mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 15:13:56 +02:00
chore: split-out vault code from teepot in teepot-vault
Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer
parent
63c16b1177
commit
f8bd9e6a08
GPG key ID:
F519A1143B3FBE32
61 changed files with 450 additions and 308 deletions
35
crates/teepot-vault/Cargo.toml
Normal file
35
crates/teepot-vault/Cargo.toml
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
[package]
|
||||
name = "teepot-vault"
|
||||
description = "TEE secret manager"
|
||||
license.workspace = true
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
repository.workspace = true
|
||||
|
||||
[dependencies]
|
||||
actix-http = "3"
|
||||
actix-web.workspace = true
|
||||
anyhow.workspace = true
|
||||
awc.workspace = true
|
||||
bytes.workspace = true
|
||||
clap.workspace = true
|
||||
const-oid.workspace = true
|
||||
futures-core = { version = "0.3.30", features = ["alloc"], default-features = false }
|
||||
hex.workspace = true
|
||||
intel-tee-quote-verification-rs.workspace = true
|
||||
pgp.workspace = true
|
||||
rustls.workspace = true
|
||||
serde.workspace = true
|
||||
serde_json.workspace = true
|
||||
serde_with.workspace = true
|
||||
sha2.workspace = true
|
||||
tdx-attest-rs.workspace = true
|
||||
teepot.workspace = true
|
||||
thiserror.workspace = true
|
||||
tracing.workspace = true
|
||||
webpki-roots = "0.26.1"
|
||||
x509-cert.workspace = true
|
||||
|
||||
[dev-dependencies]
|
||||
base64.workspace = true
|
||||
19
crates/teepot-vault/bin/tee-stress-client/Cargo.toml
Normal file
19
crates/teepot-vault/bin/tee-stress-client/Cargo.toml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
[package]
|
||||
name = "tee-stress-client"
|
||||
publish = false
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
license.workspace = true
|
||||
repository.workspace = true
|
||||
|
||||
[dependencies]
|
||||
actix-web.workspace = true
|
||||
anyhow.workspace = true
|
||||
clap.workspace = true
|
||||
serde.workspace = true
|
||||
teepot.workspace = true
|
||||
teepot-vault.workspace = true
|
||||
tracing.workspace = true
|
||||
tracing-log.workspace = true
|
||||
tracing-subscriber.workspace = true
|
||||
105
crates/teepot-vault/bin/tee-stress-client/src/main.rs
Normal file
105
crates/teepot-vault/bin/tee-stress-client/src/main.rs
Normal file
|
|
@ -0,0 +1,105 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2024-2025 Matter Labs
|
||||
|
||||
//! Server to handle requests to the Vault TEE
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
use actix_web::rt::time::sleep;
|
||||
use anyhow::{Context, Result};
|
||||
use clap::Parser;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::time::Duration;
|
||||
use teepot::sgx::{parse_tcb_levels, EnumSet, TcbLevel};
|
||||
use teepot_vault::{
|
||||
client::vault::VaultConnection,
|
||||
server::{
|
||||
attestation::{get_quote_and_collateral, VaultAttestationArgs},
|
||||
pki::make_self_signed_cert,
|
||||
},
|
||||
};
|
||||
use tracing::{error, trace};
|
||||
use tracing_log::LogTracer;
|
||||
use tracing_subscriber::{fmt, prelude::*, EnvFilter, Registry};
|
||||
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
struct Arguments {
|
||||
/// allowed TCB levels, comma separated
|
||||
#[arg(long, value_parser = parse_tcb_levels, env = "ALLOWED_TCB_LEVELS", default_value = "Ok")]
|
||||
my_sgx_allowed_tcb_levels: EnumSet<TcbLevel>,
|
||||
#[clap(flatten)]
|
||||
pub attestation: VaultAttestationArgs,
|
||||
}
|
||||
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
struct MySecret {
|
||||
val: usize,
|
||||
}
|
||||
|
||||
#[actix_web::main]
|
||||
async fn main() -> Result<()> {
|
||||
LogTracer::init().context("Failed to set logger")?;
|
||||
|
||||
let subscriber = Registry::default()
|
||||
.with(EnvFilter::from_default_env())
|
||||
.with(fmt::layer().with_writer(std::io::stderr));
|
||||
tracing::subscriber::set_global_default(subscriber).unwrap();
|
||||
|
||||
let args = Arguments::parse();
|
||||
|
||||
let (report_data, _cert_chain, _priv_key) = make_self_signed_cert("CN=localhost", None)?;
|
||||
if let Err(e) = get_quote_and_collateral(Some(args.my_sgx_allowed_tcb_levels), &report_data) {
|
||||
error!("failed to get quote and collateral: {e:?}");
|
||||
// don't return for now, we can still serve requests but we won't be able to attest
|
||||
}
|
||||
|
||||
let mut vault_1 = args.attestation.clone();
|
||||
let mut vault_2 = args.attestation.clone();
|
||||
let mut vault_3 = args.attestation.clone();
|
||||
|
||||
vault_1.vault_addr = "https://vault-1:8210".to_string();
|
||||
vault_2.vault_addr = "https://vault-2:8210".to_string();
|
||||
vault_3.vault_addr = "https://vault-3:8210".to_string();
|
||||
|
||||
let servers = vec![vault_1.clone(), vault_2.clone(), vault_3.clone()];
|
||||
|
||||
let mut val: usize = 1;
|
||||
|
||||
loop {
|
||||
let mut conns = Vec::new();
|
||||
for server in &servers {
|
||||
match VaultConnection::new(&server.into(), "stress".to_string()).await {
|
||||
Ok(conn) => conns.push(conn),
|
||||
Err(e) => {
|
||||
error!("connecting to {}: {}", server.vault_addr, e);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if conns.is_empty() {
|
||||
error!("no connections");
|
||||
sleep(Duration::from_secs(1)).await;
|
||||
continue;
|
||||
}
|
||||
|
||||
let i = val % conns.len();
|
||||
trace!("storing secret");
|
||||
conns[i]
|
||||
.store_secret(MySecret { val }, "val")
|
||||
.await
|
||||
.context("storing secret")?;
|
||||
for conn in conns {
|
||||
let got: MySecret = conn
|
||||
.load_secret("val")
|
||||
.await
|
||||
.context("loading secret")?
|
||||
.context("loading secret")?;
|
||||
assert_eq!(got.val, val,);
|
||||
}
|
||||
val += 1;
|
||||
sleep(Duration::from_secs(1)).await;
|
||||
}
|
||||
}
|
||||
22
crates/teepot-vault/bin/tee-stress-client/src/stress.json
Normal file
22
crates/teepot-vault/bin/tee-stress-client/src/stress.json
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"last_digest": "",
|
||||
"commands": [
|
||||
{
|
||||
"url": "/v1/sys/policies/acl/tee-stress",
|
||||
"data": {
|
||||
"policy": "path \"secret/data/tee/stress/*\" { capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\" ] }\n"
|
||||
}
|
||||
},
|
||||
{
|
||||
"url": "/v1/auth/tee/tees/stress",
|
||||
"data": {
|
||||
"lease": "1000",
|
||||
"name": "stress",
|
||||
"sgx_allowed_tcb_levels": "Ok,SwHardeningNeeded",
|
||||
"sgx_mrsigner": "c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d",
|
||||
"token_policies": "tee-stress",
|
||||
"types": "sgx"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCAAdFiEEC0Pk344t4+guABNk9RmhFDs/vjIFAmUn5WkACgkQ9RmhFDs/
|
||||
vjK5kw/8Dl1XuMOfJ+mxshaRH4JexPmB/+c4x5JnaYS6GGJaJ/eOp+hSFchxnwfI
|
||||
OXRV3S+/kgaytfu5zVEepqyypX43LbV+eZ5s450xa3qI0fR/rd+LnJeJNqFoJVrZ
|
||||
M+xTGpkBPvPB3340ebyti5k49I+uhgO8c5Cd1FpM00dWN0qUUJMsFuOKNueFURlC
|
||||
Sk9HLDk63G2/ZDyBzT83vMpFUZbtJ46yJmS2++W1UfEt2GZvL6sc2wr7pwlb5EtF
|
||||
wEgLtaIAy749h1Lzilw6RTWVC3ShQvaddIFIh+XagnrKmk2D0gha2XprbvBSkpYf
|
||||
a/9tZKH/4U8wfONR3sJ83wlODwks6zdIibspk7868vY5Bm9Yr2N1cIIPGtnnypHE
|
||||
xPZI9QXY/zUSnTXgs5JyEZkea8j29v135zhuGINFPVWOa+frGYTIN/zZ3sjdhZMt
|
||||
+4rRL8SZbFbkCDc/zGdlJOcTygUbEJBiseNJ8GXgbWrXzY/WDZpxL1xdxjkPK4PA
|
||||
xtKyaPlBP1B1RyHkZGYDq86t9DzX2H/gkqBHJpuSavcx/7/Q/b6KGYdf/QFxo7kY
|
||||
S0jdVXRVem0ClxWtEVZU9Wu9QykcYQbj3AM7hk+9Khmq32w7b3bwOndYNAojwzP+
|
||||
9UEVOAXv2K8LSBbq6RXott5KMKDwowOu4hQCNsDuvmBYkr1Sy5OJAcUEAAEIAC8W
|
||||
IQSBoxLFnWedkw+p6LBtco8potur+AUCZSflbREcdGVzdEBleGFtcGxlLmNvbQAK
|
||||
CRBtco8potur+LwPC/wOjT27sE4D/4Cadg58lXlRE2qoFdtc8vfs+ioxS7UxQX4m
|
||||
ggY4P6lHq8u2TkY4jDe9FpA5S7LNGQJoQx2zrr3lGwonBwGkj4nRM60/uNSar+wd
|
||||
Wknke8IUiv8E8MzITy+gKdFHwu95ZZh9IXefiQ4Fq8UQurELAfVA/sNk+1ovGzsO
|
||||
/S4srkR4uejsAuk84PCA7dgNLYobcU/7SMH/ffgorqE6BOXwzfIy13c9TV5ZztWo
|
||||
eK6R+wc92hza0ZvXVmB4i5NBe+aO7gSLe0QcJqHdaTpkcVhhhE+v8HdpF1JIgOH8
|
||||
/336W/ZOp1q1K0hL2rNU2YX40MOaZZLoxjfXNmC/dAZPel5HJMwTLzM6Aqqk49sB
|
||||
LHEPgHjefUWiHe2C31PGM0THM3fuA6i5OwypnZRI14WYVDlVa5KRmj/titcCt6aQ
|
||||
+fbzK5lYIg4AhLl8rIns8+/yJnwTIw3Zy94H8Xwjq8tplk6nSUWm0GKjYqFquwUf
|
||||
6PyKGVnqs2Cp0hFmD9o=
|
||||
=AsWI
|
||||
-----END PGP SIGNATURE-----
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
libos.entrypoint = "/app/tee-stress-client"
|
||||
|
||||
[loader]
|
||||
argv = [ "/app/tee-stress-client" ]
|
||||
entrypoint = "file:{{ gramine.libos }}"
|
||||
env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}:/usr{{ arch_libdir }}:/lib"
|
||||
env.HOME = "/app"
|
||||
env.MALLOC_ARENA_MAX = "1"
|
||||
env.AZDCAP_DEBUG_LOG_LEVEL = "ignore"
|
||||
env.AZDCAP_COLLATERAL_VERSION = "v4"
|
||||
|
||||
### Admin Config ###
|
||||
env.PORT = { passthrough = true }
|
||||
|
||||
### VAULT attestation ###
|
||||
env.VAULT_ADDR = { passthrough = true }
|
||||
env.VAULT_SGX_MRENCLAVE = { passthrough = true }
|
||||
env.VAULT_SGX_MRSIGNER = { passthrough = true }
|
||||
env.VAULT_SGX_ALLOWED_TCB_LEVELS = { passthrough = true }
|
||||
|
||||
### DEBUG ###
|
||||
env.RUST_BACKTRACE = "1"
|
||||
env.RUST_LOG="info"
|
||||
|
||||
[fs]
|
||||
root.uri = "file:/"
|
||||
start_dir = "/app"
|
||||
mounts = [
|
||||
{ path = "{{ execdir }}", uri = "file:{{ execdir }}" },
|
||||
{ path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
|
||||
{ path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
|
||||
{ path = "/etc", uri = "file:/etc" },
|
||||
{ type = "tmpfs", path = "/var/tmp" },
|
||||
{ type = "tmpfs", path = "/tmp" },
|
||||
{ type = "tmpfs", path = "/app/.dcap-qcnl" },
|
||||
{ type = "tmpfs", path = "/app/.az-dcap-client" },
|
||||
{ path = "/lib/libdcap_quoteprov.so", uri = "file:/lib/libdcap_quoteprov.so" },
|
||||
]
|
||||
|
||||
[sgx]
|
||||
trusted_files = [
|
||||
"file:/etc/ld.so.cache",
|
||||
"file:/app/",
|
||||
"file:{{ execdir }}/",
|
||||
"file:{{ arch_libdir }}/",
|
||||
"file:/usr/{{ arch_libdir }}/",
|
||||
"file:{{ gramine.libos }}",
|
||||
"file:{{ gramine.runtimedir() }}/",
|
||||
"file:/usr/lib/ssl/openssl.cnf",
|
||||
"file:/etc/ssl/",
|
||||
"file:/etc/sgx_default_qcnl.conf",
|
||||
"file:/lib/libdcap_quoteprov.so",
|
||||
]
|
||||
remote_attestation = "dcap"
|
||||
max_threads = 64
|
||||
edmm_enable = false
|
||||
## max enclave size
|
||||
enclave_size = "8G"
|
||||
|
||||
[sys]
|
||||
enable_extra_runtime_domain_names_conf = true
|
||||
enable_sigterm_injection = true
|
||||
|
||||
# possible tweak option, if problems with mio
|
||||
# currently mio is compiled with `mio_unsupported_force_waker_pipe`
|
||||
# insecure__allow_eventfd = true
|
||||
25
crates/teepot-vault/bin/tee-vault-admin/Cargo.toml
Normal file
25
crates/teepot-vault/bin/tee-vault-admin/Cargo.toml
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
[package]
|
||||
name = "tee-vault-admin"
|
||||
publish = false
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
license.workspace = true
|
||||
repository.workspace = true
|
||||
|
||||
[dependencies]
|
||||
actix-web.workspace = true
|
||||
anyhow.workspace = true
|
||||
awc.workspace = true
|
||||
bytemuck.workspace = true
|
||||
clap.workspace = true
|
||||
hex.workspace = true
|
||||
rustls.workspace = true
|
||||
serde_json.workspace = true
|
||||
sha2.workspace = true
|
||||
teepot.workspace = true
|
||||
teepot-vault.workspace = true
|
||||
tracing.workspace = true
|
||||
tracing-actix-web.workspace = true
|
||||
tracing-log.workspace = true
|
||||
tracing-subscriber.workspace = true
|
||||
89
crates/teepot-vault/bin/tee-vault-admin/src/command.rs
Normal file
89
crates/teepot-vault/bin/tee-vault-admin/src/command.rs
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! post commands
|
||||
|
||||
use crate::ServerState;
|
||||
use actix_web::web;
|
||||
use anyhow::{anyhow, Context, Result};
|
||||
use awc::http::StatusCode;
|
||||
use sha2::{Digest, Sha256};
|
||||
use std::sync::Arc;
|
||||
use teepot_vault::client::vault::VaultConnection;
|
||||
use teepot_vault::json::http::{
|
||||
VaultCommandRequest, VaultCommandResponse, VaultCommands, VaultCommandsResponse,
|
||||
};
|
||||
use teepot_vault::json::secrets::{AdminConfig, AdminState};
|
||||
use teepot_vault::server::{signatures::VerifySig, HttpResponseError, Status};
|
||||
use tracing::instrument;
|
||||
|
||||
/// Post command
|
||||
#[instrument(level = "info", name = "/v1/command", skip_all)]
|
||||
pub async fn post_command(
|
||||
state: web::Data<Arc<ServerState>>,
|
||||
item: web::Json<VaultCommandRequest>,
|
||||
) -> Result<web::Json<VaultCommandsResponse>, HttpResponseError> {
|
||||
let conn = VaultConnection::new(&state.vault_attestation.clone().into(), "admin".to_string())
|
||||
.await
|
||||
.context("connecting to vault")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
let mut admin_state: AdminState = conn
|
||||
.load_secret("state")
|
||||
.await?
