-
Notifications
You must be signed in to change notification settings - Fork 47
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
aproxy: Use static registrar for backend protocol
When other attestation protocols are implemented for the backend attestation server communication, they can register themselves with the BACKEND registrar as well. Signed-off-by: Tyler Fanelli <[email protected]>
- Loading branch information
1 parent
ad7b3e9
commit e2f36a7
Showing
6 changed files
with
97 additions
and
61 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,19 +5,26 @@ | |
| // Author: Stefano Garzarella <[email protected]> | ||
| // Author: Tyler Fanelli <[email protected]> | ||
|
|
||
| use crate::backend; | ||
| use crate::backend::BACKEND; | ||
| use anyhow::Context; | ||
| use libaproxy::*; | ||
| use reqwest::{blocking::Client, cookie::Jar}; | ||
| use serde::Serialize; | ||
| use std::{ | ||
| io::{Read, Write}, | ||
| os::unix::net::UnixStream, | ||
| sync::Arc, | ||
| }; | ||
|
|
||
| /// Attest an SVSM client session. | ||
| pub fn attest(stream: &mut UnixStream, http: &mut backend::HttpClient) -> anyhow::Result<()> { | ||
| negotiation(stream, http)?; | ||
| attestation(stream, http)?; | ||
| pub fn attest(stream: &mut UnixStream) -> anyhow::Result<()> { | ||
| let http = Client::builder() | ||
| .cookie_provider(Arc::new(Jar::default())) | ||
| .build() | ||
| .context("unable to build HTTP client to interact with attestation server")?; | ||
|
|
||
| negotiation(stream, &http)?; | ||
| attestation(stream, &http)?; | ||
|
|
||
| Ok(()) | ||
| } | ||
|
|
@@ -27,7 +34,7 @@ pub fn attest(stream: &mut UnixStream, http: &mut backend::HttpClient) -> anyhow | |
| /// server and gather all data required (i.e. a nonce) that should be hashed into the attestation | ||
| /// evidence. The proxy will also reply with the type of hash algorithm to use for the negotiation | ||
| /// parameters. | ||
| fn negotiation(stream: &mut UnixStream, http: &mut backend::HttpClient) -> anyhow::Result<()> { | ||
| fn negotiation(stream: &mut UnixStream, http: &Client) -> anyhow::Result<()> { | ||
| // Read the negotiation parameters from SVSM. | ||
| let request: NegotiationRequest = { | ||
| let payload = proxy_read(stream)?; | ||
|
|
@@ -37,7 +44,11 @@ fn negotiation(stream: &mut UnixStream, http: &mut backend::HttpClient) -> anyho | |
| }; | ||
|
|
||
| // Gather negotiation parameters from the attestation server. | ||
| let response: NegotiationResponse = http.negotiation(request)?; | ||
| let response = { | ||
| let backend = BACKEND.lock().unwrap(); | ||
|
|
||
| backend.clone().unwrap().negotiation(http, request) // Safe to unwrap. | ||
| }?; | ||
|
|
||
| // Write the response from the attestation server to SVSM. | ||
| proxy_write(stream, response)?; | ||
|
|
@@ -48,15 +59,19 @@ fn negotiation(stream: &mut UnixStream, http: &mut backend::HttpClient) -> anyho | |
| /// Attestation phase of SVSM attestation. SVSM will send an attestation request containing the TEE | ||
| /// evidence. Proxy will respond with an attestation response containing the status | ||
| /// (success/failure) and an optional secret upon successful attestation. | ||
| fn attestation(stream: &mut UnixStream, http: &backend::HttpClient) -> anyhow::Result<()> { | ||
| fn attestation(stream: &mut UnixStream, http: &Client) -> anyhow::Result<()> { | ||
| let request: AttestationRequest = { | ||
| let payload = proxy_read(stream)?; | ||
| serde_json::from_slice(&payload) | ||
| .context("unable to deserialize attestation request from JSON")? | ||
| }; | ||
|
|
||
| // Attest the TEE evidence with the server. | ||
| let response: AttestationResponse = http.attestation(request)?; | ||
| let response = { | ||
| let backend = BACKEND.lock().unwrap(); | ||
|
|
||
