_ATTESTATION_AGENT;
+    use ::ttrpc::asynchronous::Service;
+    use ::ttrpc::proto::Code;
+    use anyhow::*;
+    use async_trait::async_trait;
+
+    use std::collections::HashMap;
+
+    #[async_trait]
+    impl attestation_agent_ttrpc::AttestationAgentService for Attestation {
+        async fn get_token(
+            &self,
+            _ctx: &::ttrpc::r#async::TtrpcContext,
+            req: attestation_agent::GetTokenRequest,
+        ) -> ::ttrpc::Result<attestation_agent::GetTokenResponse> {
+            debug!("Call AA to get token ...");
+
+            let attestation_agent_mutex_clone = ASYNC_ATTESTATION_AGENT.clone();
+            let mut attestation_agent = attestation_agent_mutex_clone.lock().await;
+
+            let token = attestation_agent
+                .get_token(&req.TokenType)
+                .await
+                .map_err(|e| {
+                    error!("Call AA-KBC to get token failed: {}", e);
+                    let mut error_status = ::ttrpc::proto::Status::new();
+                    error_status.set_code(Code::INTERNAL);
+                    error_status.set_message(format!(
+                        "[ERROR:{}] AA-KBC get token failed: {}",
+                        AGENT_NAME, e
+                    ));
+                    ::ttrpc::Error::RpcStatus(error_status)
+                })?;
+
+            debug!("Get token successfully!");
+
+            let mut reply = attestation_agent::GetTokenResponse::new();
+            reply.Token = token;
+
+            ::ttrpc::Result::Ok(reply)
+        }
+
+        async fn get_evidence(
+            &self,
+            _ctx: &::ttrpc::r#async::TtrpcContext,
+            req: attestation_agent::GetEvidenceRequest,
+        ) -> ::ttrpc::Result<attestation_agent::GetEvidenceResponse> {
+            debug!("Call AA to get evidence ...");
+
+            let attestation_agent_mutex_clone = ASYNC_ATTESTATION_AGENT.clone();
+            let mut attestation_agent = attestation_agent_mutex_clone.lock().await;
+
+            let evidence = attestation_agent
+                .get_evidence(&req.RuntimeData)
+                .await
+                .map_err(|e| {
+                    error!("Call AA-KBC to get evidence failed: {}", e);
+                    let mut error_status = ::ttrpc::proto::Status::new();
+                    error_status.set_code(Code::INTERNAL);
+                    error_status.set_message(format!(
+                        "[ERROR:{}] AA-KBC get evidence failed: {}",
+                        AGENT_NAME, e
+                    ));
+                    ::ttrpc::Error::RpcStatus(error_status)
+                })?;
+
+            debug!("Get evidence successfully!");
+
+            let mut reply = attestation_agent::GetEvidenceResponse::new();
+            reply.Evidence = evidence;
+
+            ::ttrpc::Result::Ok(reply)
+        }
+    }
+
+    pub fn start_ttrpc_service() -> Result<HashMap<String, Service>> {
+        let service = Box::new(Attestation {}) as Box<dyn AttestationAgentService + Send + Sync>;
+
+        let service = Arc::new(service);
+        let get_resource_service = create_attestation_agent_service(service);
+        Ok(get_resource_service)
+    }
+}

attestation-agent/app/src/rpc/getresource/mod.rs

@@ -66,7 +66,7 @@ pub mod grpc {
 
     pub async fn start_grpc_service(socket: SocketAddr) -> Result<()> {
         let service = GetResource::default();
-        let _server = Server::builder()
+        Server::builder()
             .add_service(GetResourceServiceServer::new(service))
             .serve(socket)
             .await?;

attestation-agent/app/src/rpc/keyprovider/mod.rs

@@ -133,7 +133,7 @@ pub mod grpc {
 
     pub async fn start_grpc_service(socket: SocketAddr) -> Result<()> {
         let service = KeyProvider::default();
-        let _server = Server::builder()
+        Server::builder()
             .add_service(KeyProviderServiceServer::new(service))
             .serve(socket)
             .await?;