|
||||
.context("empty admin state")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
let commands: VaultCommands = serde_json::from_str(&item.commands)
|
||||
.context("parsing commands")
|
||||
.status(StatusCode::BAD_REQUEST)?;
|
||||
|
||||
if admin_state.last_digest.to_ascii_lowercase() != commands.last_digest {
|
||||
return Err(anyhow!(
|
||||
"last digest does not match {} != {}",
|
||||
admin_state.last_digest.to_ascii_lowercase(),
|
||||
commands.last_digest
|
||||
))
|
||||
.status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
let admin_config: AdminConfig = conn
|
||||
.load_secret("config")
|
||||
.await?
|
||||
.context("empty admin config")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
admin_config.check_sigs(&item.signatures, item.commands.as_bytes())?;
|
||||
|
||||
let mut hasher = Sha256::new();
|
||||
hasher.update(item.commands.as_bytes());
|
||||
let hash = hasher.finalize();
|
||||
let digest = hex::encode(hash);
|
||||
admin_state.last_digest.clone_from(&digest);
|
||||
conn.store_secret(admin_state, "state").await?;
|
||||
|
||||
let mut responds = VaultCommandsResponse {
|
||||
digest,
|
||||
results: vec![],
|
||||
};
|
||||
|
||||
for (pos, command) in commands.commands.iter().enumerate() {
|
||||
let resp = conn
|
||||
.vault_put(
|
||||
&format!("Executing command {pos}"),
|
||||
&command.url,
|
||||
&command.data,
|
||||
)
|
||||
.await?;
|
||||
|
||||
let vcr = VaultCommandResponse {
|
||||
status_code: resp.0.as_u16(),
|
||||
value: resp.1,
|
||||
};
|
||||
|
||||
responds.results.push(vcr);
|
||||
}
|
||||
|
||||
let _ = conn.revoke_token().await;
|
||||
|
||||
Ok(web::Json(responds))
|
||||
}
|
||||
34
crates/teepot-vault/bin/tee-vault-admin/src/digest.rs
Normal file
34
crates/teepot-vault/bin/tee-vault-admin/src/digest.rs
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! digest
|
||||
|
||||
use crate::ServerState;
|
||||
use actix_web::{web, HttpResponse};
|
||||
use anyhow::{Context, Result};
|
||||
use awc::http::StatusCode;
|
||||
use serde_json::json;
|
||||
use std::sync::Arc;
|
||||
use teepot_vault::client::vault::VaultConnection;
|
||||
use teepot_vault::json::secrets::AdminState;
|
||||
use teepot_vault::server::{HttpResponseError, Status};
|
||||
use tracing::instrument;
|
||||
|
||||
/// Get last digest
|
||||
#[instrument(level = "info", name = "/v1/digest", skip_all)]
|
||||
pub async fn get_digest(
|
||||
state: web::Data<Arc<ServerState>>,
|
||||
) -> Result<HttpResponse, HttpResponseError> {
|
||||
let conn = VaultConnection::new(&state.vault_attestation.clone().into(), "admin".to_string())
|
||||
.await
|
||||
.context("connecting to vault")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
let admin_state: AdminState = conn
|
||||
.load_secret("state")
|
||||
.await?
|
||||
.context("empty admin state")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
Ok(HttpResponse::Ok().json(json!({"last_digest": admin_state.last_digest })))
|
||||
}
|
||||
147
crates/teepot-vault/bin/tee-vault-admin/src/main.rs
Normal file
147
crates/teepot-vault/bin/tee-vault-admin/src/main.rs
Normal file
|
|
@ -0,0 +1,147 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2024 Matter Labs
|
||||
|
||||
//! Server to handle requests to the Vault TEE
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
mod command;
|
||||
mod digest;
|
||||
mod sign;
|
||||
|
||||
use actix_web::{web, web::Data, App, HttpServer};
|
||||
use anyhow::{Context, Result};
|
||||
use clap::Parser;
|
||||
use command::post_command;
|
||||
use digest::get_digest;
|
||||
use rustls::ServerConfig;
|
||||
use sign::post_sign;
|
||||
use std::{net::Ipv6Addr, sync::Arc};
|
||||
use teepot::sgx::{parse_tcb_levels, EnumSet, TcbLevel};
|
||||
use teepot_vault::{
|
||||
json::http::{SignRequest, VaultCommandRequest, DIGEST_URL},
|
||||
server::{
|
||||
attestation::{get_quote_and_collateral, VaultAttestationArgs},
|
||||
new_json_cfg,
|
||||
pki::make_self_signed_cert,
|
||||
},
|
||||
};
|
||||
use tracing::{error, info};
|
||||
use tracing_actix_web::TracingLogger;
|
||||
use tracing_log::LogTracer;
|
||||
use tracing_subscriber::{fmt, prelude::*, EnvFilter, Registry};
|
||||
|
||||
/// Server state
|
||||
pub struct ServerState {
|
||||
/// Server TLS public key hash
|
||||
pub report_data: [u8; 64],
|
||||
/// Vault attestation args
|
||||
pub vault_attestation: VaultAttestationArgs,
|
||||
}
|
||||
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
struct Arguments {
|
||||
/// allowed TCB levels, comma separated
|
||||
#[arg(long, value_parser = parse_tcb_levels, env = "ALLOWED_TCB_LEVELS", default_value = "Ok")]
|
||||
server_sgx_allowed_tcb_levels: EnumSet<TcbLevel>,
|
||||
/// port to listen on
|
||||
#[arg(long, env = "PORT", default_value = "8444")]
|
||||
port: u16,
|
||||
#[clap(flatten)]
|
||||
pub attestation: VaultAttestationArgs,
|
||||
}
|
||||
|
||||
#[actix_web::main]
|
||||
async fn main() -> Result<()> {
|
||||
LogTracer::init().context("Failed to set logger")?;
|
||||
|
||||
let subscriber = Registry::default()
|
||||
.with(EnvFilter::from_default_env())
|
||||
.with(fmt::layer().with_writer(std::io::stderr));
|
||||
tracing::subscriber::set_global_default(subscriber).unwrap();
|
||||
|
||||
let args = Arguments::parse();
|
||||
|
||||
let (report_data, cert_chain, priv_key) = make_self_signed_cert("CN=localhost", None)?;
|
||||
|
||||
if let Err(e) = get_quote_and_collateral(Some(args.server_sgx_allowed_tcb_levels), &report_data)
|
||||
{
|
||||
error!("failed to get quote and collateral: {e:?}");
|
||||
// don't return for now, we can still serve requests but we won't be able to attest
|
||||
}
|
||||
|
||||
let _ = rustls::crypto::ring::default_provider().install_default();
|
||||
|
||||
// init server config builder with safe defaults
|
||||
let config = ServerConfig::builder()
|
||||
.with_no_client_auth()
|
||||
.with_single_cert([cert_chain].into(), priv_key)
|
||||
.context("Failed to load TLS key/cert files")?;
|
||||
|
||||
info!("Starting HTTPS server at port {}", args.port);
|
||||
|
||||
info!("Quote verified! Connection secure!");
|
||||
|
||||
let server_state = Arc::new(ServerState {
|
||||
report_data,
|
||||
vault_attestation: args.attestation,
|
||||
});
|
||||
|
||||
let server = match HttpServer::new(move || {
|
||||
App::new()
|
||||
// enable logger
|
||||
.wrap(TracingLogger::default())
|
||||
.app_data(new_json_cfg())
|
||||
.app_data(Data::new(server_state.clone()))
|
||||
.service(web::resource(VaultCommandRequest::URL).route(web::post().to(post_command)))
|
||||
.service(web::resource(SignRequest::URL).route(web::post().to(post_sign)))
|
||||
.service(web::resource(DIGEST_URL).route(web::get().to(get_digest)))
|
||||
})
|
||||
.bind_rustls_0_23((Ipv6Addr::UNSPECIFIED, args.port), config)
|
||||
{
|
||||
Ok(c) => c,
|
||||
Err(e) => {
|
||||
error!("Failed to bind to port {}: {e:?}", args.port);
|
||||
return Err(e).context(format!("Failed to bind to port {}", args.port));
|
||||
}
|
||||
};
|
||||
|
||||
if let Err(e) = server.worker_max_blocking_threads(2).workers(8).run().await {
|
||||
error!("failed to start HTTPS server: {e:?}");
|
||||
return Err(e).context("Failed to start HTTPS server");
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use serde_json::json;
|
||||
use teepot_vault::json::http::{VaultCommand, VaultCommands};
|
||||
|
||||
const TEST_DATA: &str = include_str!("../../../tests/data/test.json");
|
||||
|
||||
#[test]
|
||||
fn test_vault_commands() {
|
||||
let cmd = VaultCommand {
|
||||
url: "/v1/auth/tee/tees/test".to_string(),
|
||||
data: json!({
|
||||
"lease": "1000",
|
||||
"name": "test",
|
||||
"types": "sgx",
|
||||
"sgx_allowed_tcb_levels": "Ok,SwHardeningNeeded",
|
||||
"sgx_mrsigner": "c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d",
|
||||
"token_policies": "test"
|
||||
}),
|
||||
};
|
||||
let cmds = VaultCommands {
|
||||
commands: vec![cmd],
|
||||
last_digest: "".into(),
|
||||
};
|
||||
|
||||
let test_data_cmds: VaultCommands = serde_json::from_str(TEST_DATA).unwrap();
|
||||
|
||||
assert_eq!(cmds, test_data_cmds);
|
||||
}
|
||||
}
|
||||
149
crates/teepot-vault/bin/tee-vault-admin/src/sign.rs
Normal file
149
crates/teepot-vault/bin/tee-vault-admin/src/sign.rs
Normal file
|
|
@ -0,0 +1,149 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! post signing request
|
||||
|
||||
use crate::ServerState;
|
||||
use actix_web::http::StatusCode;
|
||||
use actix_web::web;
|
||||
use anyhow::{anyhow, Context, Result};
|
||||
use sha2::{Digest, Sha256};
|
||||
use std::sync::Arc;
|
||||
use teepot::sgx::sign::PrivateKey as _;
|
||||
use teepot::sgx::sign::{Author, Signature};
|
||||
use teepot::sgx::sign::{Body, RS256PrivateKey};
|
||||
use teepot_vault::client::vault::VaultConnection;
|
||||
use teepot_vault::json::http::{SignRequest, SignRequestData, SignResponse};
|
||||
use teepot_vault::json::secrets::{AdminConfig, AdminState, SGXSigningKey};
|
||||
use teepot_vault::server::signatures::VerifySig as _;
|
||||
use teepot_vault::server::{HttpResponseError, Status};
|
||||
use tracing::instrument;
|
||||
|
||||
/// Sign command
|
||||
#[instrument(level = "info", name = "/v1/sign", skip_all)]
|
||||
pub async fn post_sign(
|
||||
state: web::Data<Arc<ServerState>>,
|
||||
item: web::Json<SignRequest>,
|
||||
) -> Result<web::Json<SignResponse>, HttpResponseError> {
|
||||
let conn = VaultConnection::new(&state.vault_attestation.clone().into(), "admin".to_string())
|
||||
.await
|
||||
.context("connecting to vault")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
let mut admin_state: AdminState = conn
|
||||
.load_secret("state")
|
||||
.await?
|
||||
.context("empty admin state")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
let sign_request: SignRequestData = serde_json::from_str(&item.sign_request_data)
|
||||
.context("parsing sign request data")
|
||||
.status(StatusCode::BAD_REQUEST)?;
|
||||
|
||||
// Sanity checks
|
||||
if sign_request.tee_type != "sgx" {
|
||||
return Err(anyhow!("tee_type not supported")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
let tee_name = sign_request.tee_name;
|
||||
|
||||
if !tee_name.is_ascii() {
|
||||
return Err(anyhow!("tee_name is not ascii")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
// check if tee_name is alphanumeric
|
||||
if !tee_name.chars().all(|c| c.is_alphanumeric()) {
|
||||
return Err(anyhow!("tee_name is not alphanumeric")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
// check if tee_name starts with an alphabetic char
|
||||
if !tee_name.chars().next().unwrap().is_alphabetic() {
|
||||
return Err(anyhow!("tee_name does not start with an alphabetic char"))
|
||||
.status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
if admin_state.last_digest != sign_request.last_digest {
|
||||
return Err(anyhow!(
|
||||
"last digest does not match {} != {}",
|
||||
admin_state.last_digest.to_ascii_lowercase(),
|
||||
sign_request.last_digest
|
||||
))
|
||||
.status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
let admin_config: AdminConfig = conn
|
||||
.load_secret("config")
|
||||
.await?
|
||||
.context("empty admin config")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
admin_config.check_sigs(&item.signatures, item.sign_request_data.as_bytes())?;
|
||||
|
||||
let mut hasher = Sha256::new();
|
||||
hasher.update(item.sign_request_data.as_bytes());
|
||||
let hash = hasher.finalize();
|
||||
let digest = hex::encode(hash);
|
||||
admin_state.last_digest.clone_from(&digest);
|
||||
conn.store_secret(admin_state, "state").await?;
|
||||
|
||||
// Sign SGX enclave
|
||||
let key_path = format!("signing_keys/{}", tee_name);
|
||||
|
||||
let sgx_key = match conn
|
||||
.load_secret::<SGXSigningKey>(&key_path)
|
||||
.await
|
||||
.context("Error loading signing key")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?
|
||||
{
|
||||
Some(key) => RS256PrivateKey::from_pem(&key.pem_pk)
|
||||
.context("Failed to parse private key")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?,
|
||||
None => {
|
||||
let private_key = RS256PrivateKey::generate(3)
|
||||
.context("Failed to generate private key")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
let pem_pk = private_key
|
||||
.to_pem()
|
||||
.context("Failed to convert private key to pem")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
let key = SGXSigningKey { pem_pk };
|
||||
|
||||
conn.store_secret(key.clone(), &key_path)
|
||||
.await
|
||||
.context("Error storing generated private key")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
private_key
|
||||
}
|
||||
};
|
||||
|
||||
let signed_data = sign_sgx(&sign_request.data, &sgx_key)?;
|
||||
let respond = SignResponse {
|
||||
digest,
|
||||
signed_data,
|
||||
};
|
||||
|
||||
let _ = conn.revoke_token().await;
|
||||
|
||||
Ok(web::Json(respond))
|
||||
}
|
||||
|
||||
fn sign_sgx(body_bytes: &[u8], sgx_key: &RS256PrivateKey) -> Result<Vec<u8>, HttpResponseError> {
|
||||
let body: Body = bytemuck::try_pod_read_unaligned(body_bytes)
|
||||
.context("Invalid SGX input data")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
if body.can_set_debug() {
|
||||
return Err(anyhow!("Not signing SGX enclave with debug flag"))
|
||||
.status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
// FIXME: do we need the date and sw defined value?
