Skip to content

Commit ee1aed0

Browse files
martintomazicmartintomazic
committed
go: Validate against keymanager access policy before registration
1 parent 93b8d28 commit ee1aed0

14 files changed

Lines changed: 188 additions & 115 deletions

File tree

‎go/oasis-node/cmd/node/node.go‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -212,9 +212,19 @@ func (n *Node) initRuntimeWorkers(genesisDoc *genesisAPI.Document) error {
212212
}
213213
n.svcMgr.Register(n.RuntimeRegistry)
214214

215+
// Determine whether hosted RONL components will be registered on the
216+
// consensus layer.
217+
var willRegisterComputeRuntime bool
218+
switch config.GlobalConfig.Mode {
219+
case config.ModeCompute, config.ModeObserver:
220+
willRegisterComputeRuntime = true
221+
default:
222+
}
223+
215224
// Initialize the common worker.
216225
commonCfg := workerCommon.Config{
217-
TxPool: config.GlobalConfig.Runtime.TxPool,
226+
TxPool: config.GlobalConfig.Runtime.TxPool,
227+
WillRegisterComputeRuntime: willRegisterComputeRuntime,
218228
}
219229
n.CommonWorker, err = workerCommon.New(
220230
commonCfg,

‎go/runtime/host/host.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"github.com/oasisprotocol/oasis-core/go/common"
88
"github.com/oasisprotocol/oasis-core/go/common/node"
99
"github.com/oasisprotocol/oasis-core/go/common/pubsub"
10+
"github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
1011
"github.com/oasisprotocol/oasis-core/go/common/version"
1112
"github.com/oasisprotocol/oasis-core/go/runtime/bundle"
1213
"github.com/oasisprotocol/oasis-core/go/runtime/bundle/component"
@@ -25,6 +26,9 @@ type Config struct {
2526
// Component is the component that should be provisioned.
2627
Component *bundle.ExplodedComponent
2728

29+
// QuotePolicy provides quote policy for the provisioned component.
30+
QuotePolicy QuotePolicyProvider
31+
2832
// Extra is an optional provisioner-specific configuration.
2933
Extra any
3034

@@ -38,6 +42,12 @@ type Config struct {
3842
Log *log.Log
3943
}
4044

45+
// QuotePolicyProvider provides quote policies.
46+
type QuotePolicyProvider interface {
47+
// Get returns the quote policy.
48+
Get(ctx context.Context) (*quote.Policy, error)
49+
}
50+
4151
// Provisioner is the runtime provisioner interface.
4252
type Provisioner interface {
4353
// NewRuntime provisions a new runtime.

‎go/runtime/host/provisioner/provisioner.go‎

Lines changed: 1 addition & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,16 @@
11
package provisioner
22

33
import (
4-
"context"
54
"fmt"
65

7-
"github.com/oasisprotocol/oasis-core/go/common"
8-
"github.com/oasisprotocol/oasis-core/go/common/cbor"
96
"github.com/oasisprotocol/oasis-core/go/common/identity"
10-
"github.com/oasisprotocol/oasis-core/go/common/node"
117
"github.com/oasisprotocol/oasis-core/go/common/persistent"
128
"github.com/oasisprotocol/oasis-core/go/common/sgx/pcs"
13-
sgxQuote "github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
149
"github.com/oasisprotocol/oasis-core/go/common/version"
1510
"github.com/oasisprotocol/oasis-core/go/config"
1611
consensus "github.com/oasisprotocol/oasis-core/go/consensus/api"
1712
genesisAPI "github.com/oasisprotocol/oasis-core/go/genesis/api"
1813
cmdFlags "github.com/oasisprotocol/oasis-core/go/oasis-node/cmd/common/flags"
19-
registry "github.com/oasisprotocol/oasis-core/go/registry/api"
2014
"github.com/oasisprotocol/oasis-core/go/runtime/bundle/component"
2115
rtConfig "github.com/oasisprotocol/oasis-core/go/runtime/config"
2216
runtimeHost "github.com/oasisprotocol/oasis-core/go/runtime/host"
@@ -26,7 +20,6 @@ import (
2620
hostProtocol "github.com/oasisprotocol/oasis-core/go/runtime/host/protocol"
2721
hostSandbox "github.com/oasisprotocol/oasis-core/go/runtime/host/sandbox"
2822
hostSgx "github.com/oasisprotocol/oasis-core/go/runtime/host/sgx"
29-
sgxCommon "github.com/oasisprotocol/oasis-core/go/runtime/host/sgx/common"
3023
hostTdx "github.com/oasisprotocol/oasis-core/go/runtime/host/tdx"
3124
)
3225

