Skip to content

Commit 675d4e5

Browse files
martintomazicmartintomazic
committed
go/oasis-test-runner: Add e2e test for compute runtime kma_policy
1 parent ade5ba1 commit 675d4e5

5 files changed

Lines changed: 108 additions & 35 deletions

File tree

‎.buildkite/code.pipeline.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,10 @@ steps:
357357
command:
358358
- trap 'buildkite-agent artifact upload "coverage-merged-e2e-*.txt;/tmp/e2e/**/*.log;/tmp/e2e/**/genesis.json;/tmp/e2e/**/runtime_genesis.json"' EXIT
359359
- .buildkite/scripts/download_e2e_test_artifacts_mocksgx.sh
360-
- .buildkite/scripts/test_e2e.sh --timeout 20m --scenario e2e/runtime/runtime-encryption
360+
- .buildkite/scripts/test_e2e.sh --timeout 20m
361+
--scenario e2e/runtime/runtime-encryption
362+
--scenario e2e/runtime/keymanager-access-policy
363+
361364
env:
362365
OASIS_TEE_HARDWARE: intel-sgx
363366
OASIS_UNSAFE_MOCK_TEE: "1"

‎go/oasis-test-runner/oasis/fixture.go‎

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"github.com/oasisprotocol/oasis-core/go/common/crypto/signature"
1111
"github.com/oasisprotocol/oasis-core/go/common/node"
1212
"github.com/oasisprotocol/oasis-core/go/common/sgx"
13+
"github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
1314
"github.com/oasisprotocol/oasis-core/go/consensus/cometbft/config"
1415
"github.com/oasisprotocol/oasis-core/go/oasis-test-runner/env"
1516
"github.com/oasisprotocol/oasis-core/go/oasis-test-runner/log"
@@ -256,6 +257,9 @@ type RuntimeFixture struct {
256257

257258
GovernanceModel registry.RuntimeGovernanceModel `json:"governance_model"`
258259

260+
// KeyManagerAccessPolicy is an optional key manager access policy.
261+
KeyManagerAccessPolicy *quote.Policy `json:"kma_policy,omitempty"`
262+
259263
Pruner RuntimePrunerCfg `json:"pruner,omitempty"`
260264

261265
ExcludeFromGenesis bool `json:"exclude_from_genesis,omitempty"`
@@ -286,24 +290,25 @@ func (f *RuntimeFixture) Create(netFixture *NetworkFixture, net *Network) (*Runt
286290
}
287291

288292
return net.NewRuntime(&RuntimeCfg{
289-
ID: f.ID,
290-
Kind: f.Kind,
291-
Entity: entity,
292-
Keymanager: km,
293-
TEEHardware: netFixture.TEE.Hardware,
294-
MrSigner: netFixture.TEE.MrSigner,
295-
Executor: f.Executor,
296-
TxnScheduler: f.TxnScheduler,
297-
Storage: f.Storage,
298-
AdmissionPolicy: admissionPolicy,
299-
Staking: f.Staking,
300-
GenesisRound: f.GenesisRound,
301-
GenesisStateRoot: f.GenesisStateRoot,
302-
Pruner: f.Pruner,
303-
ExcludeFromGenesis: f.ExcludeFromGenesis,
304-
KeepBundles: f.KeepBundles,
305-
GovernanceModel: f.GovernanceModel,
306-
Deployments: f.Deployments,
293+
ID: f.ID,
294+
Kind: f.Kind,
295+
Entity: entity,
296+
Keymanager: km,
297+
TEEHardware: netFixture.TEE.Hardware,
298+
MrSigner: netFixture.TEE.MrSigner,
299+
KeyManagerAccessPolicy: f.KeyManagerAccessPolicy,
300+
Executor: f.Executor,
301+
TxnScheduler: f.TxnScheduler,
302+
Storage: f.Storage,
303+
AdmissionPolicy: admissionPolicy,
304+
Staking: f.Staking,
305+
GenesisRound: f.GenesisRound,
306+
GenesisStateRoot: f.GenesisStateRoot,
307+
Pruner: f.Pruner,
308+
ExcludeFromGenesis: f.ExcludeFromGenesis,
309+
KeepBundles: f.KeepBundles,
310+
GovernanceModel: f.GovernanceModel,
311+
Deployments: f.Deployments,
307312
})
308313
}
309314

‎go/oasis-test-runner/oasis/runtime.go‎

Lines changed: 25 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"github.com/oasisprotocol/oasis-core/go/common/crypto/hash"
1515
"github.com/oasisprotocol/oasis-core/go/common/node"
1616
"github.com/oasisprotocol/oasis-core/go/common/sgx"
17+
"github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
1718
"github.com/oasisprotocol/oasis-core/go/common/version"
1819
"github.com/oasisprotocol/oasis-core/go/oasis-test-runner/env"
1920
registry "github.com/oasisprotocol/oasis-core/go/registry/api"
@@ -48,8 +49,9 @@ type Runtime struct {
4849
// of this file is discouraged (if not entirely forbidden).
4950
cfgSave runtimeCfgSave
5051

51-
teeHardware node.TEEHardware
52-
mrSigner *sgx.MrSigner
52+
teeHardware node.TEEHardware
53+
mrSigner *sgx.MrSigner
54+
keyManagerAccessPolicy *quote.Policy
5355

