Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Move AA abilities to CDH #427

Merged
merged 10 commits into from
Jan 12, 2024
Merged

Move AA abilities to CDH #427

merged 10 commits into from
Jan 12, 2024

Commits on Jan 9, 2024

  1. image-rs: use CDH for GetResource API and abondon AA lib dep 

    As stated in confidential-containers#412, AA will never be used as a component that provides
abilities more than attestation. This commit changes the ttrpc socket
path from AA to CDH for image-rs to GetResource API.

Also, for enclave-cc, the Native resource client will instead use the
kbs_protocol crate to do the RCAR handshake and do GetResource.

For gRPC, we still use the legacy address, but the API was changed as we
do not assume that the API is provided by AA but CDH.

Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    3003ef5 View commit details
    Browse the repository at this point in the history

  2. ocicrypt-rs: abondon AA lib dep for UnwrapKey 

    As stated in confidential-containers#412, AA will never be used as a component that provides
abilities more than attestation. This commit changes the AA lib calling
to decrypt image.

This will influence enclave-cc behavior.

Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    1754b55 View commit details
    Browse the repository at this point in the history

  3. CDH: fix feature dependencies 

    Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    9ec57f1 View commit details
    Browse the repository at this point in the history

  4. ci: delete duplicated ocicrypt-rs test cases 

    Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    3abdeba View commit details
    Browse the repository at this point in the history

  5. CDH: add log for launch and requests 

    add logs for every request. Also deletes previous ttrpc socket file
every time the CDH launches.

Also, create the parent directory tree when given a unix socket path.

Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    a628283 View commit details
    Browse the repository at this point in the history

  6. CDH: update ttrpc generated files 

    Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    2be47c3 View commit details
    Browse the repository at this point in the history

  7. CDH: delete default RESOURCE_PROVIDER in Makefile 

    Before this commit, if we do not specify the RESOURCE_PROVIDER field
when make, kbs and sev features will be enabled. This will prevent
offline-fs-kbc from being activated.

This patch requires programmers that manually provide the
RESOURCE_PROVIDER parameter when executing make command.

Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    01314df View commit details
    Browse the repository at this point in the history

  8. CDH/hub: fix the KeyProvider Protobuf 

    In protobuf, the `package` matters when a client calls to a server. In
ocicrypt-rs, the proto of KeyProvider follows ocicrypt standard, where
the package is `keyprovider`.

We once use a common name `api` for all apis of CDH, but this does not
follow the ocicrypt standard.

This patch splits the ocicrypt parts into a separate proto file, whose
package is `keyprovider`.

Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    49e3569 View commit details
    Browse the repository at this point in the history

  9. CDH/image: fix unwrap key logic 

    1. Fix the place of AnnotationPacket. The old code points to a wrong
place that was never test so we never found that.
2. Fix the provider comparation logic. The scheme of KBS should be `kbs`
rather than `Kbs`.

Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    9c01cd0 View commit details
    Browse the repository at this point in the history

  10. image-rs: fix integration test 

    We used to request AA for image decryption keys and public keys, etc.
Now we are using CDH for these non-attestation APIs.

This patch brings a workaround that make the test environment look like
it is a "peer pod" environment, then the CDH will read aa_kbc_params
from a file rather than kernel cmdline.

In future, we will define a launch configuration file for CDH. After
that, this workaround can be depreciated.

Signed-off-by: Xynnn007 <[email protected]>
    @Xynnn007
    Xynnn007 committed Jan 9, 2024
    Configuration menu
    Copy the full SHA
    68523c5 View commit details
    Browse the repository at this point in the history