@@ -54,10 +47,8 @@ func New(
5447
return nil, err
5548
}
5649

57-
policyProvider := &quotePolicyProvider{consensus}
58-
5950
// Create runtime provisioner.
60-
return createProvisioner(dataDir, commonStore, identity, hostInfo, qs, policyProvider)
51+
return createProvisioner(dataDir, commonStore, identity, hostInfo, qs)
6152
}
6253

6354
func createHostInfo(genesisDoc *genesisAPI.Document) (*hostProtocol.HostInfo, error) {
@@ -87,7 +78,6 @@ func createProvisioner(
8778
identity *identity.Identity,
8879
hostInfo *hostProtocol.HostInfo,
8980
qs pcs.QuoteService,
90-
policyProvider sgxCommon.QuotePolicyProvider,
9181
) (runtimeHost.Provisioner, error) {
9282
var err error
9383
var insecureNoSandbox bool
@@ -153,7 +143,6 @@ func createProvisioner(
153143
CommonStore: commonStore,
154144
LoaderPath: sgxLoader,
155145
PCS: qs,
156-
QuotePolicy: policyProvider,
157146
Identity: identity,
158147
SandboxBinaryPath: sandboxBinary,
159148
InsecureNoSandbox: insecureNoSandbox,
@@ -182,7 +171,6 @@ func createProvisioner(
182171
HostInfo: hostInfo,
183172
CommonStore: commonStore,
184173
PCS: qs,
185-
QuotePolicy: policyProvider,
186174
Identity: identity,
187175
CidPool: cidPool,
188176
RuntimeAttestInterval: attestInterval,
@@ -202,26 +190,3 @@ func createProvisioner(
202190

203191
return provisioner, nil
204192
}
205-
206-
type quotePolicyProvider struct {
207-
cs consensus.Service
208-
}
209-
210-
func (p *quotePolicyProvider) Get(ctx context.Context, runtimeID common.Namespace, version version.Version) (*sgxQuote.Policy, error) {
211-
rt, err := p.cs.Registry().GetRuntime(ctx, &registry.GetRuntimeQuery{
212-
Height: consensus.HeightLatest,
213-
ID: runtimeID,
214-
IncludeSuspended: true,
215-
})
216-
if err != nil {
217-
return nil, fmt.Errorf("failed to query runtime descriptor: %w", err)
218-
}
219-
if d := rt.DeploymentForVersion(version); d != nil {
220-
var sc node.SGXConstraints
221-
if err = cbor.Unmarshal(d.TEE, &sc); err != nil {
222-
return nil, fmt.Errorf("malformed runtime SGX constraints: %w", err)
223-
}
224-
return sc.Policy, nil
225-
}
226-
return nil, nil
227-
}

‎go/runtime/host/sgx/common/common.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,26 +8,18 @@ import (
88

99
"github.com/cenkalti/backoff/v4"
1010

11-
"github.com/oasisprotocol/oasis-core/go/common"
1211
"github.com/oasisprotocol/oasis-core/go/common/cbor"
1312
"github.com/oasisprotocol/oasis-core/go/common/crypto/signature"
1413
"github.com/oasisprotocol/oasis-core/go/common/identity"
1514
"github.com/oasisprotocol/oasis-core/go/common/logging"
1615
"github.com/oasisprotocol/oasis-core/go/common/node"
1716
"github.com/oasisprotocol/oasis-core/go/common/sgx/pcs"
1817
sgxQuote "github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
19-
"github.com/oasisprotocol/oasis-core/go/common/version"
2018
"github.com/oasisprotocol/oasis-core/go/runtime/host"
2119
"github.com/oasisprotocol/oasis-core/go/runtime/host/protocol"
2220
"github.com/oasisprotocol/oasis-core/go/runtime/host/sandbox"
2321
)
2422