| backend.clone().unwrap().attestation(http, request) // Safe to unwrap. | ||
| }?; | ||
|
|
||
| // Write the response from the attestation server to SVSM. | ||
| proxy_write(stream, response)?; | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,61 +5,56 @@ | |
| // Author: Stefano Garzarella <[email protected]> | ||
| // Author: Tyler Fanelli <[email protected]> | ||
|
|
||
| mod kbs; | ||
| pub mod kbs; | ||
|
|
||
| use anyhow::{anyhow, Context}; | ||
| use kbs::KbsProtocol; | ||
| use anyhow::anyhow; | ||
| use lazy_static::lazy_static; | ||
| use libaproxy::*; | ||
| use reqwest::{blocking::Client, cookie::Jar}; | ||
| use std::{str::FromStr, sync::Arc}; | ||
| use reqwest::blocking::Client; | ||
| use std::{str::FromStr, sync::Mutex}; | ||
|
|
||
| lazy_static! { | ||
| pub static ref BACKEND: Mutex<Option<ProtocolDispatcher>> = Mutex::new(None); | ||
| } | ||
|
|
||
| /// HTTP client and protocol identifier. | ||
| #[derive(Clone, Debug)] | ||
| pub struct HttpClient { | ||
| pub cli: Client, | ||
| pub struct ProtocolDispatcher { | ||
| pub url: String, | ||
| protocol: Protocol, | ||
| pub negotiation: fn(&Client, &str, NegotiationRequest) -> anyhow::Result<NegotiationResponse>, | ||
| pub attestation: fn(&Client, &str, AttestationRequest) -> anyhow::Result<AttestationResponse>, | ||
| } | ||
|
|
||
| impl HttpClient { | ||
| pub fn new(url: String, protocol: Protocol) -> anyhow::Result<Self> { | ||
| let cli = Client::builder() | ||
| .cookie_provider(Arc::new(Jar::default())) | ||
| .build() | ||
| .context("unable to build HTTP client to interact with attestation server")?; | ||
|
|
||
| Ok(Self { cli, url, protocol }) | ||
| } | ||
|
|
||
| pub fn negotiation(&mut self, req: NegotiationRequest) -> anyhow::Result<NegotiationResponse> { | ||
| // Depending on the underlying protocol of the attestation server, gather negotiation | ||
| // parameters accordingly. | ||
| match self.protocol { | ||
| Protocol::Kbs(mut kbs) => kbs.negotiation(self, req), | ||
| } | ||
| impl ProtocolDispatcher { | ||
| pub fn negotiation( | ||
| &self, | ||
| cli: &Client, | ||
| n: NegotiationRequest, | ||
| ) -> anyhow::Result<NegotiationResponse> { | ||
| (self.negotiation)(cli, &self.url, n) | ||
| } | ||
|
|
||
| pub fn attestation(&self, req: AttestationRequest) -> anyhow::Result<AttestationResponse> { | ||
| // Depending on the underlying protocol of the attestation server, attest TEE evidence | ||
| // accoridngly. | ||
| match self.protocol { | ||
| Protocol::Kbs(kbs) => kbs.attestation(self, req), | ||
| } | ||
| pub fn attestation( | ||
| &self, | ||
| cli: &Client, | ||
| a: AttestationRequest, | ||
| ) -> anyhow::Result<AttestationResponse> { | ||
| (self.attestation)(cli, &self.url, a) | ||
| } | ||
| } | ||
|
|
||
| /// Attestation Protocol identifier. | ||
| #[derive(Clone, Copy, Debug)] | ||
| pub enum Protocol { | ||
| Kbs(KbsProtocol), | ||
| Kbs, | ||
| } | ||
|
|
||
| impl FromStr for Protocol { | ||
| type Err = anyhow::Error; | ||
|
|
||
| fn from_str(s: &str) -> Result<Self, Self::Err> { | ||
| match &s.to_lowercase()[..] { | ||
| "kbs" => Ok(Self::Kbs(KbsProtocol)), | ||
| "kbs" => Ok(Self::Kbs), | ||
| _ => Err(anyhow!("invalid backend attestation protocol selected")), | ||
| } | ||
| } | ||
|
|
@@ -69,13 +64,13 @@ impl FromStr for Protocol { | |
| /// protocols. | ||
| pub trait AttestationProtocol { | ||
| fn negotiation( | ||
| &mut self, | ||
| client: &mut HttpClient, | ||
| client: &Client, | ||
| url: &str, | ||
| req: NegotiationRequest, | ||
| ) -> anyhow::Result<NegotiationResponse>; | ||
| fn attestation( | ||
| &self, | ||
| client: &HttpClient, | ||
| client: &Client, | ||
| url: &str, | ||
| req: AttestationRequest, | ||
| ) -> anyhow::Result<AttestationResponse>; | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters