go: Validate attestation against per role policies prior early

Author: martintomazic

go/oasis-node/cmd/node/node.go

@@ -11,6 +11,7 @@ import (
 	"github.com/oasisprotocol/oasis-core/go/common/grpc"
 	"github.com/oasisprotocol/oasis-core/go/common/identity"
 	"github.com/oasisprotocol/oasis-core/go/common/logging"
+	"github.com/oasisprotocol/oasis-core/go/common/node"
 	"github.com/oasisprotocol/oasis-core/go/common/persistent"
 	"github.com/oasisprotocol/oasis-core/go/common/version"
 	"github.com/oasisprotocol/oasis-core/go/config"
@@ -205,12 +206,29 @@ func (n *Node) initRuntimeWorkers(genesisDoc *genesisAPI.Document) error {
 	}
 	n.svcMgr.Register(n.RuntimeRegistry)
 
+	// Determine runtime role.
+	runtimeRoles := node.RoleEmpty
+	switch config.GlobalConfig.Mode {
+	case config.ModeCompute:
+		runtimeRoles = node.RoleComputeWorker
+	case config.ModeKeyManager:
+		runtimeRoles = node.RoleKeyManager
+	case config.ModeClient, config.ModeStatelessClient:
+		if config.GlobalConfig.Registration.Entity != "" || config.GlobalConfig.Registration.EntityID != "" {
+			runtimeRoles |= node.RoleObserver
+		}
+		if config.GlobalConfig.Storage.PublicRPCEnabled {
+			runtimeRoles |= node.RoleStorageRPC
+		}
+	}
+
 	// Initialize the common worker.
 	n.CommonWorker, err = workerCommon.New(
 		n,
 		n.dataDir,
 		n.chainContext,
 		n.Identity,
+		runtimeRoles,
 		n.Consensus,
 		n.LightService,
 		n.P2P,

go/runtime/host/host.go

@@ -22,6 +22,10 @@ type Config struct {
 	// ID is the runtime identifier.
 	ID common.Namespace
 
+	// RuntimeRoles is the runtime role mask the node will register RONL component with.
+	// In case of ROFL only nodes (no registration) this is expected to be empty role.
+	RuntimeRoles node.RolesMask
+
 	// Component is the component that should be provisioned.
 	Component *bundle.ExplodedComponent
 

go/runtime/host/sgx/common/common.go

@@ -48,7 +48,7 @@ func GetQuotePolicy(
 				return nil, fmt.Errorf("malformed runtime SGX constraints: %w", err)
 			}
 
-			return sc.Policy, nil
+			return sc.PolicyFor(cfg.RuntimeRoles), nil
 		}
 		return fallbackPolicy, nil
 	case component.ROFL:

go/runtime/registry/host.go

@@ -21,25 +21,27 @@ type RuntimeHostNode struct {
 
 	host *composite.Host
 
-	runtime     Runtime
-	provisioner host.Provisioner
-	handler     host.RuntimeHandler
-	logManager  *log.Manager
+	runtime      Runtime
+	runtimeRoles node.RolesMask
+	provisioner  host.Provisioner
+	handler      host.RuntimeHandler
+	logManager   *log.Manager
 
 	rofls map[component.ID]version.Version
 }
 
 // NewRuntimeHostNode creates a new runtime host node.
-func NewRuntimeHostNode(runtime Runtime, provisioner host.Provisioner, handler host.RuntimeHandler, logManager *log.Manager) (*RuntimeHostNode, error) {
+func NewRuntimeHostNode(runtime Runtime, runtimeRoles node.RolesMask, provisioner host.Provisioner, handler host.RuntimeHandler, logManager *log.Manager) (*RuntimeHostNode, error) {
 	h := composite.NewHost(runtime.ID())
 
 	return &RuntimeHostNode{
-		host:        h,
-		logManager:  logManager,
-		runtime:     runtime,
-		handler:     handler,
-		provisioner: provisioner,
-		rofls:       make(map[component.ID]version.Version),
+		host:         h,
+		logManager:   logManager,
+		runtime:      runtime,
+		runtimeRoles: runtimeRoles,
+		handler:      handler,
+		provisioner:  provisioner,
+		rofls:        make(map[component.ID]version.Version),
 	}, nil
 }
 