25-
// QuotePolicyProvider provides quote policies.
26-
type QuotePolicyProvider interface {
27-
// Get returns the quote policy for the specified RONL deployment.
28-
Get(ctx context.Context, runtimeID common.Namespace, version version.Version) (*sgxQuote.Policy, error)
29-
}
30-
3123
// EndorseCapabilityTEE endorses the given CapabilityTEE and submits the signed endorsement to the
3224
// runtime over the given connection.
3325
func EndorseCapabilityTEE(

‎go/runtime/host/sgx/ecdsa.go‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66

77
"github.com/oasisprotocol/oasis-core/go/common/sgx/aesm"
88
"github.com/oasisprotocol/oasis-core/go/common/sgx/pcs"
9-
"github.com/oasisprotocol/oasis-core/go/runtime/bundle/component"
109
"github.com/oasisprotocol/oasis-core/go/runtime/host"
1110
"github.com/oasisprotocol/oasis-core/go/runtime/host/protocol"
1211
sgxCommon "github.com/oasisprotocol/oasis-core/go/runtime/host/sgx/common"
@@ -55,17 +54,12 @@ func (ec *teeStateECDSA) Update(ctx context.Context, sp *sgxProvisioner, conn pr
5554
}
5655

5756
var pcsQuotePolicy *pcs.QuotePolicy
58-
switch ec.cfg.Component.Kind {
59-
case component.RONL:
60-
quotePolicy, err := sp.policyProvider.Get(ctx, ec.cfg.ID, ec.cfg.Component.Version)
61-
if err != nil {
62-
return nil, fmt.Errorf("failed to fetch RONL quote policy: %w", err)
63-
}
64-
if quotePolicy != nil {
65-
pcsQuotePolicy = quotePolicy.PCS
66-
}
67-
default:
68-
// No policy.
57+
quotePolicy, err := ec.cfg.QuotePolicy.Get(ctx)
58+
if err != nil {
59+
return nil, fmt.Errorf("failed to fetch quote policy: %w", err)
60+
}
61+
if quotePolicy != nil {
62+
pcsQuotePolicy = quotePolicy.PCS
6963
}
7064

7165
quoteBundle, err := sp.pcs.ResolveQuote(ctx, rawQuote, pcsQuotePolicy)

‎go/runtime/host/sgx/provisioner.go‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,7 @@ type Config struct {
5858

5959
// PCS is the Intel Provisioning Certification Service quote service.
6060
PCS pcs.QuoteService
61-
// QuotePolicy provides the quote policy for RONL deployments.
62-
QuotePolicy sgxCommon.QuotePolicyProvider
61+
6362
// Identity is the node identity.
6463
Identity *identity.Identity
6564

@@ -85,12 +84,11 @@ type sgxProvisioner struct {
8584

8685
cfg Config
8786

88-
sandbox host.Provisioner
89-
pcs pcs.QuoteService
90-
aesm *aesm.Client
91-
policyProvider sgxCommon.QuotePolicyProvider
92-
identity *identity.Identity
93-
store *persistent.CommonStore
87+
sandbox host.Provisioner
88+
pcs pcs.QuoteService
89+
aesm *aesm.Client
90+
identity *identity.Identity
91+
store *persistent.CommonStore
9492

9593
logger *logging.Logger
9694
}
@@ -105,13 +103,12 @@ func NewProvisioner(cfg Config) (host.Provisioner, error) {
105103
sgxCommon.InitMetrics()
106104

107105
p := &sgxProvisioner{
108-
cfg: cfg,
109-
pcs: cfg.PCS,
110-
aesm: aesm.NewClient(aesmdSocketPath),
111-
policyProvider: cfg.QuotePolicy,
112-
identity: cfg.Identity,
113-
store: cfg.CommonStore,
114-
logger: logging.GetLogger("runtime/host/sgx"),
106+
cfg: cfg,
107+
pcs: cfg.PCS,
108+
aesm: aesm.NewClient(aesmdSocketPath),
109+
identity: cfg.Identity,
110+
store: cfg.CommonStore,
111+
logger: logging.GetLogger("runtime/host/sgx"),
115112
}
116113
sp, err := sandbox.NewProvisioner(sandbox.Config{
117114
GetSandboxConfig: p.getSandboxConfig,