|
||||
let author = Author::new(0, 0);
|
||||
let sig = Signature::new(sgx_key, author, body)
|
||||
.context("Failed to create RSA signature")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
Ok(bytemuck::bytes_of(&sig).to_vec())
|
||||
}
|
||||
21
crates/teepot-vault/bin/tee-vault-unseal/Cargo.toml
Normal file
21
crates/teepot-vault/bin/tee-vault-unseal/Cargo.toml
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
[package]
|
||||
name = "tee-vault-unseal"
|
||||
publish = false
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
license.workspace = true
|
||||
repository.workspace = true
|
||||
|
||||
[dependencies]
|
||||
actix-web.workspace = true
|
||||
anyhow.workspace = true
|
||||
awc.workspace = true
|
||||
clap.workspace = true
|
||||
rustls.workspace = true
|
||||
serde_json.workspace = true
|
||||
teepot.workspace = true
|
||||
teepot-vault.workspace = true
|
||||
tracing.workspace = true
|
||||
tracing-log.workspace = true
|
||||
tracing-subscriber.workspace = true
|
||||
|
|
@ -0,0 +1,80 @@
|
|||
# Read system health check
|
||||
path "sys/health"
|
||||
{
|
||||
capabilities = ["read", "sudo"]
|
||||
}
|
||||
|
||||
# Create and manage ACL policies broadly across Vault
|
||||
|
||||
# List existing policies
|
||||
path "sys/policies/acl"
|
||||
{
|
||||
capabilities = ["list"]
|
||||
}
|
||||
|
||||
# Create and manage ACL policies
|
||||
path "sys/policies/acl/*"
|
||||
{
|
||||
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
||||
}
|
||||
|
||||
# Enable and manage authentication methods broadly across Vault
|
||||
|
||||
# Manage auth methods broadly across Vault
|
||||
path "auth/*"
|
||||
{
|
||||
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
||||
}
|
||||
|
||||
# Create, update, and delete auth methods
|
||||
path "sys/auth/*"
|
||||
{
|
||||
capabilities = ["create", "update", "delete", "sudo"]
|
||||
}
|
||||
|
||||
# List auth methods
|
||||
path "sys/auth"
|
||||
{
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
# Enable and manage the key/value secrets engine at `secret/` path
|
||||
|
||||
# List, create, update, and delete key/value secrets
|
||||
path "secret/*"
|
||||
{
|
||||
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
||||
}
|
||||
|
||||
# Manage secrets engines
|
||||
path "sys/mounts/*"
|
||||
{
|
||||
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
||||
}
|
||||
|
||||
# List existing secrets engines.
|
||||
path "sys/mounts"
|
||||
{
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
# Manage plugins
|
||||
# https://developer.hashicorp.com/vault/api-docs/system/plugins-catalog
|
||||
path "sys/plugins/catalog/*"
|
||||
{
|
||||
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
||||
}
|
||||
|
||||
# List existing plugins
|
||||
# https://developer.hashicorp.com/vault/api-docs/system/plugins-catalog
|
||||
path "sys/plugins/catalog"
|
||||
{
|
||||
capabilities = ["list"]
|
||||
}
|
||||
|
||||
# Reload plugins
|
||||
# https://developer.hashicorp.com/vault/api-docs/system/plugins-reload-backend
|
||||
path "sys/plugins/reload/backend"
|
||||
{
|
||||
capabilities = ["create", "update", "sudo"]
|
||||
}
|
||||
137
crates/teepot-vault/bin/tee-vault-unseal/src/init.rs
Normal file
137
crates/teepot-vault/bin/tee-vault-unseal/src/init.rs
Normal file
|
|
@ -0,0 +1,137 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
use crate::{get_vault_status, UnsealServerState, Worker};
|
||||
use actix_web::error::ErrorBadRequest;
|
||||
use actix_web::{web, HttpResponse};
|
||||
use anyhow::{anyhow, Context, Result};
|
||||
use awc::http::StatusCode;
|
||||
use serde_json::json;
|
||||
use teepot_vault::client::TeeConnection;
|
||||
use teepot_vault::json::http::{Init, InitResponse, VaultInitRequest};
|
||||
use teepot_vault::json::secrets::AdminConfig;
|
||||
use teepot_vault::server::{HttpResponseError, Status};
|
||||
use tracing::{debug, error, info, instrument, trace};
|
||||
|
||||
#[instrument(level = "info", name = "/v1/sys/init", skip_all)]
|
||||
pub async fn post_init(
|
||||
worker: web::Data<Worker>,
|
||||
init: web::Json<Init>,
|
||||
) -> Result<HttpResponse, HttpResponseError> {
|
||||
let Init {
|
||||
pgp_keys,
|
||||
secret_shares,
|
||||
secret_threshold,
|
||||
admin_pgp_keys,
|
||||
admin_threshold,
|
||||
admin_tee_mrenclave,
|
||||
} = init.into_inner();
|
||||
let conn = TeeConnection::new(&worker.vault_attestation);
|
||||
let client = conn.client();
|
||||
let vault_url = &worker.config.vault_url;
|
||||
|
||||
let vault_init = VaultInitRequest {
|
||||
pgp_keys,
|
||||
secret_shares,
|
||||
secret_threshold,
|
||||
};
|
||||
|
||||
if admin_threshold < 1 {
|
||||
return Ok(HttpResponse::from_error(ErrorBadRequest(
|
||||
json!({"error": "admin_threshold must be at least 1"}),
|
||||
)));
|
||||
}
|
||||
|
||||
if admin_threshold > admin_pgp_keys.len() {
|
||||
return Ok(HttpResponse::from_error(ErrorBadRequest(
|
||||
json!({"error": "admin_threshold must be less than or equal to the number of admin_pgp_keys"}),
|
||||
)));
|
||||
}
|
||||
|
||||
loop {
|
||||
let current_state = worker.state.read().unwrap().clone();
|
||||
match current_state {
|
||||
UnsealServerState::VaultUninitialized => {
|
||||
break;
|
||||
}
|
||||
UnsealServerState::VaultUnsealed => {
|
||||
return Err(anyhow!("Vault already unsealed")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
UnsealServerState::VaultInitialized { .. } => {
|
||||
return Err(anyhow!("Vault already initialized")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
UnsealServerState::VaultInitializedAndConfigured => {
|
||||
return Err(anyhow!("Vault already initialized")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
UnsealServerState::Undefined => {
|
||||
let state = get_vault_status(vault_url, client).await;
|
||||
*worker.state.write().unwrap() = state;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
trace!(
|
||||
"Sending init request to Vault {}",
|
||||
serde_json::to_string(&vault_init).unwrap()
|
||||
);
|
||||
let mut response = client
|
||||
.post(format!("{}/v1/sys/init", vault_url))
|
||||
.send_json(&vault_init)
|
||||
.await?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("Vault returned server error: {}", status_code);
|
||||
return Err(HttpResponseError::from_proxy(response).await);
|
||||
}
|
||||
|
||||
let response = response
|
||||
.json::<serde_json::Value>()
|
||||
.await
|
||||
.context("Failed to convert to json")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
info!("Vault initialized");
|
||||
trace!("response {}", response);
|
||||
|
||||
let root_token = response["root_token"]
|
||||
.as_str()
|
||||
.ok_or(anyhow!("No `root_token` field"))
|
||||
.status(StatusCode::BAD_GATEWAY)?
|
||||
.to_string();
|
||||
|
||||
debug!("Root token: {root_token}");
|
||||
|
||||
let unseal_keys = response["keys_base64"]
|
||||
.as_array()
|
||||
.ok_or(anyhow!("No `keys_base64` field"))
|
||||
.status(StatusCode::BAD_GATEWAY)?
|
||||
.iter()
|
||||
.map(|v| v.as_str().unwrap().to_string())
|
||||
.collect::<Vec<_>>();
|
||||
|
||||
debug!("Unseal keys: {}", unseal_keys.join(", "));
|
||||
|
||||
/*
|
||||
FIXME: use unseal keys to create new token
|
||||
let mut output = File::create("/opt/vault/data/root_token")
|
||||
.context("Failed to create `/opt/vault/data/root_token`")?;
|
||||
output
|
||||
.write_all(root_token.as_bytes())
|
||||
.context("Failed to write root_token")?;
|
||||
*/
|
||||
|
||||
*worker.state.write().unwrap() = UnsealServerState::VaultInitialized {
|
||||
admin_config: AdminConfig {
|
||||
admin_pgp_keys,
|
||||
admin_threshold,
|
||||
},
|
||||
admin_tee_mrenclave,
|
||||
root_token,
|
||||
};
|
||||
|
||||
let response = InitResponse { unseal_keys };
|
||||
|
||||
Ok(HttpResponse::Ok().json(response)) // <- send response
|
||||
}
|
||||
236
crates/teepot-vault/bin/tee-vault-unseal/src/main.rs
Normal file
236
crates/teepot-vault/bin/tee-vault-unseal/src/main.rs
Normal file
|
|
@ -0,0 +1,236 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2024 Matter Labs
|
||||
|
||||
//! Server to initialize and unseal the Vault TEE.
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
mod init;
|
||||
mod unseal;
|
||||
|
||||
use actix_web::{rt::time::sleep, web, web::Data, App, HttpServer};
|
||||
use anyhow::{bail, Context, Result};
|
||||
use awc::Client;
|
||||
use clap::Parser;
|
||||
use init::post_init;
|
||||
use rustls::ServerConfig;
|
||||
use std::fmt::Debug;
|
||||
use std::io::Read;
|
||||
use std::net::Ipv6Addr;
|
||||
use std::path::PathBuf;
|
||||
use std::sync::{Arc, RwLock};
|
||||
use std::time::Duration;
|
||||
use teepot::pki::make_self_signed_cert;
|
||||
use teepot::sgx::{parse_tcb_levels, EnumSet, TcbLevel};
|
||||
use teepot_vault::client::{AttestationArgs, TeeConnection};
|
||||
use teepot_vault::json::http::{Init, Unseal};
|
||||
use teepot_vault::json::secrets::AdminConfig;
|
||||
use teepot_vault::server::attestation::{get_quote_and_collateral, VaultAttestationArgs};
|
||||
use teepot_vault::server::new_json_cfg;
|
||||
use tracing::{error, info};
|
||||
use tracing_log::LogTracer;
|
||||
use tracing_subscriber::{fmt, prelude::*, EnvFilter, Registry};
|
||||
use unseal::post_unseal;
|
||||
|
||||
const VAULT_TOKEN_HEADER: &str = "X-Vault-Token";
|
||||
|
||||
/// Worker thread state and data
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct Worker {
|
||||
/// TLS config for the HTTPS client
|
||||
pub vault_attestation: Arc<AttestationArgs>,
|
||||
/// Server config
|
||||
pub config: Arc<UnsealServerConfig>,
|
||||
/// Server state
|
||||
pub state: Arc<RwLock<UnsealServerState>>,
|
||||
}
|
||||
|
||||
/// Global Server config
|
||||
#[derive(Debug, Default)]
|
||||
pub struct UnsealServerConfig {
|
||||
/// Vault URL
|
||||
pub vault_url: String,
|
||||
/// The expected report_data for the Vault TEE
|
||||
pub report_data: Box<[u8]>,
|
||||
/// allowed TCB levels
|
||||
pub allowed_tcb_levels: Option<EnumSet<TcbLevel>>,
|
||||
/// SHA256 of the vault_auth_tee plugin binary
|
||||
pub vault_auth_tee_sha: String,
|
||||
/// version string of the vault_auth_tee plugin
|
||||
pub vault_auth_tee_version: String,
|
||||
/// the common cacert file for the vault cluster
|
||||
pub ca_cert_file: PathBuf,
|
||||
}
|
||||
|
||||
/// Server state
|
||||
#[derive(Debug, Clone)]
|
||||
pub enum UnsealServerState {
|
||||
/// Undefined
|
||||
Undefined,
|
||||
/// Vault is not yet initialized
|
||||
VaultUninitialized,
|
||||
/// Vault is initialized but not unsealed
|
||||
VaultInitialized {
|
||||
/// config for the admin TEE
|
||||
admin_config: AdminConfig,
|
||||
/// initial admin TEE mrenclave
|
||||
admin_tee_mrenclave: String,
|
||||
/// Vault root token
|
||||
root_token: String,
|
||||
},
|
||||
/// Vault is already initialized but not unsealed
|
||||
/// and should already be configured
|
||||
VaultInitializedAndConfigured,
|
||||
/// Vault is unsealed
|
||||
VaultUnsealed,
|
||||
}
|
||||
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
struct Args {
|
||||
/// allowed TCB levels, comma separated
|
||||
#[arg(long, value_parser = parse_tcb_levels, env = "ALLOWED_TCB_LEVELS", default_value = "Ok")]
|
||||
allowed_tcb_levels: EnumSet<TcbLevel>,
|
||||
/// port to listen on
|
||||
#[arg(long, env = "PORT", default_value = "8443")]
|
||||
port: u16,
|
||||
/// the sha256 of the `vault_auth_tee` plugin, with precedence over the file
|
||||
#[arg(long, env = "VAULT_AUTH_TEE_SHA256")]
|
||||
vault_auth_tee_sha: Option<String>,
|
||||
/// the file containing the sha256 of the `vault_auth_tee` plugin
|
||||
#[arg(long, env = "VAULT_AUTH_TEE_SHA256_FILE")]
|
||||
vault_auth_tee_sha_file: Option<PathBuf>,
|
||||
#[arg(long, env = "VAULT_AUTH_TEE_VERSION")]
|
||||
vault_auth_tee_version: String,
|
||||
/// ca cert file
|
||||
#[arg(long, env = "CA_CERT_FILE", default_value = "/opt/vault/cacert.pem")]
|
||||
ca_cert_file: PathBuf,
|
||||
#[clap(flatten)]
|
||||
pub attestation: VaultAttestationArgs,
|
||||
}
|
||||
|
||||
#[actix_web::main]
|
||||
async fn main() -> Result<()> {
|
||||
LogTracer::init().context("Failed to set logger")?;
|
||||
|
||||
let subscriber = Registry::default()
|
||||
.with(EnvFilter::from_default_env())
|
||||
.with(
|
||||
fmt::layer()
|
||||
.with_span_events(fmt::format::FmtSpan::NEW)
|
||||
.with_writer(std::io::stderr),
|
||||
);
|
||||
tracing::subscriber::set_global_default(subscriber).unwrap();
|
||||
|
||||
let args = Args::parse();
|
||||
|
||||
info!("Starting up");
|
||||
|
||||
if let Err(e) = get_quote_and_collateral(Some(args.allowed_tcb_levels), &[0u8; 64]) {
|
||||
error!("failed to get quote and collateral: {e:?}");
|
||||
// don't return for now, we can still serve requests but we won't be able to attest
|
||||
}
|
||||
|
||||
let (report_data, cert_chain, priv_key) = make_self_signed_cert("CN=localhost", None)?;
|
||||
|
||||
let _ = rustls::crypto::ring::default_provider().install_default();
|
||||
|
||||
// init server config builder with safe defaults
|
||||
let config = ServerConfig::builder()
|
||||
.with_no_client_auth()
|
||||
.with_single_cert([cert_chain].into(), priv_key)
|