5456
pruner RuntimePrunerCfg
5557

@@ -59,12 +61,13 @@ type Runtime struct {
5961

6062
// RuntimeCfg is the Oasis runtime provisioning configuration.
6163
type RuntimeCfg struct {
62-
ID common.Namespace
63-
Kind registry.RuntimeKind
64-
Entity *Entity
65-
Keymanager *Runtime
66-
TEEHardware node.TEEHardware
67-
MrSigner *sgx.MrSigner
64+
ID common.Namespace
65+
Kind registry.RuntimeKind
66+
Entity *Entity
67+
Keymanager *Runtime
68+
TEEHardware node.TEEHardware
69+
MrSigner *sgx.MrSigner
70+
KeyManagerAccessPolicy *quote.Policy
6871

6972
Deployments []DeploymentCfg
7073
GenesisRound uint64
@@ -230,14 +233,19 @@ func (rt *Runtime) toRuntimeBundle(index int, cfg *deploymentCfg) (*bundle.Bundl
230233
return fmt.Errorf("oasis/runtime: failed to derive MRENCLAVE: %w", err)
231234
}
232235

233-
cfg.versionInfo.TEE = cbor.Marshal(node.SGXConstraints{
236+
sc := node.SGXConstraints{
234237
Enclaves: []sgx.EnclaveIdentity{
235238
{
236239
MrEnclave: *mrEnclave,
237240
MrSigner: *rt.mrSigner,
238241
},
239242
},
240-
})
243+
}
244+
if rt.keyManagerAccessPolicy != nil {
245+
sc.Versioned = cbor.NewVersioned(1)
246+
sc.KeyManagerAccessPolicy = rt.keyManagerAccessPolicy
247+
}
248+
cfg.versionInfo.TEE = cbor.Marshal(sc)
241249
cfg.mrEnclave = mrEnclave
242250
return nil
243251
}
@@ -368,12 +376,13 @@ func (net *Network) NewRuntime(cfg *RuntimeCfg) (*Runtime, error) {
368376
cfgSave: runtimeCfgSave{
369377
id: cfg.ID,
370378
},
371-
kind: cfg.Kind,
372-
teeHardware: cfg.TEEHardware,
373-
mrSigner: cfg.MrSigner,
374-
pruner: cfg.Pruner,
375-
excludeFromGenesis: cfg.ExcludeFromGenesis,
376-
descriptor: descriptor,
379+
kind: cfg.Kind,
380+
teeHardware: cfg.TEEHardware,
381+
mrSigner: cfg.MrSigner,
382+
keyManagerAccessPolicy: cfg.KeyManagerAccessPolicy,
383+
pruner: cfg.Pruner,
384+
excludeFromGenesis: cfg.ExcludeFromGenesis,
385+
descriptor: descriptor,
377386
}
378387

379388
for _, deployCfg := range cfg.Deployments {

‎go/oasis-test-runner/scenario/e2e/runtime/kma_policy.go‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package runtime
2+
3+
import (
4+
"context"
5+
6+
"github.com/oasisprotocol/oasis-core/go/common/sgx/pcs"
7+
"github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
8+
"github.com/oasisprotocol/oasis-core/go/oasis-test-runner/env"
9+
"github.com/oasisprotocol/oasis-core/go/oasis-test-runner/oasis"
10+
"github.com/oasisprotocol/oasis-core/go/oasis-test-runner/scenario"
11+
)
12+
13+
// KeyManagerAccessPolicy is the key manager access policy e2e test scenario.
14+
var KeyManagerAccessPolicy scenario.Scenario = newKeyManagerAccessPolicyImpl()
15+
16+
type keyManagerAccessPolicyImpl struct {
17+
Scenario
18+
}
19+
20+
func newKeyManagerAccessPolicyImpl() scenario.Scenario {
21+
return &keyManagerAccessPolicyImpl{
22+
Scenario: *NewScenario("keymanager-access-policy", NewTestClient().WithScenario(SimpleScenario)),
23+
}
24+
}
25+
26+
func (sc *keyManagerAccessPolicyImpl) Clone() scenario.Scenario {
27+
return &keyManagerAccessPolicyImpl{
28+
Scenario: *sc.Scenario.Clone().(*Scenario),
29+
}
30+
}
31+
32+
func (sc *keyManagerAccessPolicyImpl) Fixture() (*oasis.NetworkFixture, error) {
33+
f, err := sc.Scenario.Fixture()
34+
if err != nil {
35+
return nil, err
36+
}
37+
38+
f.Runtimes[1].KeyManagerAccessPolicy = &quote.Policy{
39+
PCS: &pcs.QuotePolicy{
40+
TCBValidityPeriod: 90,
41+
MinTCBEvaluationDataNumber: 12,
42+
},
43+
}
44+
45+
return f, nil
46+
}
47+
48+
func (sc *keyManagerAccessPolicyImpl) Run(ctx context.Context, childEnv *env.Env) error {
49+
if err := sc.StartNetworkAndTestClient(ctx, childEnv); err != nil {
50+
return err
51+
}
52+
53+
return sc.WaitTestClientAndCheckLogs()
54+
}

‎go/oasis-test-runner/scenario/e2e/runtime/scenario.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,8 @@ func RegisterScenarios() error {
421421
TxSourceMultiShortSGX,
422422
// Observer tests
423423
ObserverMode,
424+
// SGXConstraints tests.
425+
KeyManagerAccessPolicy,
424426
} {
425427
if err := cmd.RegisterNondefault(s); err != nil {
426428
return err

0 commit comments

Comments
 (0)