@@ -67,6 +69,7 @@ func (n *RuntimeHostNode) ProvisionHostedRuntimeComponent(comp *bundle.ExplodedC
 
 	cfg := host.Config{
 		ID:             n.runtime.ID(),
+		RuntimeRoles:   n.runtimeRoles,
 		Component:      comp,
 		MessageHandler: handler,
 		LocalConfig:    getLocalConfig(n.runtime.ID(), comp.ID()),

go/worker/common/committee/node.go

@@ -11,6 +11,7 @@ import (
 	beacon "github.com/oasisprotocol/oasis-core/go/beacon/api"
 	"github.com/oasisprotocol/oasis-core/go/common/identity"
 	"github.com/oasisprotocol/oasis-core/go/common/logging"
+	"github.com/oasisprotocol/oasis-core/go/common/node"
 	"github.com/oasisprotocol/oasis-core/go/common/service"
 	"github.com/oasisprotocol/oasis-core/go/common/version"
 	"github.com/oasisprotocol/oasis-core/go/config"
@@ -59,6 +60,7 @@ type Node struct {
 	HostNode control.NodeController
 
 	Identity         *identity.Identity
+	RuntimeRoles     node.RolesMask
 	KeyManager       keymanager.Backend
 	KeyManagerClient *KeyManagerClientWrapper
 	Consensus        consensus.Service
@@ -637,6 +639,7 @@ func NewNode(
 	provisioner host.Provisioner,
 	rtRegistry runtimeRegistry.Registry,
 	identity *identity.Identity,
+	runtimeRoles node.RolesMask,
 	keymanager keymanager.Backend,
 	consensus consensus.Service,
 	lightProvider consensus.LightProvider,
@@ -664,6 +667,7 @@ func NewNode(
 		Runtime:         runtime,
 		RuntimeRegistry: rtRegistry,
 		Identity:        identity,
+		RuntimeRoles:    runtimeRoles,
 		KeyManager:      keymanager,
 		Consensus:       consensus,
 		LightProvider:   lightProvider,
@@ -686,7 +690,7 @@ func NewNode(
 	handler := runtimeRegistry.NewRuntimeHostHandler(&nodeEnvironment{n}, n.Runtime, consensus)
 
 	// Prepare the runtime host node helpers.
-	rhn, err := runtimeRegistry.NewRuntimeHostNode(runtime, provisioner, handler, rtRegistry.GetLogManager())
+	rhn, err := runtimeRegistry.NewRuntimeHostNode(runtime, runtimeRoles, provisioner, handler, rtRegistry.GetLogManager())
 	if err != nil {
 		return nil, err
 	}

go/worker/common/worker.go

@@ -6,6 +6,7 @@ import (
 	"github.com/oasisprotocol/oasis-core/go/common"
 	"github.com/oasisprotocol/oasis-core/go/common/identity"
 	"github.com/oasisprotocol/oasis-core/go/common/logging"
+	"github.com/oasisprotocol/oasis-core/go/common/node"
 	"github.com/oasisprotocol/oasis-core/go/config"
 	consensus "github.com/oasisprotocol/oasis-core/go/consensus/api"
 	control "github.com/oasisprotocol/oasis-core/go/control/api"
@@ -25,6 +26,7 @@ type Worker struct {
 	DataDir         string
 	ChainContext    string
 	Identity        *identity.Identity
+	runtimeRoles    node.RolesMask
 	Consensus       consensus.Service
 	LightProvider   consensus.LightProvider
 	P2P             p2p.Service
@@ -161,6 +163,7 @@ func (w *Worker) registerRuntime(runtime runtimeRegistry.Runtime) error {
 		w.Provisioner,
 		w.RuntimeRegistry,
 		w.Identity,
+		w.runtimeRoles,
 		w.KeyManager,
 		w.Consensus,
 		w.LightProvider,
@@ -185,6 +188,7 @@ func New(
 	dataDir string,
 	chainContext string,
 	identity *identity.Identity,
+	runtimeRoles node.RolesMask,
 	consensus consensus.Service,
 	lightProvider consensus.LightProvider,
 	p2p p2p.Service,
@@ -215,6 +219,7 @@ func New(
 		DataDir:         dataDir,
 		ChainContext:    chainContext,
 		Identity:        identity,
+		runtimeRoles:    runtimeRoles,
 		Consensus:       consensus,
 		LightProvider:   lightProvider,
 		P2P:             p2p,

go/worker/keymanager/init.go

@@ -82,7 +82,7 @@ func New(
 	handler := runtimeRegistry.NewRuntimeHostHandler(&workerEnvironment{w}, w.runtime, w.commonWorker.Consensus)
 
 	// Prepare the runtime host node helpers.
-	w.RuntimeHostNode, err = runtimeRegistry.NewRuntimeHostNode(w.runtime, provisioner, handler, w.commonWorker.RuntimeRegistry.GetLogManager())
+	w.RuntimeHostNode, err = runtimeRegistry.NewRuntimeHostNode(w.runtime, node.RoleKeyManager, provisioner, handler, w.commonWorker.RuntimeRegistry.GetLogManager())
 	if err != nil {
 		return nil, fmt.Errorf("worker/keymanager: failed to create runtime host helpers: %w", err)
 	}