||||
.context("Failed to load TLS key/cert files")?;
|
||||
|
||||
let attestation_args: AttestationArgs = args.attestation.clone().into();
|
||||
|
||||
let conn = TeeConnection::new(&attestation_args);
|
||||
|
||||
let server_state = get_vault_status(&args.attestation.vault_addr, conn.client()).await;
|
||||
|
||||
let vault_auth_tee_sha = if let Some(vault_auth_tee_sha) = args.vault_auth_tee_sha {
|
||||
vault_auth_tee_sha
|
||||
} else if let Some(sha_file) = args.vault_auth_tee_sha_file {
|
||||
let mut file = std::fs::File::open(sha_file)?;
|
||||
let mut contents = String::new();
|
||||
file.read_to_string(&mut contents)?;
|
||||
contents.trim_end().into()
|
||||
} else {
|
||||
bail!("Neither `VAULT_AUTH_TEE_SHA256_FILE` nor `VAULT_AUTH_TEE_SHA256` set!");
|
||||
};
|
||||
|
||||
info!("Starting HTTPS server at port {}", args.port);
|
||||
let server_config = Arc::new(UnsealServerConfig {
|
||||
vault_url: args.attestation.vault_addr,
|
||||
report_data: Box::from(report_data),
|
||||
allowed_tcb_levels: Some(args.allowed_tcb_levels),
|
||||
vault_auth_tee_sha,
|
||||
vault_auth_tee_version: args.vault_auth_tee_version,
|
||||
ca_cert_file: args.ca_cert_file,
|
||||
});
|
||||
|
||||
let server_state = Arc::new(RwLock::new(server_state));
|
||||
|
||||
let worker = Worker {
|
||||
vault_attestation: Arc::new(attestation_args),
|
||||
config: server_config,
|
||||
state: server_state,
|
||||
};
|
||||
|
||||
let server = match HttpServer::new(move || {
|
||||
App::new()
|
||||
// enable logger
|
||||
//.wrap(TracingLogger::default())
|
||||
.app_data(new_json_cfg())
|
||||
.app_data(Data::new(worker.clone()))
|
||||
.service(web::resource(Init::URL).route(web::post().to(post_init)))
|
||||
.service(web::resource(Unseal::URL).route(web::post().to(post_unseal)))
|
||||
})
|
||||
.bind_rustls_0_23((Ipv6Addr::UNSPECIFIED, args.port), config)
|
||||
{
|
||||
Ok(c) => c,
|
||||
Err(e) => {
|
||||
error!("Failed to bind to port {}: {e:?}", args.port);
|
||||
return Err(e).context(format!("Failed to bind to port {}", args.port));
|
||||
}
|
||||
};
|
||||
|
||||
if let Err(e) = server.worker_max_blocking_threads(2).workers(8).run().await {
|
||||
error!("failed to start HTTPS server: {e:?}");
|
||||
return Err(e).context("Failed to start HTTPS server");
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn get_vault_status(vault_url: &str, client: &Client) -> UnsealServerState {
|
||||
loop {
|
||||
let r = client
|
||||
.get(format!("{}/v1/sys/health", vault_url))
|
||||
.send()
|
||||
.await;
|
||||
|
||||
if let Ok(r) = r {
|
||||
// https://developer.hashicorp.com/vault/api-docs/system/health
|
||||
match r.status().as_u16() {
|
||||
200 | 429 | 472 | 473 => {
|
||||
info!("Vault is initialized and unsealed");
|
||||
break UnsealServerState::VaultUnsealed;
|
||||
}
|
||||
501 => {
|
||||
info!("Vault is not initialized");
|
||||
break UnsealServerState::VaultUninitialized;
|
||||
}
|
||||
503 => {
|
||||
info!("Vault is initialized but not unsealed");
|
||||
break UnsealServerState::VaultInitializedAndConfigured;
|
||||
}
|
||||
s => {
|
||||
error!("Vault is not ready: status code {s}");
|
||||
}
|
||||
}
|
||||
}
|
||||
info!("Waiting for vault to be ready");
|
||||
sleep(Duration::from_secs(1)).await;
|
||||
}
|
||||
}
|
||||
409
crates/teepot-vault/bin/tee-vault-unseal/src/unseal.rs
Normal file
409
crates/teepot-vault/bin/tee-vault-unseal/src/unseal.rs
Normal file
|
|
@ -0,0 +1,409 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
use crate::{get_vault_status, UnsealServerConfig, UnsealServerState, Worker, VAULT_TOKEN_HEADER};
|
||||
use actix_web::http::StatusCode;
|
||||
use actix_web::rt::time::sleep;
|
||||
use actix_web::{web, HttpResponse};
|
||||
use anyhow::{anyhow, Context, Result};
|
||||
use awc::{Client, ClientRequest, SendClientRequest};
|
||||
use serde_json::{json, Value};
|
||||
use std::fs::File;
|
||||
use std::future::Future;
|
||||
use std::io::Read;
|
||||
use std::time::Duration;
|
||||
use teepot_vault::client::vault::VaultConnection;
|
||||
use teepot_vault::client::TeeConnection;
|
||||
use teepot_vault::json::http::Unseal;
|
||||
use teepot_vault::json::secrets::{AdminConfig, AdminState};
|
||||
use teepot_vault::server::{HttpResponseError, Status};
|
||||
use tracing::{debug, error, info, instrument, trace};
|
||||
|
||||
#[instrument(level = "info", name = "/v1/sys/unseal", skip_all)]
|
||||
pub async fn post_unseal(
|
||||
worker: web::Data<Worker>,
|
||||
item: web::Json<Unseal>,
|
||||
) -> Result<HttpResponse, HttpResponseError> {
|
||||
let conn = TeeConnection::new(&worker.vault_attestation);
|
||||
let client = conn.client();
|
||||
let app = &worker.config;
|
||||
let vault_url = &app.vault_url;
|
||||
|
||||
loop {
|
||||
let current_state = worker.state.read().unwrap().clone();
|
||||
match current_state {
|
||||
UnsealServerState::VaultUninitialized => {
|
||||
return Err(anyhow!("Vault not yet initialized")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
UnsealServerState::VaultUnsealed => {
|
||||
return Err(anyhow!("Vault already unsealed")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
UnsealServerState::VaultInitialized { .. } => {
|
||||
break;
|
||||
}
|
||||
UnsealServerState::VaultInitializedAndConfigured => {
|
||||
break;
|
||||
}
|
||||
UnsealServerState::Undefined => {
|
||||
let state = get_vault_status(vault_url, client).await;
|
||||
*worker.state.write().unwrap() = state;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
let mut response = client
|
||||
.post(format!("{}/v1/sys/unseal", vault_url))
|
||||
.send_json(&item.0)
|
||||
.await?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("Vault returned server error: {}", status_code);
|
||||
let mut client_resp = HttpResponse::build(status_code);
|
||||
for (header_name, header_value) in response.headers().iter() {
|
||||
client_resp.insert_header((header_name.clone(), header_value.clone()));
|
||||
}
|
||||
return Ok(client_resp.streaming(response));
|
||||
}
|
||||
|
||||
let response: Value = response
|
||||
.json()
|
||||
.await
|
||||
.context("parsing unseal response")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
debug!("unseal: {:?}", response);
|
||||
|
||||
if response.get("errors").is_some() {
|
||||
return Ok(HttpResponse::Ok().json(response));
|
||||
}
|
||||
|
||||
let sealed = response
|
||||
.get("sealed")
|
||||
.map(|v| v.as_bool().unwrap_or(true))
|
||||
.unwrap_or(true);
|
||||
|
||||
debug!(sealed);
|
||||
|
||||
// if unsealed
|
||||
if !sealed {
|
||||
let mut state = UnsealServerState::VaultUnsealed;
|
||||
std::mem::swap(&mut *worker.state.write().unwrap(), &mut state);
|
||||
|
||||
match state {
|
||||
UnsealServerState::VaultUninitialized => {
|
||||
return Err(anyhow!("Invalid internal state")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
UnsealServerState::VaultUnsealed => {
|
||||
return Err(anyhow!("Invalid internal state")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
UnsealServerState::VaultInitialized {
|
||||
admin_config,
|
||||
admin_tee_mrenclave,
|
||||
root_token,
|
||||
} => {
|
||||
debug!(root_token);
|
||||
info!("Vault is unsealed");
|
||||
|
||||
vault_configure_unsealed(
|
||||
app,
|
||||
&admin_config,
|
||||
&root_token,
|
||||
&admin_tee_mrenclave,
|
||||
client,
|
||||
)
|
||||
.await
|
||||
.context("Failed to configure unsealed vault")
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
// destroy root token
|
||||
let _response = client
|
||||
.post(format!("{}/v1/auth/token/revoke-self", app.vault_url))
|
||||
.insert_header((VAULT_TOKEN_HEADER, root_token.to_string()))
|
||||
.send()
|
||||
.await;
|
||||
|
||||
info!("Vault unsealed and configured!");
|
||||
}
|
||||
UnsealServerState::VaultInitializedAndConfigured => {
|
||||
info!("Vault is unsealed and hopefully configured!");
|
||||
info!("Initiating raft join");
|
||||
// load TLS cert chain
|
||||
let mut cert_file = File::open(&app.ca_cert_file)
|
||||
.context("Failed to open TLS cert chain")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
let mut cert_buf = Vec::new();
|
||||
cert_file
|
||||
.read_to_end(&mut cert_buf)
|
||||
.context("Failed to read TLS cert chain")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
let cert_chain = std::str::from_utf8(&cert_buf)
|
||||
.context("Failed to parse TLS cert chain as UTF-8")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?
|
||||
.to_string();
|
||||
|
||||
let payload = json!({"leader_ca_cert": cert_chain, "retry": true });
|
||||
|
||||
let mut response = client
|
||||
.post(format!("{}/v1/sys/storage/raft/join", vault_url))
|
||||
.send_json(&payload)
|
||||
.await?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("Vault returned server error: {}", status_code);
|
||||
let mut client_resp = HttpResponse::build(status_code);
|
||||
for (header_name, header_value) in response.headers().iter() {
|
||||
client_resp.insert_header((header_name.clone(), header_value.clone()));
|
||||
}
|
||||
return Ok(client_resp.streaming(response));
|
||||
}
|
||||
|
||||
let response: Value = response
|
||||
.json()
|
||||
.await
|
||||
.context("parsing raft join response")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
debug!("raft join: {:?}", response);
|
||||
|
||||
if response.get("errors").is_some() {
|
||||
return Ok(HttpResponse::Ok().json(response));
|
||||
}
|
||||
}
|
||||
UnsealServerState::Undefined => {
|
||||
unreachable!("Invalid internal state");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Ok(HttpResponse::Accepted().json(response)) // <- send response
|
||||
}
|
||||
|
||||
pub async fn vault_configure_unsealed(
|
||||
app: &UnsealServerConfig,
|
||||
admin_config: &AdminConfig,
|
||||
root_token: &str,
|
||||
admin_tee_mrenclave: &str,
|
||||
c: &Client,
|
||||
) -> Result<(), HttpResponseError> {
|
||||
wait_for_plugins_catalog(app, root_token, c).await;
|
||||
|
||||
if !plugin_is_already_running(app, root_token, c).await? {
|
||||
let r = vault(
|
||||
"Installing vault-auth-tee plugin",
|
||||
c.put(format!(
|
||||
"{}/v1/sys/plugins/catalog/auth/vault-auth-tee",
|
||||
app.vault_url
|
||||
)),
|
||||
root_token,
|
||||
json!({
|
||||
"sha256": app.vault_auth_tee_sha,
|
||||
"command": "vault-auth-tee",
|
||||
"version": app.vault_auth_tee_version
|
||||
}),
|
||||
)
|
||||
.await
|
||||
.map_err(|e| anyhow!("{:?}", e))
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
if !r.status().is_success() {
|
||||
let err = HttpResponseError::from_proxy(r).await;
|
||||
return Err(err);
|
||||
}
|
||||
} else {
|
||||
info!("vault-auth-tee plugin already installed");
|
||||
}
|
||||
|
||||
if !plugin_is_already_running(app, root_token, c).await? {
|
||||
let r = vault(
|
||||
"Activating vault-auth-tee plugin",
|
||||
c.post(format!("{}/v1/sys/auth/tee", app.vault_url)),
|
||||
root_token,
|
||||
json!({"type": "vault-auth-tee"}),
|
||||
)
|
||||
.await
|
||||
.map_err(|e| anyhow!("{:?}", e))
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
if !r.status().is_success() {
|
||||
let err = HttpResponseError::from_proxy(r).await;
|
||||
return Err(err);
|
||||
}
|
||||
} else {
|
||||
info!("vault-auth-tee plugin already activated");
|
||||
}
|
||||
|
||||
if let Ok(mut r) = c
|
||||
.get(format!("{}/v1/auth/tee/tees?list=true", app.vault_url))
|
||||
.insert_header((VAULT_TOKEN_HEADER, root_token))
|
||||
.send()
|
||||
.await
|
||||
{
|
||||
let r: Value = r
|
||||
.json()
|
||||
.await
|
||||
.map_err(|e| anyhow!("{:?}", e))
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
trace!("{:?}", r);
|
||||
if let Some(tees) = r.get("data").and_then(|v| v.get("keys")) {
|
||||
if let Some(tees) = tees.as_array() {
|
||||
if tees.contains(&json!("root")) {
|
||||
info!("root TEE already installed");
|
||||
return Ok(());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
vault(
|
||||
"Installing root TEE",
|
||||
c.put(format!("{}/v1/auth/tee/tees/admin", app.vault_url)),
|
||||
root_token,
|
||||
json!({
|
||||
"lease": "1000",
|
||||
"name": "admin",
|
||||
"types": "sgx",
|
||||
"sgx_allowed_tcb_levels": "Ok,SwHardeningNeeded",
|
||||
"sgx_mrenclave": &admin_tee_mrenclave,
|
||||
"token_policies": "admin"
|
||||
}),
|
||||
)
|
||||
.await
|
||||
.map_err(|e| anyhow!("{:?}", e))
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
// Install admin policies
|
||||
let admin_policy = include_str!("admin-policy.hcl");
|
||||
vault(
|
||||
"Installing admin policy",
|
||||
c.put(format!("{}/v1/sys/policies/acl/admin", app.vault_url)),
|
||||
root_token,
|
||||
json!({ "policy": admin_policy }),
|
||||
)
|
||||
.await
|
||||
.map_err(|e| anyhow!("{:?}", e))
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
vault(
|
||||
"Enable the key/value secrets engine v1 at secret/.",
|
||||
c.put(format!("{}/v1/sys/mounts/secret", app.vault_url)),
|
||||
root_token,
|
||||
json!({ "type": "kv", "description": "K/V v1" } ),
|
||||
)
|
||||
.await
|
||||
.map_err(|e| anyhow!("{:?}", e))
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
|
||||
// Create a `VaultConnection` for the `admin` tee to initialize the secrets for it.
