go/runtime/host: Improve common.GetQuotePolicy function

Author: martintomazic

.changelog/6531.trivial.md

@@ -8,56 +8,47 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 
+	"github.com/oasisprotocol/oasis-core/go/common"
 	"github.com/oasisprotocol/oasis-core/go/common/cbor"
 	"github.com/oasisprotocol/oasis-core/go/common/crypto/signature"
 	"github.com/oasisprotocol/oasis-core/go/common/identity"
 	"github.com/oasisprotocol/oasis-core/go/common/logging"
 	"github.com/oasisprotocol/oasis-core/go/common/node"
 	"github.com/oasisprotocol/oasis-core/go/common/sgx/pcs"
 	sgxQuote "github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
+	"github.com/oasisprotocol/oasis-core/go/common/version"
 	consensus "github.com/oasisprotocol/oasis-core/go/consensus/api"
 	registry "github.com/oasisprotocol/oasis-core/go/registry/api"
-	"github.com/oasisprotocol/oasis-core/go/runtime/bundle/component"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host/protocol"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host/sandbox"
 )
 
-// GetQuotePolicy fetches the quote policy for the given component. In case the policy is
-// not available, return the fallback policy.
-func GetQuotePolicy(
+// GetRONLQuotePolicy fetches the quote policy for the specified RONL deployment.
+//
+// Returns nil if the policy is not available.
+func GetRONLQuotePolicy(
 	ctx context.Context,
-	cfg *host.Config,
+	runtimeID common.Namespace,
+	version version.Version,
 	cs consensus.Service,
-	fallbackPolicy *sgxQuote.Policy,
 ) (*sgxQuote.Policy, error) {
-	switch cfg.Component.Kind {
-	case component.RONL:
-		// Load RONL policy from the consensus layer.
-		rt, err := cs.Registry().GetRuntime(ctx, &registry.GetRuntimeQuery{
-			Height:           consensus.HeightLatest,
-			ID:               cfg.ID,
-			IncludeSuspended: true,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to query runtime descriptor: %w", err)
-		}
-		if d := rt.DeploymentForVersion(cfg.Component.Version); d != nil {
-			var sc node.SGXConstraints
-			if err = cbor.Unmarshal(d.TEE, &sc); err != nil {
-				return nil, fmt.Errorf("malformed runtime SGX constraints: %w", err)
-			}
-
-			return sc.Policy, nil
+	rt, err := cs.Registry().GetRuntime(ctx, &registry.GetRuntimeQuery{
+		Height:           consensus.HeightLatest,
+		ID:               runtimeID,
+		IncludeSuspended: true,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to query runtime descriptor: %w", err)
+	}
+	if d := rt.DeploymentForVersion(version); d != nil {
+		var sc node.SGXConstraints
+		if err = cbor.Unmarshal(d.TEE, &sc); err != nil {
+			return nil, fmt.Errorf("malformed runtime SGX constraints: %w", err)
 		}
-		return fallbackPolicy, nil
-	case component.ROFL:
-		// Always use fallback policy for ROFL components.
-		return fallbackPolicy, nil
-	default:
-		// No policy.
-		return fallbackPolicy, nil
+		return sc.Policy, nil
 	}
+	return nil, nil
 }
 
 // EndorseCapabilityTEE endorses the given CapabilityTEE and submits the signed endorsement to the

go/runtime/host/sgx/common/common.go

@@ -6,7 +6,9 @@ import (
 
 	"github.com/oasisprotocol/oasis-core/go/common/sgx/aesm"
 	"github.com/oasisprotocol/oasis-core/go/common/sgx/pcs"
+	"github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
 	consensus "github.com/oasisprotocol/oasis-core/go/consensus/api"
+	"github.com/oasisprotocol/oasis-core/go/runtime/bundle/component"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host/protocol"
 	sgxCommon "github.com/oasisprotocol/oasis-core/go/runtime/host/sgx/common"
@@ -63,9 +65,12 @@ func (ec *teeStateECDSA) Update(ctx context.Context, sp *sgxProvisioner, conn pr
 		return nil, fmt.Errorf("failed to get quote: %w", err)
 	}
 
-	quotePolicy, err := sgxCommon.GetQuotePolicy(ctx, ec.cfg, sp.consensus, nil)
-	if err != nil {
-		return nil, err
+	var quotePolicy *quote.Policy
+	if ec.cfg.Component.Kind == component.RONL {
+		quotePolicy, err = sgxCommon.GetRONLQuotePolicy(ctx, ec.cfg.ID, ec.cfg.Component.Version, sp.consensus)
+		if err != nil {
+			return nil, fmt.Errorf("failed to fetch RONL quote policy: %w", err)
+		}
 	}
 	var pcsQuotePolicy *pcs.QuotePolicy
 	if quotePolicy != nil {

go/runtime/host/sgx/ecdsa.go

@@ -12,6 +12,7 @@ import (
 	sgxQuote "github.com/oasisprotocol/oasis-core/go/common/sgx/quote"
 	consensus "github.com/oasisprotocol/oasis-core/go/consensus/api"
 	ias "github.com/oasisprotocol/oasis-core/go/ias/api"
+	"github.com/oasisprotocol/oasis-core/go/runtime/bundle/component"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host"
 	"github.com/oasisprotocol/oasis-core/go/runtime/host/protocol"
 	sgxCommon "github.com/oasisprotocol/oasis-core/go/runtime/host/sgx/common"
@@ -107,9 +108,12 @@ func (ep *teeStateEPID) update(
 		return nil, fmt.Errorf("error while getting quote: %w", err)
 	}
 
-	quotePolicy, err := sgxCommon.GetQuotePolicy(ctx, ep.cfg, sp.consensus, nil)
-	if err != nil {
-		return nil, err
+	var quotePolicy *sgxQuote.Policy
+	if ep.cfg.Component.Kind == component.RONL {
+		quotePolicy, err = sgxCommon.GetRONLQuotePolicy(ctx, ep.cfg.ID, ep.cfg.Component.Version, sp.consensus)
+		if err != nil {
+			return nil, fmt.Errorf("failed to fetch RONL quote policy: %w", err)
+		}
 	}
 	var minTCBEvaluationDataNumber uint32
 	if quotePolicy != nil && quotePolicy.IAS != nil {

go/runtime/host/sgx/epid.go

@@ -443,9 +443,15 @@ func (p *qemuProvisioner) updateCapabilityTEE(ctx context.Context, hp *sandbox.H
 			TDX:                        &pcs.TdxQuotePolicy{},
 		},
 	}
-	quotePolicy, err := sgxCommon.GetQuotePolicy(ctx, hp.Config, p.consensus, fallbackPolicy)
-	if err != nil {
-		return nil, err
+	var quotePolicy *sgxQuote.Policy
+	if hp.Config.Component.Kind == component.RONL {
+		quotePolicy, err = sgxCommon.GetRONLQuotePolicy(ctx, hp.Config.ID, hp.Config.Component.Version, p.consensus)
+		if err != nil {
+			return nil, fmt.Errorf("failed to fetch RONL quote policy: %w", err)
+		}
+	}
+	if quotePolicy == nil {
+		quotePolicy = fallbackPolicy
 	}
 	if quotePolicy.PCS == nil {
 		quotePolicy.PCS = fallbackPolicy.PCS