attestation-agent/app/src/rpc/mod.rs

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 
+pub mod attestation;
 pub mod getresource;
 pub mod keyprovider;
 

attestation-agent/app/src/rpc/ttrpc_protocol/mod.rs

@@ -9,3 +9,7 @@ pub mod getresource_ttrpc;
 pub mod keyprovider;
 #[allow(clippy::redundant_field_names)]
 pub mod keyprovider_ttrpc;
+
+pub mod attestation_agent;
+#[allow(clippy::redundant_field_names)]
+pub mod attestation_agent_ttrpc;

attestation-agent/app/src/ttrpc.rs

@@ -25,6 +25,11 @@ const DEFAULT_GETRESOURCE_SOCKET_ADDR: &str = concatcp!(
     DEFAULT_UNIX_SOCKET_DIR,
     "getresource.sock"
 );
+const DEFAULT_ATTESTATION_SOCKET_ADDR: &str = concatcp!(
+    UNIX_SOCKET_PREFIX,
+    DEFAULT_UNIX_SOCKET_DIR,
+    "attestation-agent.sock"
+);
 
 lazy_static! {
     pub static ref ASYNC_ATTESTATION_AGENT: Arc<Mutex<AttestationAgent>> =
@@ -51,6 +56,15 @@ struct Cli {
     /// `--getresource_sock unix:///tmp/aa_getresource`
     #[arg(default_value_t = DEFAULT_GETRESOURCE_SOCKET_ADDR.to_string(), short, long = "getresource_sock")]
     getresource_sock: String,
+
+    /// Attestation ttRPC Unix socket addr.
+    ///
+    /// This Unix socket address which the Attestation ttRPC service
+    /// will listen to, for example:
+    ///
+    /// `--attestation_sock unix:///tmp/attestation`
+    #[arg(default_value_t = DEFAULT_ATTESTATION_SOCKET_ADDR.to_string(), short, long = "attestation_sock")]
+    attestation_sock: String,
 }
 
 pub async fn ttrpc_main() -> Result<()> {
@@ -64,9 +78,13 @@ pub async fn ttrpc_main() -> Result<()> {
         .context("clean previous keyprovider socket file")?;
     clean_previous_sock_file(&cli.getresource_sock)
         .context("clean previous getresource socket file")?;
+    clean_previous_sock_file(&cli.attestation_sock)
+        .context("clean previous attestation socket file")?;
 
     let kp = rpc::keyprovider::ttrpc::start_ttrpc_service()?;
     let gs = rpc::getresource::ttrpc::start_ttrpc_service()?;
+    let att = rpc::attestation::ttrpc::start_ttrpc_service()?;
+
     let mut kps = Server::new()
         .bind(&cli.getresource_sock)
         .context("cannot bind getresource ttrpc service")?
@@ -81,6 +99,13 @@ pub async fn ttrpc_main() -> Result<()> {
 
     gss.start().await?;
 
+    let mut atts = Server::new()
+        .bind(&cli.attestation_sock)
+        .context("cannot bind attestation ttrpc service")?
+        .register_service(att);
+
+    atts.start().await?;
+
     debug!(
         "KeyProvider ttRPC service listening on: {:?}",
         cli.keyprovider_sock
@@ -89,6 +114,10 @@ pub async fn ttrpc_main() -> Result<()> {
         "GetResource ttRPC service listening on: {:?}",
         cli.getresource_sock
     );
+    debug!(
+        "Attestation ttRPC service listening on: {:?}",
+        cli.attestation_sock
+    );
 
     let mut interrupt = signal(SignalKind::interrupt())?;
     let mut hangup = signal(SignalKind::hangup())?;

attestation-agent/kbs_protocol/build.rs

@@ -29,8 +29,8 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
         ttrpc_codegen::Codegen::new()
             .out_dir("src/token_provider/aa")
-            .include("protos")
-            .inputs(["protos/attestation-agent.proto"])
+            .include("../protos")
+            .inputs(["../protos/attestation-agent.proto"])
             .rust_protobuf()
             .customize(ttrpc_codegen::Customize {
                 async_all: true,