|
||||
// Safety: the connection was already attested
|
||||
let admin_vcon = unsafe {
|
||||
VaultConnection::new_from_client_without_attestation(
|
||||
app.vault_url.clone(),
|
||||
c.clone(),
|
||||
"admin".into(),
|
||||
root_token.to_string(),
|
||||
)
|
||||
};
|
||||
|
||||
// initialize the admin config
|
||||
admin_vcon.store_secret(admin_config, "config").await?;
|
||||
admin_vcon
|
||||
.store_secret(AdminState::default(), "state")
|
||||
.await?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn wait_for_plugins_catalog(app: &UnsealServerConfig, root_token: &str, c: &Client) {
|
||||
info!("Waiting for plugins to be loaded");
|
||||
loop {
|
||||
let r = c
|
||||
.get(format!("{}/v1/sys/plugins/catalog", app.vault_url))
|
||||
.insert_header((VAULT_TOKEN_HEADER, root_token))
|
||||
.send()
|
||||
.await;
|
||||
|
||||
match r {
|
||||
Ok(r) => {
|
||||
if r.status().is_success() {
|
||||
break;
|
||||
} else {
|
||||
debug!("/v1/sys/plugins/catalog status: {:#?}", r)
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("/v1/sys/plugins/catalog error: {}", e)
|
||||
}
|
||||
}
|
||||
|
||||
info!("Waiting for plugins to be loaded");
|
||||
sleep(Duration::from_secs(1)).await;
|
||||
}
|
||||
}
|
||||
|
||||
async fn plugin_is_already_running(
|
||||
app: &UnsealServerConfig,
|
||||
root_token: &str,
|
||||
c: &Client,
|
||||
) -> std::result::Result<bool, HttpResponseError> {
|
||||
if let Ok(mut r) = c
|
||||
.get(format!("{}/v1/sys/auth", app.vault_url))
|
||||
.insert_header((VAULT_TOKEN_HEADER, root_token))
|
||||
.send()
|
||||
.await
|
||||
{
|
||||
if !r.status().is_success() {
|
||||
return Ok(false);
|
||||
}
|
||||
let r: Value = r
|
||||
.json()
|
||||
.await
|
||||
.map_err(|e| anyhow!("{:?}", e))
|
||||
.status(StatusCode::BAD_GATEWAY)?;
|
||||
trace!("{}", r.to_string());
|
||||
|
||||
let is_running = r
|
||||
.get("data")
|
||||
.and_then(|v| v.get("tee/"))
|
||||
.and_then(|v| v.get("running_sha256"))
|
||||
.and_then(|v| v.as_str())
|
||||
.and_then(|v| if v.is_empty() { None } else { Some(v) })
|
||||
.and_then(|v| {
|
||||
if v == app.vault_auth_tee_sha {
|
||||
Some(v)
|
||||
} else {
|
||||
None
|
||||
}
|
||||
})
|
||||
.is_some();
|
||||
Ok(is_running)
|
||||
} else {
|
||||
Ok(false)
|
||||
}
|
||||
}
|
||||
|
||||
async fn vault(
|
||||
action: &str,
|
||||
req: ClientRequest,
|
||||
token: &str,
|
||||
json: Value,
|
||||
) -> <SendClientRequest as Future>::Output {
|
||||
info!("{}", action);
|
||||
debug!("json: {:?}", json);
|
||||
match req
|
||||
.insert_header((VAULT_TOKEN_HEADER, token))
|
||||
.send_json(&json)
|
||||
.await
|
||||
{
|
||||
Ok(r) => {
|
||||
debug!("response {:?}", r);
|
||||
Ok(r)
|
||||
}
|
||||
Err(e) => {
|
||||
error!("{}: {}", action, e);
|
||||
Err(e)
|
||||
}
|
||||
}
|
||||
}
|
||||
21
crates/teepot-vault/bin/teepot-read/Cargo.toml
Normal file
21
crates/teepot-vault/bin/teepot-read/Cargo.toml
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
[package]
|
||||
name = "teepot-read"
|
||||
publish = false
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
license.workspace = true
|
||||
repository.workspace = true
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
[dependencies]
|
||||
actix-web.workspace = true
|
||||
anyhow.workspace = true
|
||||
awc.workspace = true
|
||||
clap.workspace = true
|
||||
serde_json.workspace = true
|
||||
teepot-vault.workspace = true
|
||||
tracing.workspace = true
|
||||
tracing-log.workspace = true
|
||||
tracing-subscriber.workspace = true
|
||||
111
crates/teepot-vault/bin/teepot-read/src/main.rs
Normal file
111
crates/teepot-vault/bin/teepot-read/src/main.rs
Normal file
|
|
@ -0,0 +1,111 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! Get the secrets from a Vault TEE and pass them as environment variables to a command
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::Parser;
|
||||
use serde_json::Value;
|
||||
use std::collections::HashMap;
|
||||
use std::os::unix::process::CommandExt;
|
||||
use std::process::Command;
|
||||
use teepot_vault::client::vault::VaultConnection;
|
||||
use teepot_vault::server::attestation::VaultAttestationArgs;
|
||||
use tracing::{debug, info, warn};
|
||||
use tracing_log::LogTracer;
|
||||
use tracing_subscriber::{fmt, prelude::*, EnvFilter, Registry};
|
||||
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
struct Arguments {
|
||||
/// turn on test mode
|
||||
#[arg(long, hide = true)]
|
||||
pub test: bool,
|
||||
/// vault token
|
||||
#[arg(long, env = "VAULT_TOKEN", hide = true)]
|
||||
pub vault_token: String,
|
||||
#[clap(flatten)]
|
||||
pub attestation: VaultAttestationArgs,
|
||||
/// name of this TEE to login to vault
|
||||
#[arg(long, required = true)]
|
||||
pub name: String,
|
||||
/// secrets to get from vault and pass as environment variables
|
||||
#[arg(long, required = true)]
|
||||
pub secrets: Vec<String>,
|
||||
/// command to run
|
||||
pub command: Vec<String>,
|
||||
}
|
||||
|
||||
#[actix_web::main]
|
||||
async fn main() -> Result<()> {
|
||||
LogTracer::init().context("Failed to set logger")?;
|
||||
|
||||
let subscriber = Registry::default()
|
||||
.with(EnvFilter::from_default_env())
|
||||
.with(fmt::layer().with_writer(std::io::stderr));
|
||||
tracing::subscriber::set_global_default(subscriber).unwrap();
|
||||
|
||||
let args = Arguments::parse();
|
||||
|
||||
// Split every string with a ',' into a vector of strings, flatten them and collect them.
|
||||
let secrets = args
|
||||
.secrets
|
||||
.iter()
|
||||
.flat_map(|s| s.split(','))
|
||||
.collect::<Vec<_>>();
|
||||
|
||||
info!("args: {:?}", args);
|
||||
|
||||
let conn = if args.test {
|
||||
warn!("TEST MODE");
|
||||
let client = awc::Client::builder()
|
||||
.add_default_header((actix_web::http::header::USER_AGENT, "teepot/1.0"))
|
||||
.finish();
|
||||
// SAFETY: TEST MODE
|
||||
unsafe {
|
||||
VaultConnection::new_from_client_without_attestation(
|
||||
args.attestation.vault_addr.clone(),
|
||||
client,
|
||||
args.name.clone(),
|
||||
args.vault_token.clone(),
|
||||
)
|
||||
}
|
||||
} else {
|
||||
VaultConnection::new(&args.attestation.clone().into(), args.name.clone())
|
||||
.await
|
||||
.expect("connecting to vault")
|
||||
};
|
||||
|
||||
let mut env: HashMap<String, String> = HashMap::new();
|
||||
|
||||
for secret_name in secrets {
|
||||
debug!("getting secret {secret_name}");
|
||||
let secret_val: serde_json::Value = match conn.load_secret(secret_name).await? {
|
||||
Some(val) => val,
|
||||
None => {
|
||||
debug!("secret {secret_name} not found");
|
||||
continue;
|
||||
}
|
||||
};
|
||||
|
||||
debug!("got secret {secret_name}: {secret_val}");
|
||||
|
||||
// Plain strings can be converted to strings.
|
||||
let env_val = match secret_val {
|
||||
Value::String(s) => s,
|
||||
_ => secret_val.to_string(),
|
||||
};
|
||||
|
||||
env.insert(secret_name.to_string(), env_val);
|
||||
}
|
||||
|
||||
let err = Command::new(&args.command[0])
|
||||
.args(&args.command[1..])
|
||||
.envs(env)
|
||||
.exec();
|
||||
|
||||
Err(err).context("exec failed")
|
||||
}
|
||||
21
crates/teepot-vault/bin/teepot-write/Cargo.toml
Normal file
21
crates/teepot-vault/bin/teepot-write/Cargo.toml
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
[package]
|
||||
name = "teepot-write"
|
||||
publish = false
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
license.workspace = true
|
||||
repository.workspace = true
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
[dependencies]
|
||||
actix-web.workspace = true
|
||||
anyhow.workspace = true
|
||||
awc.workspace = true
|
||||
clap.workspace = true
|
||||
serde_json.workspace = true
|
||||
teepot-vault.workspace = true
|
||||
tracing.workspace = true
|
||||
tracing-log.workspace = true
|
||||
tracing-subscriber.workspace = true
|
||||
96
crates/teepot-vault/bin/teepot-write/src/main.rs
Normal file
96
crates/teepot-vault/bin/teepot-write/src/main.rs
Normal file
|
|
@ -0,0 +1,96 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! Write secrets to a Vault TEE from environment variables
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
use anyhow::{Context, Result};
|
||||
use clap::Parser;
|
||||
use serde_json::Value;
|
||||
use std::{collections::HashMap, env};
|
||||
use teepot_vault::{client::vault::VaultConnection, server::attestation::VaultAttestationArgs};
|
||||
use tracing::{debug, info, warn};
|
||||
use tracing_log::LogTracer;
|
||||
use tracing_subscriber::{fmt, prelude::*, EnvFilter, Registry};
|
||||
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
struct Arguments {
|
||||
/// turn on test mode
|
||||
#[arg(long, hide = true)]
|
||||
pub test: bool,
|
||||
/// vault token
|
||||
#[arg(long, env = "VAULT_TOKEN", hide = true)]
|
||||
pub vault_token: String,
|
||||
#[clap(flatten)]
|
||||
pub attestation: VaultAttestationArgs,
|
||||
/// name of this TEE to login to vault
|
||||
#[arg(long, required = true)]
|
||||
pub name: String,
|
||||
/// name of this TEE to login to vault
|
||||
#[arg(long)]
|
||||
pub store_name: Option<String>,
|
||||
/// secrets to write to vault with the value of the environment variables
|
||||
#[arg(long, required = true)]
|
||||
pub secrets: Vec<String>,
|
||||
}
|
||||
|
||||
#[actix_web::main]
|
||||
async fn main() -> Result<()> {
|
||||
LogTracer::init().context("Failed to set logger")?;
|
||||
|
||||
let subscriber = Registry::default()
|
||||
.with(EnvFilter::from_default_env())
|
||||
.with(fmt::layer().with_writer(std::io::stderr));
|
||||
tracing::subscriber::set_global_default(subscriber).unwrap();
|
||||
|
||||
let args = Arguments::parse();
|
||||
|
||||
// Split every string with a ',' into a vector of strings, flatten them and collect them.
|
||||
let secrets = args
|
||||
.secrets
|
||||
.iter()
|
||||
.flat_map(|s| s.split(','))
|
||||
.collect::<Vec<_>>();
|
||||
|
||||
info!("args: {:?}", args);
|
||||
|
||||
let conn = if args.test {
|
||||
warn!("TEST MODE");
|
||||
let client = awc::Client::builder()
|
||||
.add_default_header((actix_web::http::header::USER_AGENT, "teepot/1.0"))
|
||||
.finish();
|
||||
// SAFETY: TEST MODE
|
||||
unsafe {
|
||||
VaultConnection::new_from_client_without_attestation(
|
||||
args.attestation.vault_addr.clone(),
|
||||
client,
|
||||
args.name.clone(),
|
||||
args.vault_token.clone(),
|
||||
)
|
||||
}
|
||||
} else {
|
||||
VaultConnection::new(&args.attestation.clone().into(), args.name.clone())
|
||||
.await
|
||||
.expect("connecting to vault")
|
||||
};
|
||||
|
||||
let tee_name = args.store_name.unwrap_or(args.name.clone());
|
||||
|
||||
let env = env::vars()
|
||||
.filter(|(k, _)| secrets.contains(&k.as_str()))
|
||||
.collect::<HashMap<_, _>>();
|
||||
|
||||
for (secret_name, secret_val) in env {
|
||||
debug!("storing secret {secret_name}: {secret_val}");
|
||||
let secret_val = Value::String(secret_val);
|
||||
conn.store_secret_for_tee(&tee_name, &secret_val, &secret_name)
|
||||
.await
|
||||
.expect("storing secret");
|
||||
info!("stored secret {secret_name}");
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
20
crates/teepot-vault/bin/vault-admin/Cargo.toml
Normal file
20
crates/teepot-vault/bin/vault-admin/Cargo.toml
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
[package]
|
||||
name = "vault-admin"
|
||||
publish = false
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
license.workspace = true
|
||||
repository.workspace = true
|
||||
|
||||
[dependencies]
|
||||
actix-web.workspace = true
|
||||
anyhow.workspace = true
|
||||
bytemuck.workspace = true
|
||||
clap.workspace = true
|
||||
hex.workspace = true
|
||||
pgp.workspace = true
|
||||
serde_json.workspace = true
|
||||
teepot.workspace = true
|
||||
teepot-vault.workspace = true
|
||||
tracing.workspace = true
|
||||
46
crates/teepot-vault/bin/vault-admin/README.md
Normal file
46
crates/teepot-vault/bin/vault-admin/README.md
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
```bash
|
||||
❯ idents=( tests/data/pub*.asc )
|
||||
❯ cargo run --bin vault-admin -p vault-admin -- \
|
||||
verify \
|
||||
${idents[@]/#/-i } \
|
||||
tests/data/test.json \
|
||||
tests/data/test.json.asc
|
||||
|
||||
Verified signature for `81A312C59D679D930FA9E8B06D728F29A2DBABF8`
|
||||
|
||||
❯ RUST_LOG=info cargo run -p vault-admin -- \
|
||||
command \
|
||||
--sgx-mrsigner c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d \
|
||||
--sgx-allowed-tcb-levels SwHardeningNeeded \
|
||||
--server https://127.0.0.1:8444 \
|
||||
crates/teepot-vault/tests/data/test.json \
|
||||
crates/teepot-vault/tests/data/test.json.asc
|
||||
|
||||
2023-08-04T10:51:14.919941Z INFO vault_admin: Quote verified! Connection secure!