‎go/runtime/host/tdx/qemu.go‎

Lines changed: 13 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,7 @@ type QemuConfig struct {
5555

5656
// PCS is the Intel Provisioning Certification Service quote service.
5757
PCS pcs.QuoteService
58-
// QuotePolicy provides the quote policy for RONL deployments.
59-
QuotePolicy sgxCommon.QuotePolicyProvider
58+
6059
// Identity is the node identity.
6160
Identity *identity.Identity
6261

@@ -77,11 +76,10 @@ type QemuExtraConfig struct {
7776
type qemuProvisioner struct {
7877
cfg QemuConfig
7978

80-
sandbox host.Provisioner
81-
pcs pcs.QuoteService
82-
quotePolicy sgxCommon.QuotePolicyProvider
83-
identity *identity.Identity
84-
cidPool *CidPool
79+
sandbox host.Provisioner
80+
pcs pcs.QuoteService
81+
identity *identity.Identity
82+
cidPool *CidPool
8583

8684
logger *logging.Logger
8785
}
@@ -96,12 +94,11 @@ func NewQemuProvisioner(cfg QemuConfig) (host.Provisioner, error) {
9694
sgxCommon.InitMetrics()
9795

9896
p := &qemuProvisioner{
99-
cfg: cfg,
100-
pcs: cfg.PCS,
101-
quotePolicy: cfg.QuotePolicy,
102-
identity: cfg.Identity,
103-
cidPool: cfg.CidPool,
104-
logger: logging.GetLogger("runtime/host/tdx/qemu"),
97+
cfg: cfg,
98+
pcs: cfg.PCS,
99+
identity: cfg.Identity,
100+
cidPool: cfg.CidPool,
101+
logger: logging.GetLogger("runtime/host/tdx/qemu"),
105102
}
106103
sp, err := sandbox.NewProvisioner(sandbox.Config{
107104
Connector: newVsockConnector,
@@ -433,15 +430,9 @@ func (p *qemuProvisioner) updateCapabilityTEE(ctx context.Context, hp *sandbox.H
433430
rekPub := rspRep.RuntimeCapabilityTEERakReportResponse.RekPub
434431
rawQuote := rspRep.RuntimeCapabilityTEERakReportResponse.Report
435432

436-
var quotePolicy *sgxQuote.Policy
437-
switch hp.Config.Component.Kind {
438-
case component.RONL:
439-
quotePolicy, err = p.quotePolicy.Get(ctx, hp.Config.ID, hp.Config.Component.Version)
440-
if err != nil {
441-
return nil, fmt.Errorf("failed to fetch RONL quote policy: %w", err)
442-
}
443-
default:
444-
// No policy, use fallback.
433+
quotePolicy, err := hp.Config.QuotePolicy.Get(ctx)
434+
if err != nil {
435+
return nil, fmt.Errorf("failed to fetch quote policy: %w", err)
445436
}
446437

447438
// Use the fallback policy for ROFL components and RONL components with no TDX policy so that provisioning can proceed.

‎go/runtime/registry/host.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ func NewRuntimeHostNode(runtime Runtime, provisioner host.Provisioner, handler h
4444
}
4545

4646
// ProvisionHostedRuntimeComponent provisions the given runtime component.
47-
func (n *RuntimeHostNode) ProvisionHostedRuntimeComponent(comp *bundle.ExplodedComponent) error {
47+
func (n *RuntimeHostNode) ProvisionHostedRuntimeComponent(comp *bundle.ExplodedComponent, quotePolicy host.QuotePolicyProvider) error {
4848
n.mu.Lock()
4949
defer n.mu.Unlock()
5050

@@ -68,6 +68,7 @@ func (n *RuntimeHostNode) ProvisionHostedRuntimeComponent(comp *bundle.ExplodedC
6868
cfg := host.Config{
6969
ID: n.runtime.ID(),
7070
Component: comp,
71+
QuotePolicy: quotePolicy,
7172
MessageHandler: handler,
7273
LocalConfig: getLocalConfig(n.runtime.ID(), comp.ID()),
7374
Log: log,

0 commit comments

Comments
 (0)