|
||||
2023-08-04T10:51:14.920430Z INFO tee_client: Getting attestation report
|
||||
2023-08-04T10:51:15.020459Z INFO tee_client: Checked or set server certificate public key hash `f6dc06b9f2a14fa16a94c076a85eab8513f99ec0091801cc62c8761e42908fc1`
|
||||
2023-08-04T10:51:15.024310Z INFO tee_client: Verifying attestation report
|
||||
2023-08-04T10:51:15.052712Z INFO tee_client: TcbLevel is allowed: SwHardeningNeeded: Software hardening is needed
|
||||
2023-08-04T10:51:15.054508Z WARN tee_client: Info: Advisory ID: INTEL-SA-00615
|
||||
2023-08-04T10:51:15.054572Z INFO tee_client: Report data matches `f6dc06b9f2a14fa16a94c076a85eab8513f99ec0091801cc62c8761e42908fc1`
|
||||
2023-08-04T10:51:15.054602Z INFO tee_client: mrsigner `c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d` matches
|
||||
[
|
||||
{
|
||||
"request": {
|
||||
"data": {
|
||||
"lease": "1000",
|
||||
"name": "test",
|
||||
"sgx_allowed_tcb_levels": "Ok,SwHardeningNeeded",
|
||||
"sgx_mrsigner": "c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d",
|
||||
"token_policies": "test",
|
||||
"types": "sgx"
|
||||
},
|
||||
"url": "/v1/auth/tee/tees/test"
|
||||
},
|
||||
"response": {
|
||||
"status_code": 204,
|
||||
"value": null
|
||||
}
|
||||
}
|
||||
]
|
||||
```
|
||||
371
crates/teepot-vault/bin/vault-admin/src/main.rs
Normal file
371
crates/teepot-vault/bin/vault-admin/src/main.rs
Normal file
|
|
@ -0,0 +1,371 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
use anyhow::{anyhow, bail, Context, Result};
|
||||
use clap::{Args, Parser, Subcommand};
|
||||
use pgp::{types::PublicKeyTrait, Deserializable, SignedPublicKey};
|
||||
use serde_json::Value;
|
||||
use std::{
|
||||
default::Default,
|
||||
fs::{File, OpenOptions},
|
||||
io::{Read, Write},
|
||||
path::{Path, PathBuf},
|
||||
};
|
||||
use teepot::{
|
||||
log::{setup_logging, LogLevelParser},
|
||||
sgx::sign::Signature,
|
||||
};
|
||||
use teepot_vault::{
|
||||
client::{AttestationArgs, TeeConnection},
|
||||
json::http::{
|
||||
SignRequest, SignRequestData, SignResponse, VaultCommandRequest, VaultCommands,
|
||||
VaultCommandsResponse, DIGEST_URL,
|
||||
},
|
||||
server::signatures::verify_sig,
|
||||
};
|
||||
use tracing::{error, level_filters::LevelFilter};
|
||||
|
||||
#[derive(Args, Debug)]
|
||||
struct SendArgs {
|
||||
#[clap(flatten)]
|
||||
pub attestation: AttestationArgs,
|
||||
/// Vault command file
|
||||
#[arg(required = true)]
|
||||
pub command_file: PathBuf,
|
||||
/// GPG signature files
|
||||
#[arg(required = true)]
|
||||
pub sigs: Vec<PathBuf>,
|
||||
}
|
||||
|
||||
#[derive(Args, Debug)]
|
||||
struct SignTeeArgs {
|
||||
#[clap(flatten)]
|
||||
pub attestation: AttestationArgs,
|
||||
/// output file
|
||||
#[arg(short, long, required = true)]
|
||||
pub out: PathBuf,
|
||||
/// signature request file
|
||||
#[arg(required = true)]
|
||||
pub sig_request_file: PathBuf,
|
||||
/// GPG signature files
|
||||
#[arg(required = true)]
|
||||
pub sigs: Vec<PathBuf>,
|
||||
}
|
||||
|
||||
#[derive(Args, Debug)]
|
||||
struct DigestArgs {
|
||||
#[clap(flatten)]
|
||||
pub attestation: AttestationArgs,
|
||||
}
|
||||
|
||||
#[derive(Args, Debug)]
|
||||
struct VerifyArgs {
|
||||
/// GPG identity files
|
||||
#[arg(short, long, required = true)]
|
||||
pub idents: Vec<PathBuf>,
|
||||
/// Vault command file
|
||||
#[arg(required = true)]
|
||||
pub command_file: PathBuf,
|
||||
/// GPG signature files
|
||||
#[arg(required = true)]
|
||||
pub sigs: Vec<PathBuf>,
|
||||
}
|
||||
|
||||
#[derive(Args, Debug)]
|
||||
struct CreateSignRequestArgs {
|
||||
/// Last digest
|
||||
#[arg(long)]
|
||||
pub last_digest: Option<String>,
|
||||
/// TEE name
|
||||
#[arg(long)]
|
||||
pub tee_name: Option<String>,
|
||||
/// Vault command file
|
||||
#[arg(required = true)]
|
||||
pub sig_file: PathBuf,
|
||||
}
|
||||
|
||||
#[derive(Subcommand, Debug)]
|
||||
enum SubCommands {
|
||||
/// Send the signed commands to execute to the vault
|
||||
Command(SendArgs),
|
||||
/// Verify the signature(s) for the commands to send
|
||||
Verify(VerifyArgs),
|
||||
/// Get the digest of the last executed commands
|
||||
Digest(DigestArgs),
|
||||
/// Send the signed commands to execute to the vault
|
||||
SignTee(SignTeeArgs),
|
||||
/// Create a sign request
|
||||
CreateSignRequest(CreateSignRequestArgs),
|
||||
}
|
||||
|
||||
/// Admin tool for the vault
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
struct Arguments {
|
||||
#[clap(subcommand)]
|
||||
cmd: SubCommands,
|
||||
/// Log level for the log output.
|
||||
/// Valid values are: `off`, `error`, `warn`, `info`, `debug`, `trace`
|
||||
#[clap(long, default_value_t = LevelFilter::WARN, value_parser = LogLevelParser)]
|
||||
pub log_level: LevelFilter,
|
||||
}
|
||||
|
||||
#[actix_web::main]
|
||||
async fn main() -> Result<()> {
|
||||
let args = Arguments::parse();
|
||||
|
||||
tracing::subscriber::set_global_default(setup_logging(
|
||||
env!("CARGO_CRATE_NAME"),
|
||||
&args.log_level,
|
||||
)?)?;
|
||||
|
||||
match args.cmd {
|
||||
SubCommands::Command(args) => send_commands(args).await?,
|
||||
SubCommands::SignTee(args) => send_sig_request(args).await?,
|
||||
SubCommands::Verify(args) => {
|
||||
verify(args.command_file, args.idents.iter(), args.sigs.iter())?
|
||||
}
|
||||
SubCommands::Digest(args) => digest(args).await?,
|
||||
SubCommands::CreateSignRequest(args) => create_sign_request(args)?,
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn create_sign_request(args: CreateSignRequestArgs) -> Result<()> {
|
||||
let mut sigstruct_file = File::open(&args.sig_file)?;
|
||||
let mut sigstruct_bytes = Vec::new();
|
||||
sigstruct_file.read_to_end(&mut sigstruct_bytes)?;
|
||||
|
||||
let sigstruct = bytemuck::try_from_bytes::<Signature>(&sigstruct_bytes)
|
||||
.context(format!("parsing signature file {:?}", &args.sig_file))?;
|
||||
|
||||
let body = sigstruct.body();
|
||||
let data = bytemuck::bytes_of(&body).to_vec();
|
||||
|
||||
let sign_request_data = SignRequestData {
|
||||
data,
|
||||
last_digest: args.last_digest.unwrap_or_default(),
|
||||
tee_name: args.tee_name.unwrap_or_default(),
|
||||
tee_type: "sgx".to_string(),
|
||||
..Default::default()
|
||||
};
|
||||
|
||||
println!("{}", serde_json::to_string_pretty(&sign_request_data)?);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn verify(
|
||||
msg: impl AsRef<Path>,
|
||||
idents_file_paths: impl Iterator<Item = impl AsRef<Path>>,
|
||||
sig_paths: impl Iterator<Item = impl AsRef<Path>>,
|
||||
) -> Result<()> {
|
||||
let mut cmd_file = File::open(msg.as_ref())?;
|
||||
let mut cmd_buf = Vec::new();
|
||||
cmd_file
|
||||
.read_to_end(&mut cmd_buf)
|
||||
.context(format!("reading command file {:?}", &cmd_file))?;
|
||||
|
||||
let mut idents = Vec::new();
|
||||
for ident_file_path in idents_file_paths {
|
||||
let ident_file = File::open(ident_file_path.as_ref()).context(format!(
|
||||
"reading identity file {:?}",
|
||||
ident_file_path.as_ref()
|
||||
))?;
|
||||
idents.push(
|
||||
SignedPublicKey::from_armor_single(ident_file)
|
||||
.context(format!(
|
||||
"reading identity file {:?}",
|
||||
ident_file_path.as_ref()
|
||||
))?
|
||||
.0,
|
||||
);
|
||||
}
|
||||
|
||||
for sig_path in sig_paths {
|
||||
let mut sig_file = File::open(&sig_path)
|
||||
.context(format!("reading signature file {:?}", sig_path.as_ref()))?;
|
||||
let mut sig = String::new();
|
||||
sig_file
|
||||
.read_to_string(&mut sig)
|
||||
.context(format!("reading signature file {:?}", sig_path.as_ref()))?;
|
||||
let ident_pos = verify_sig(&sig, &cmd_buf, &idents)?;
|
||||
println!(
|
||||
"Verified signature for `{}`",
|
||||
hex::encode_upper(idents.get(ident_pos).unwrap().fingerprint().as_bytes())
|
||||
);
|
||||
// Remove the identity from the list of identities to verify
|
||||
idents.remove(ident_pos);
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn send_commands(args: SendArgs) -> Result<()> {
|
||||
// Read the command file into a string
|
||||
let mut cmd_file = File::open(&args.command_file)?;
|
||||
let mut commands = String::new();
|
||||
cmd_file.read_to_string(&mut commands)?;
|
||||
|
||||
// Check that the command file is valid JSON
|
||||
let vault_commands: VaultCommands = serde_json::from_str(&commands)
|
||||
.context(format!("parsing command file {:?}", &args.command_file))?;
|
||||
|
||||
let mut signatures = Vec::new();
|
||||
|
||||
for sig in args.sigs {
|
||||
let mut sig_file = File::open(sig)?;
|
||||
let mut sig = String::new();
|
||||
sig_file.read_to_string(&mut sig)?;
|
||||
signatures.push(sig);
|
||||
}
|
||||
|
||||
let send_req = VaultCommandRequest {
|
||||
commands,
|
||||
signatures,
|
||||
};
|
||||
|
||||
let conn = TeeConnection::new(&args.attestation);
|
||||
|
||||
let mut response = conn
|
||||
.client()
|
||||
.post(&format!(
|
||||
"{server}{url}",
|
||||
server = conn.server(),
|
||||
url = VaultCommandRequest::URL
|
||||
))
|
||||
.send_json(&send_req)
|
||||
.await
|
||||
.map_err(|e| anyhow!("sending command request: {}", e))?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("sending command request: {}", status_code);
|
||||
if let Ok(r) = response.json::<Value>().await {
|
||||
eprintln!(
|
||||
"Error sending command request: {}",
|
||||
serde_json::to_string(&r).unwrap_or_default()
|
||||
);
|
||||
}
|
||||
bail!("sending command request: {}", status_code);
|
||||
}
|
||||
|
||||
let cmd_responses: VaultCommandsResponse = response
|
||||
.json()
|
||||
.await
|
||||
.context("failed parsing command response")?;
|
||||
|
||||
println!("digest: {}", &cmd_responses.digest);
|
||||
|
||||
let pairs = cmd_responses
|
||||
.results
|
||||
.iter()
|
||||
.zip(vault_commands.commands.iter())
|
||||
.map(|(resp, cmd)| {
|
||||
let mut pair = serde_json::Map::new();
|
||||
pair.insert("request".to_string(), serde_json::to_value(cmd).unwrap());
|
||||
pair.insert("response".to_string(), serde_json::to_value(resp).unwrap());
|
||||
pair
|
||||
})
|
||||
.collect::<Vec<_>>();
|
||||
|
||||
println!("{}", serde_json::to_string_pretty(&pairs)?);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn send_sig_request(args: SignTeeArgs) -> Result<()> {
|
||||
// Read the command file into a string
|
||||
let mut cmd_file = File::open(&args.sig_request_file)?;
|
||||
let mut sign_request_data_str = String::new();
|
||||
cmd_file.read_to_string(&mut sign_request_data_str)?;
|
||||
|
||||
// Check that the command file is valid JSON
|
||||
let _sign_request_data: SignRequestData = serde_json::from_str(&sign_request_data_str)
|
||||
.context(format!("parsing command file {:?}", &args.sig_request_file))?;
|
||||
|
||||
let mut signatures = Vec::new();
|
||||
|
||||
for sig in args.sigs {
|
||||
let mut sig_file = File::open(sig)?;
|
||||
let mut sig = String::new();
|
||||
sig_file.read_to_string(&mut sig)?;
|
||||
signatures.push(sig);
|
||||
}
|
||||
|
||||
// open out_file early to fail fast if it is not writable
|
||||
let mut out_file = OpenOptions::new()
|
||||
.create(true)
|
||||
.truncate(true)
|
||||
.write(true)
|
||||
.open(&args.out)?;
|
||||
|
||||
let send_req = SignRequest {
|
||||
sign_request_data: sign_request_data_str,
|
||||
signatures,
|
||||
};
|
||||
|
||||
let conn = TeeConnection::new(&args.attestation);
|
||||
|
||||
let mut response = conn
|
||||
.client()
|
||||
.post(&format!(
|
||||
"{server}{url}",
|
||||
server = conn.server(),
|
||||
url = SignRequest::URL
|
||||
))
|
||||
.send_json(&send_req)
|
||||
.await
|
||||
.map_err(|e| anyhow!("sending sign request: {}", e))?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("sending sign request: {}", status_code);
|
||||
if let Ok(r) = response.json::<Value>().await {
|
||||
eprintln!(
|
||||
"Error sending sign request: {}",
|
||||
serde_json::to_string(&r).unwrap_or_default()
|
||||
);
|
||||
}
|
||||
bail!("sending sign request: {}", status_code);
|
||||
}
|
||||
|
||||
let sign_response: SignResponse = response
|
||||
.json()
|
||||
.await
|
||||
.context("failed parsing sign response")?;
|
||||
|
||||
println!("digest: {}", &sign_response.digest);
|
||||
|
||||
out_file.write_all(&sign_response.signed_data)?;
|
||||
|
||||
println!("{{ \"digest\": \"{}\" }}", sign_response.digest);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn digest(args: DigestArgs) -> Result<()> {
|
||||
let conn = TeeConnection::new(&args.attestation);
|
||||
|
||||
let mut response = conn
|
||||
.client()
|
||||
.get(&format!("{server}{DIGEST_URL}", server = conn.server()))
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| anyhow!("sending digest request: {}", e))?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("sending digest request: {}", status_code);
|
||||
if let Ok(r) = response.json::<Value>().await {
|
||||
eprintln!("Error sending digest request: {}", r);
|
||||
}
|
||||
bail!("sending digest request: {}", status_code);
|
||||
}
|
||||
|
||||
let digest_response: Value = response
|
||||
.json()
|
||||
.await
|
||||
.context("failed parsing digest response")?;
|
||||
|
||||
println!("{}", serde_json::to_string_pretty(&digest_response)?);
|
||||
Ok(())
|
||||
}
|
||||
19
crates/teepot-vault/bin/vault-unseal/Cargo.toml
Normal file
19
crates/teepot-vault/bin/vault-unseal/Cargo.toml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
[package]
|
||||
name = "vault-unseal"
|
||||
publish = false
|
||||
version.workspace = true
|
||||
edition.workspace = true
|
||||
authors.workspace = true
|
||||
license.workspace = true
|
||||
repository.workspace = true
|
||||
|
||||
[dependencies]
|
||||
actix-web.workspace = true
|
||||
anyhow.workspace = true
|
||||
base64.workspace = true
|
||||
clap.workspace = true
|
||||
serde_json.workspace = true
|
||||
teepot-vault.workspace = true
|
||||
tracing.workspace = true
|
||||
tracing-log.workspace = true
|
||||
tracing-subscriber.workspace = true
|
||||
220
crates/teepot-vault/bin/vault-unseal/src/main.rs
Normal file
220
crates/teepot-vault/bin/vault-unseal/src/main.rs
Normal file
|
|
@ -0,0 +1,220 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
use anyhow::{anyhow, bail, Context, Result};
|
||||
use base64::{engine::general_purpose, Engine as _};
|
||||
use clap::{Args, Parser, Subcommand};
|
||||
use serde_json::Value;
|
||||
use std::{fs::File, io::Read};
|
||||
use teepot_vault::{
|
||||
client::{AttestationArgs, TeeConnection},
|
||||
json::http::{Init, InitResponse, Unseal},
|
||||
};
|
||||
use tracing::{error, info, trace, warn};
|
||||
use tracing_log::LogTracer;
|
||||
use tracing_subscriber::{fmt, prelude::*, EnvFilter, Registry};
|
||||
|
||||
#[derive(Args, Debug)]
|
||||
pub struct InitArgs {
|
||||
/// admin threshold
|
||||
#[arg(long)]
|
||||
admin_threshold: usize,
|
||||
/// PGP keys to sign commands for the admin tee
|
||||
#[arg(short, long)]
|
||||
admin_pgp_key_file: Vec<String>,
|
||||
/// admin TEE mrenclave
|
||||
#[arg(long)]
|
||||
admin_tee_mrenclave: String,
|
||||
/// secret threshold
|
||||
#[arg(long)]
|
||||
unseal_threshold: usize,
|
||||
/// PGP keys to encrypt the unseal keys with
|
||||
#[arg(short, long)]
|
||||
unseal_pgp_key_file: Vec<String>,
|
||||
}
|
||||
|
||||
/// subcommands and their options/arguments.
|
||||
#[derive(Subcommand, Debug)]
|
||||
enum SubCommands {
|
||||
Init(InitArgs),
|
||||
Unseal,
|
||||
}
|
||||
|
||||
#[derive(Parser, Debug)]
|
||||
#[command(author, version, about, long_about = None)]
|
||||
struct Arguments {
|
||||
#[clap(flatten)]
|
||||
pub attestation: AttestationArgs,
|
||||
/// Subcommands (with their own options)
|
||||
#[clap(subcommand)]
|
||||
cmd: SubCommands,
|
||||
}
|
||||
|
||||
#[actix_web::main]
|
||||
async fn main() -> Result<()> {
|
||||
LogTracer::init().context("Failed to set logger")?;
|
||||
|
||||
let subscriber = Registry::default()
|
||||
.with(EnvFilter::from_default_env())
|
||||
.with(fmt::layer().with_writer(std::io::stderr));
|
||||
tracing::subscriber::set_global_default(subscriber).unwrap();
|
||||
|
||||
let args = Arguments::parse();
|
||||
|
||||
match args.cmd {
|
||||
SubCommands::Init(_) => init(args).await?,
|
||||
SubCommands::Unseal => unseal(args).await?,
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn init(args: Arguments) -> Result<()> {
|
||||
let conn = TeeConnection::new(&args.attestation);
|
||||
|
||||
info!("Quote verified! Connection secure!");
|
||||
|
||||
let SubCommands::Init(init_args) = args.cmd else {
|
||||
unreachable!()
|
||||
};
|
||||
|
||||
if init_args.admin_threshold == 0 {
|
||||
bail!("admin threshold must be greater than 0");
|
||||
}
|
||||
|
||||
if init_args.unseal_threshold == 0 {
|
||||
bail!("unseal threshold must be greater than 0");
|
||||
}
|
||||
|
||||
if init_args.admin_threshold > init_args.admin_pgp_key_file.len() {
|
||||
bail!("admin threshold must be less than or equal to the number of admin pgp keys");
|
||||
}
|
||||
|
||||
if init_args.unseal_threshold > init_args.unseal_pgp_key_file.len() {
|
||||
bail!("unseal threshold must be less than or equal to the number of unseal pgp keys");
|
||||
}
|
||||
|
||||
let mut pgp_keys = Vec::new();
|
||||
|
||||
for filename in init_args.unseal_pgp_key_file {
|
||||
let mut file =
|
||||
File::open(&filename).context(format!("Failed to open pgp key file {}", &filename))?;
|
||||
let mut buf = Vec::new();
|
||||
file.read_to_end(&mut buf)?;
|
||||
let key = std::str::from_utf8(&buf)?.trim().to_string();
|
||||
pgp_keys.push(key);
|
||||
}
|
||||
|
||||
let mut admin_pgp_keys = Vec::new();
|
||||
|
||||
for filename in init_args.admin_pgp_key_file {
|
||||
let mut file =
|
||||
File::open(&filename).context(format!("Failed to open pgp key file {}", &filename))?;
|
||||
// read all lines from file and concatenate them
|
||||
let mut key = String::new();
|
||||
file.read_to_string(&mut key)
|
||||
.context(format!("Failed to read pgp key file {}", &filename))?;
|
||||
key.retain(|c| !c.is_ascii_whitespace());
|
||||
|
||||
let bytes = general_purpose::STANDARD.decode(key).context(format!(
|
||||
"Failed to base64 decode pgp key file {}",
|
||||
&filename
|
||||
))?;
|
||||
admin_pgp_keys.push(bytes.into_boxed_slice());
|
||||
}
|
||||
|
||||
let init = Init {
|
||||
secret_shares: pgp_keys.len() as _,
|
||||
secret_threshold: init_args.unseal_threshold,
|
||||
admin_threshold: init_args.admin_threshold,
|
||||
admin_tee_mrenclave: init_args.admin_tee_mrenclave,
|
||||
admin_pgp_keys: admin_pgp_keys.into_boxed_slice(),
|
||||
pgp_keys,
|
||||
};
|
||||
|
||||
info!("Initializing vault");
|
||||
|
||||
let mut response = conn
|
||||
.client()
|
||||
.post(&format!(
|
||||
"{server}{url}",
|
||||
server = conn.server(),
|
||||
url = Init::URL
|
||||
))
|
||||
.send_json(&init)
|
||||
.await
|
||||
.map_err(|e| anyhow!("Error sending init request: {}", e))?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("Failed to init vault: {}", status_code);
|
||||
if let Ok(r) = response.json::<Value>().await {
|
||||
eprintln!("Failed to init vault: {}", r);
|
||||
}
|
||||
bail!("failed to init vault: {}", status_code);
|
||||
}
|
||||
|
||||
let init_response: Value = response.json().await.context("failed to init vault")?;
|
||||
|
||||
info!("Got Response: {}", init_response.to_string());
|
||||
|
||||
let resp: InitResponse =
|
||||
serde_json::from_value(init_response).context("Failed to parse init response")?;
|
||||
println!("{}", serde_json::to_string(&resp).unwrap());
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn unseal(args: Arguments) -> Result<()> {
|
||||
info!("Reading unencrypted key from stdin");
|
||||
|
||||
// read all bytes from stdin
|
||||
let mut stdin = std::io::stdin();
|
||||
let mut buf = Vec::new();
|
||||
stdin.read_to_end(&mut buf)?;
|
||||
let key = std::str::from_utf8(&buf)?.trim().to_string();
|
||||
|
||||
if key.is_empty() {
|
||||
bail!("Error reading key from stdin");
|
||||
}
|
||||
|
||||
let conn = TeeConnection::new(&args.attestation);
|
||||
|
||||
info!("Quote verified! Connection secure!");
|
||||
|
||||
info!("Unsealing vault");
|
||||
|
||||
let unseal_data = Unseal { key };
|
||||
|
||||
let mut response = conn
|
||||
.client()
|
||||
.post(&format!(
|
||||
"{server}{url}",
|
||||
server = conn.server(),
|
||||
url = Unseal::URL
|
||||
))
|
||||
.send_json(&unseal_data)
|
||||
.await
|
||||
.map_err(|e| anyhow!("Error sending unseal request: {}", e))?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("Failed to unseal vault: {}", status_code);
|
||||
if let Ok(r) = response.json::<Value>().await {
|
||||
eprintln!("Failed to unseal vault: {}", r);
|
||||
}
|
||||
bail!("failed to unseal vault: {}", status_code);
|
||||
}
|
||||
|
||||
let unseal_response: Value = response.json().await.context("failed to unseal vault")?;
|
||||
|
||||
trace!("Got Response: {}", unseal_response.to_string());
|
||||
|
||||
if matches!(unseal_response["sealed"].as_bool(), Some(true)) {
|
||||
warn!("Vault is still sealed!");
|
||||
println!("Vault is still sealed!");
|
||||
} else {
|
||||
info!("Vault is unsealed!");
|
||||
println!("Vault is unsealed!");
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
309
crates/teepot-vault/src/client/mod.rs
Normal file
309
crates/teepot-vault/src/client/mod.rs
Normal file
|
|
@ -0,0 +1,309 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2024 Matter Labs
|
||||
|
||||
//! Helper functions for CLI clients to verify Intel SGX enclaves and other TEEs.
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
pub mod vault;
|
||||
|
||||
use crate::server::pki::{RaTlsCollateralExtension, RaTlsQuoteExtension};
|
||||
use actix_web::http::header;
|
||||
use anyhow::Result;
|
||||
use awc::{Client, Connector};
|
||||
use clap::Args;
|
||||
use const_oid::AssociatedOid;
|
||||
use intel_tee_quote_verification_rs::Collateral;
|
||||
use rustls::{
|
||||
client::{
|
||||
danger::{HandshakeSignatureValid, ServerCertVerifier},
|
||||
WebPkiServerVerifier,
|
||||
},
|
||||
pki_types::{CertificateDer, ServerName, UnixTime},
|
||||
ClientConfig, DigitallySignedStruct, Error, SignatureScheme,
|
||||
};
|
||||
use sha2::{Digest, Sha256};
|
||||
use std::{sync::Arc, time, time::Duration};
|
||||
use teepot::{quote::Report, sgx::Quote};
|
||||
pub use teepot::{
|
||||
quote::{verify_quote_with_collateral, QuoteVerificationResult},
|
||||
sgx::{parse_tcb_levels, sgx_ql_qv_result_t, EnumSet, TcbLevel},
|
||||
};
|
||||
use tracing::{debug, error, info, trace, warn};
|
||||
use x509_cert::{
|
||||
der::{Decode as _, Encode as _},
|
||||
Certificate,
|
||||
};
|
||||
|
||||
/// Options and arguments needed to attest a TEE
|
||||
#[derive(Args, Debug, Clone)]
|
||||
pub struct AttestationArgs {
|
||||
/// hex encoded SGX mrsigner of the enclave to attest
|
||||
#[arg(long)]
|
||||
pub sgx_mrsigner: Option<String>,
|
||||
/// hex encoded SGX mrenclave of the enclave to attest
|
||||
#[arg(long)]
|
||||
pub sgx_mrenclave: Option<String>,
|
||||
/// URL of the server
|
||||
#[arg(long, required = true)]
|
||||
pub server: String,
|
||||
/// allowed TCB levels, comma separated:
|
||||
/// Ok, ConfigNeeded, ConfigAndSwHardeningNeeded, SwHardeningNeeded, OutOfDate, OutOfDateConfigNeeded
|
||||
#[arg(long, value_parser = parse_tcb_levels)]
|
||||
pub sgx_allowed_tcb_levels: Option<EnumSet<TcbLevel>>,
|
||||
}
|
||||
|
||||
/// A connection to a TEE, which implements the `teepot` attestation API
|
||||
pub struct TeeConnection {
|
||||
/// Options and arguments needed to attest a TEE
|
||||
server: String,
|
||||
client: Client,
|
||||
}
|
||||
|
||||
impl TeeConnection {
|
||||
/// Create a new connection to a TEE
|
||||
///
|
||||
/// This will verify the attestation report and check that the enclave
|
||||
/// is running the expected code.
|
||||
pub fn new(args: &AttestationArgs) -> Self {
|
||||
let _ = rustls::crypto::ring::default_provider().install_default();
|
||||
|
||||
let tls_config = Arc::new(
|
||||
ClientConfig::builder()
|
||||
.dangerous()
|
||||
.with_custom_certificate_verifier(Arc::new(Self::make_verifier(args.clone())))
|
||||
.with_no_client_auth(),
|
||||
);
|
||||
|
||||
let agent = Client::builder()
|
||||
.add_default_header((header::USER_AGENT, "teepot/1.0"))
|
||||
// a "connector" wraps the stream into an encrypted connection
|
||||
.connector(Connector::new().rustls_0_23(tls_config))
|
||||
.timeout(Duration::from_secs(12000))
|
||||
.finish();
|
||||
|
||||
Self {
|
||||
server: args.server.clone(),
|
||||
client: agent,
|
||||
}
|
||||
}
|
||||
|
||||
/// Create a new connection to a TEE
|
||||
///
|
||||
/// # Safety
|
||||
/// This function is unsafe, because it does not verify the attestation report.
|
||||
pub unsafe fn new_from_client_without_attestation(server: String, client: Client) -> Self {
|
||||
Self { server, client }
|
||||
}
|
||||
|
||||
/// Get a reference to the agent, which can be used to make requests to the TEE
|
||||
///
|
||||
/// Note, that it will refuse to connect to any other TLS server than the one
|
||||
/// specified in the `AttestationArgs` of the `Self::new` function.
|
||||
pub fn client(&self) -> &Client {
|
||||
&self.client
|
||||
}
|
||||
|
||||
/// Get a reference to the server URL
|
||||
pub fn server(&self) -> &str {
|
||||
&self.server
|
||||
}
|
||||
|
||||
/// Save the hash of the public server key to `REPORT_DATA` to check
|
||||
/// the attestations against it and it does not change on reconnect.
|
||||
pub fn make_verifier(args: AttestationArgs) -> impl ServerCertVerifier {
|
||||
#[derive(Debug)]
|
||||
struct V {
|
||||
args: AttestationArgs,
|
||||
server_verifier: Arc<WebPkiServerVerifier>,
|
||||
}
|
||||
impl ServerCertVerifier for V {
|
||||
fn verify_server_cert(
|
||||
&self,
|
||||
end_entity: &CertificateDer,
|
||||
_intermediates: &[CertificateDer],
|
||||
_server_name: &ServerName,
|
||||
_ocsp_response: &[u8],
|
||||
_now: UnixTime,
|
||||
) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
|
||||
let cert = Certificate::from_der(end_entity.as_ref())
|
||||
.map_err(|e| Error::General(format!("Failed get certificate {e:?}")))?;
|
||||
let pub_key = cert
|
||||
.tbs_certificate
|
||||
.subject_public_key_info
|
||||
.to_der()
|
||||
.unwrap();
|
||||
|
||||
let hash = Sha256::digest(pub_key);
|
||||
|
||||
let exts = cert
|
||||
.tbs_certificate
|
||||
.extensions
|
||||
.ok_or_else(|| Error::General("Failed get quote in certificate".into()))?;
|
||||
|
||||
trace!("Get quote bytes!");
|
||||
|
||||
let quote_bytes = exts
|
||||
.iter()
|
||||
.find(|ext| ext.extn_id == RaTlsQuoteExtension::OID)
|
||||
.ok_or_else(|| Error::General("Failed get quote in certificate".into()))?
|
||||
.extn_value
|
||||
.as_bytes();
|
||||
|
||||
trace!("Get collateral bytes!");
|
||||
|
||||
let collateral = exts
|
||||
.iter()
|
||||
.find(|ext| ext.extn_id == RaTlsCollateralExtension::OID)
|
||||
.and_then(|ext| {
|
||||
serde_json::from_slice::<Collateral>(ext.extn_value.as_bytes())
|
||||
.map_err(|e| {
|
||||
debug!("Failed to get collateral in certificate {e:?}");
|
||||
trace!(
|
||||
"Failed to get collateral in certificate {:?}",
|
||||
String::from_utf8_lossy(ext.extn_value.as_bytes())
|
||||
);
|
||||
})
|
||||
.ok()
|
||||
});
|
||||
|
||||
if collateral.is_none() {
|
||||
debug!("Failed to get collateral in certificate");
|
||||
}
|
||||
|
||||
let quote = Quote::try_from_bytes(quote_bytes).map_err(|e| {
|
||||
Error::General(format!("Failed get quote in certificate {e:?}"))
|
||||
})?;
|
||||
|
||||
if "e.report_body.reportdata[..32] != hash.as_slice() {
|
||||
error!("Report data mismatch");
|
||||
return Err(Error::General("Report data mismatch".to_string()));
|
||||
} else {
|
||||
info!(
|
||||
"Report data matches `{}`",
|
||||
hex::encode("e.report_body.reportdata[..32])
|
||||
);
|
||||
}
|
||||
|
||||
let current_time: i64 = time::SystemTime::now()
|
||||
.duration_since(time::UNIX_EPOCH)
|
||||
.unwrap()
|
||||
.as_secs() as _;
|
||||
|
||||
let QuoteVerificationResult {
|
||||
collateral_expired,
|
||||
result,
|
||||
quote,
|
||||
advisories,
|
||||
earliest_expiration_date,
|
||||
..
|
||||
} = verify_quote_with_collateral(quote_bytes, collateral.as_ref(), current_time)
|
||||
.unwrap();
|
||||
|
||||
let Report::SgxEnclave(report_body) = quote.report else {
|
||||
return Err(Error::General("TDX quote and not SGX quote".into()));
|
||||
};
|
||||
|
||||
if collateral_expired || result != sgx_ql_qv_result_t::SGX_QL_QV_RESULT_OK {
|
||||
if collateral_expired {
|
||||
error!(
|
||||
"Collateral is out of date! Expired {}",
|
||||
earliest_expiration_date
|
||||
);
|
||||
return Err(Error::General(format!(
|
||||
"Collateral is out of date! Expired {}",
|
||||
earliest_expiration_date
|
||||
)));
|
||||
}
|
||||
|
||||
let tcblevel = TcbLevel::from(result);
|
||||
if self
|
||||
.args
|
||||
.sgx_allowed_tcb_levels
|
||||
.map_or(true, |levels| !levels.contains(tcblevel))
|
||||
{
|
||||
error!("Quote verification result: {}", tcblevel);
|
||||
return Err(Error::General(format!(
|
||||
"Quote verification result: {}",
|
||||
tcblevel
|
||||
)));
|
||||
}
|
||||
|
||||
info!("TcbLevel is allowed: {}", tcblevel);
|
||||
}
|
||||
|
||||
for advisory in advisories {
|
||||
warn!("Info: Advisory ID: {advisory}");
|
||||
}
|
||||
|
||||
if let Some(mrsigner) = &self.args.sgx_mrsigner {
|
||||
let mrsigner_bytes = hex::decode(mrsigner)
|
||||
.map_err(|e| Error::General(format!("Failed to decode mrsigner: {}", e)))?;
|
||||
if report_body.mr_signer[..] != mrsigner_bytes {
|
||||
return Err(Error::General(format!(
|
||||
"mrsigner mismatch: got {}, expected {}",
|
||||
hex::encode(report_body.mr_signer),
|
||||
&mrsigner
|
||||
)));
|
||||
} else {
|
||||
info!("mrsigner `{mrsigner}` matches");
|
||||
}
|
||||
}
|
||||
|
||||
if let Some(mrenclave) = &self.args.sgx_mrenclave {
|
||||
let mrenclave_bytes = hex::decode(mrenclave).map_err(|e| {
|
||||
Error::General(format!("Failed to decode mrenclave: {}", e))
|
||||
})?;
|
||||
if report_body.mr_enclave[..] != mrenclave_bytes {
|
||||
return Err(Error::General(format!(
|
||||
"mrenclave mismatch: got {}, expected {}",
|
||||
hex::encode(report_body.mr_enclave),
|
||||
&mrenclave
|
||||
)));
|
||||
} else {
|
||||
info!("mrenclave `{mrenclave}` matches");
|
||||
}
|
||||
}
|
||||
|
||||
info!("Quote verified! Connection secure!");
|
||||
|
||||
Ok(rustls::client::danger::ServerCertVerified::assertion())
|
||||
}
|
||||
|
||||
fn verify_tls12_signature(
|
||||
&self,
|
||||
message: &[u8],
|
||||
cert: &CertificateDer<'_>,
|
||||
dss: &DigitallySignedStruct,
|
||||
) -> std::result::Result<HandshakeSignatureValid, Error> {
|
||||
self.server_verifier
|
||||
.verify_tls12_signature(message, cert, dss)
|
||||
}
|
||||
|
||||
fn verify_tls13_signature(
|
||||
&self,
|
||||
message: &[u8],
|
||||
cert: &CertificateDer<'_>,
|
||||
dss: &DigitallySignedStruct,
|
||||
) -> std::result::Result<HandshakeSignatureValid, Error> {
|
||||
self.server_verifier
|
||||
.verify_tls13_signature(message, cert, dss)
|
||||
}
|
||||
|
||||
fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
|
||||
self.server_verifier.supported_verify_schemes()
|
||||
}
|
||||
}
|
||||
let mut root_store = rustls::RootCertStore::empty();
|
||||
root_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
|
||||
let server_verifier = WebPkiServerVerifier::builder(Arc::new(root_store))
|
||||
.build()
|
||||
.unwrap();
|
||||
|
||||
V {
|
||||
args,
|
||||
server_verifier,
|
||||
}
|
||||
}
|
||||
}
|
||||
376
crates/teepot-vault/src/client/vault.rs
Normal file
376
crates/teepot-vault/src/client/vault.rs
Normal file
|
|
@ -0,0 +1,376 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! Helper functions for CLI clients to verify Intel SGX enclaves and other TEEs.
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
use super::{AttestationArgs, TeeConnection};
|
||||
use crate::{
|
||||
json::http::{AuthRequest, AuthResponse},
|
||||
server::{pki::make_self_signed_cert, AnyHowResponseError, HttpResponseError, Status},
|
||||
};
|
||||
use actix_http::error::PayloadError;
|
||||
use actix_web::{http::header, ResponseError};
|
||||
use anyhow::{anyhow, bail, Context, Result};
|
||||
use awc::{
|
||||
error::{SendRequestError, StatusCode},
|
||||
Client, ClientResponse, Connector,
|
||||
};
|
||||
use bytes::Bytes;
|
||||
use futures_core::Stream;
|
||||
use intel_tee_quote_verification_rs::tee_qv_get_collateral;
|
||||
use rustls::ClientConfig;
|
||||
use serde_json::{json, Value};
|
||||
use std::{
|
||||
fmt::{Display, Formatter},
|
||||
sync::Arc,
|
||||
time,
|
||||
};
|
||||
use teepot::quote::error::QuoteContext;
|
||||
pub use teepot::{
|
||||
quote::{verify_quote_with_collateral, QuoteVerificationResult},
|
||||
sgx::{
|
||||
parse_tcb_levels, sgx_gramine_get_quote, sgx_ql_qv_result_t, Collateral, EnumSet, TcbLevel,
|
||||
},
|
||||
};
|
||||
use tracing::{debug, error, info, trace};
|
||||
|
||||
const VAULT_TOKEN_HEADER: &str = "X-Vault-Token";
|
||||
|
||||
/// Error returned when sending a request to Vault
|
||||
#[derive(Debug, thiserror::Error)]
|
||||
pub enum VaultSendError {
|
||||
/// Error sending the request
|
||||
SendRequest(String),
|
||||
/// Error returned by the Vault API
|
||||
#[error(transparent)]
|
||||
Vault(#[from] HttpResponseError),
|
||||
}
|
||||
|
||||
impl Display for VaultSendError {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
|
||||
match self {
|
||||
VaultSendError::SendRequest(e) => write!(f, "VaultSendError: {}", e),
|
||||
VaultSendError::Vault(e) => write!(f, "VaultSendError: {}", e),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const _: () = {
|
||||
fn assert_send<T: Send>() {}
|
||||
let _ = assert_send::<VaultSendError>;
|
||||
};
|
||||
|
||||
impl From<VaultSendError> for HttpResponseError {
|
||||
fn from(value: VaultSendError) -> Self {
|
||||
match value {
|
||||
VaultSendError::SendRequest(e) => HttpResponseError::Anyhow(AnyHowResponseError {
|
||||
status_code: StatusCode::BAD_GATEWAY,
|
||||
error: anyhow!(e),
|
||||
}),
|
||||
VaultSendError::Vault(e) => e,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// A connection to a Vault TEE, which implements the `teepot` attestation API
|
||||
/// called by a TEE itself. This authenticates the TEE to Vault and gets a token,
|
||||
/// which can be used to access the Vault API.
|
||||
pub struct VaultConnection {
|
||||
/// Options and arguments needed to attest Vault
|
||||
pub conn: TeeConnection,
|
||||
key_hash: [u8; 64],
|
||||
client_token: String,
|
||||
name: String,
|
||||
}
|
||||
|
||||
impl VaultConnection {
|
||||
/// Create a new connection to Vault
|
||||
///
|
||||
/// This will verify the attestation report and check that the enclave
|
||||
/// is running the expected code.
|
||||
pub async fn new(args: &AttestationArgs, name: String) -> Result<Self> {
|
||||
let (key_hash, rustls_certificate, rustls_pk) =
|
||||
make_self_signed_cert("CN=localhost", None)?;
|
||||
|
||||
let tls_config = Arc::new(
|
||||
ClientConfig::builder()
|
||||
.dangerous()
|
||||
.with_custom_certificate_verifier(Arc::new(TeeConnection::make_verifier(
|
||||
args.clone(),
|
||||
)))
|
||||
.with_client_auth_cert(vec![rustls_certificate], rustls_pk)?,
|
||||
);
|
||||
|
||||
let client = Client::builder()
|
||||
.add_default_header((header::USER_AGENT, "teepot/1.0"))
|
||||
// a "connector" wraps the stream into an encrypted connection
|
||||
.connector(Connector::new().rustls_0_23(tls_config))
|
||||
.timeout(time::Duration::from_secs(12000))
|
||||
.finish();
|
||||
|
||||
let mut this = Self {
|
||||
name,
|
||||
key_hash,
|
||||
conn: unsafe {
|
||||
TeeConnection::new_from_client_without_attestation(args.server.clone(), client)
|
||||
},
|
||||
client_token: Default::default(),
|
||||
};
|
||||
|
||||
this.client_token = this.auth().await?.auth.client_token;
|
||||
|
||||
trace!("Got Token: {:#?}", &this.client_token);
|
||||
|
||||
Ok(this)
|
||||
}
|
||||
|
||||
/// create a new [`VaultConnection`] to Vault from an existing connection
|
||||
///
|
||||
/// # Safety
|
||||
/// This function is unsafe, because it does not verify the attestation report.
|
||||
pub unsafe fn new_from_client_without_attestation(
|
||||
server: String,
|
||||
client: Client,
|
||||
name: String,
|
||||
client_token: String,
|
||||
) -> Self {
|
||||
Self {
|
||||
name,
|
||||
client_token,
|
||||
conn: unsafe { TeeConnection::new_from_client_without_attestation(server, client) },
|
||||
key_hash: [0u8; 64],
|
||||
}
|
||||
}
|
||||
|
||||
/// Get a reference to the agent, which can be used to make requests to the TEE
|
||||
///
|
||||
/// Note, that it will refuse to connect to any other TLS server than the one
|
||||
/// specified in the `AttestationArgs` of the `Self::new` function.
|
||||
pub fn agent(&self) -> &Client {
|
||||
self.conn.client()
|
||||
}
|
||||
|
||||
async fn auth(&self) -> Result<AuthResponse> {
|
||||
info!("Getting attestation report");
|
||||
let attestation_url = AuthRequest::URL;
|
||||
let quote = sgx_gramine_get_quote(&self.key_hash).context("Failed to get own quote")?;
|
||||
let collateral = tee_qv_get_collateral("e).context("Failed to get own collateral")?;
|
||||
|
||||
let auth_req = AuthRequest {
|
||||
name: self.name.clone(),
|
||||
tee_type: "sgx".to_string(),
|
||||
quote,
|
||||
collateral: serde_json::to_string(&collateral)?,
|
||||
challenge: None,
|
||||
};
|
||||
|
||||
let mut response = self
|
||||
.agent()
|
||||
.post(&format!(
|
||||
"{server}{attestation_url}",
|
||||
server = self.conn.server,
|
||||
))
|
||||
.send_json(&auth_req)
|
||||
.await
|
||||
.map_err(|e| anyhow!("Error sending attestation request: {}", e))?;
|
||||
|
||||
let status_code = response.status();
|
||||
if !status_code.is_success() {
|
||||
error!("Failed to login to vault: {}", status_code);
|
||||
if let Ok(r) = response.json::<Value>().await {
|
||||
eprintln!("Failed to login to vault: {}", r);
|
||||
}
|
||||
bail!("failed to login to vault: {}", status_code);
|
||||
}
|
||||
|
||||
let auth_response: Value = response.json().await.context("failed to login to vault")?;
|
||||
trace!(
|
||||
"Got AuthResponse: {:?}",
|
||||
serde_json::to_string(&auth_response)
|
||||
);
|
||||
|
||||
let auth_response: AuthResponse =
|
||||
serde_json::from_value(auth_response).context("Failed to parse AuthResponse")?;
|
||||
|
||||
trace!("Got AuthResponse: {:#?}", &auth_response);
|
||||
|
||||
Ok(auth_response)
|
||||
}
|
||||
|
||||
/// Send a put request to the vault
|
||||
pub async fn vault_put(
|
||||
&self,
|
||||
action: &str,
|
||||
url: &str,
|
||||
json: &Value,
|
||||
) -> std::result::Result<(StatusCode, Option<Value>), VaultSendError> {
|
||||
let full_url = format!("{}{url}", self.conn.server);
|
||||
info!("{action} via put {full_url}");
|
||||
debug!(
|
||||
"sending json: {:?}",
|
||||
serde_json::to_string(json).unwrap_or_default()
|
||||
);
|
||||
let res = self
|
||||
.agent()
|
||||
.put(full_url)
|
||||
.insert_header((VAULT_TOKEN_HEADER, self.client_token.clone()))
|
||||
.send_json(json)
|
||||
.await;
|
||||
Self::handle_client_response(action, res).await
|
||||
}
|
||||
|
||||
/// Send a get request to the vault
|
||||
pub async fn vault_get(
|
||||
&self,
|
||||
action: &str,
|
||||
url: &str,
|
||||
) -> std::result::Result<(StatusCode, Option<Value>), VaultSendError> {
|
||||
let full_url = format!("{}{url}", self.conn.server);
|
||||
info!("{action} via get {full_url}");
|
||||
let res = self
|
||||
.agent()
|
||||
.get(full_url)
|
||||
.insert_header((VAULT_TOKEN_HEADER, self.client_token.clone()))
|
||||
.send()
|
||||
.await;
|
||||
Self::handle_client_response(action, res).await
|
||||
}
|
||||
|
||||
async fn handle_client_response<S>(
|
||||
action: &str,
|
||||
res: std::result::Result<ClientResponse<S>, SendRequestError>,
|
||||
) -> std::result::Result<(StatusCode, Option<Value>), VaultSendError>
|
||||
where
|
||||
S: Stream<Item = Result<Bytes, PayloadError>>,
|
||||
{
|
||||
match res {
|
||||
Ok(mut r) => {
|
||||
let status_code = r.status();
|
||||
if status_code.is_success() {
|
||||
let msg = r.json().await.ok();
|
||||
debug!(
|
||||
"{action}: status code: {status_code} {:?}",
|
||||
serde_json::to_string(&msg)
|
||||
);
|
||||
Ok((status_code, msg))
|
||||
} else {
|
||||
let err = HttpResponseError::from_proxy(r).await;
|
||||
error!("{action}: {err:?}");
|
||||
Err(err.into())
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
error!("{}: {}", action, e);
|
||||
Err(VaultSendError::SendRequest(e.to_string()))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Revoke the token
|
||||
pub async fn revoke_token(&self) -> std::result::Result<(), VaultSendError> {
|
||||
self.vault_put(
|
||||
"Revoke the token",
|
||||
"/v1/auth/token/revoke-self",
|
||||
&Value::default(),
|
||||
)
|
||||
.await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn check_rel_path(rel_path: &str) -> Result<(), HttpResponseError> {
|
||||
if !rel_path.is_ascii() {
|
||||
return Err(anyhow!("path is not ascii")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
// check if rel_path is alphanumeric
|
||||
if !rel_path
|
||||
.chars()
|
||||
.all(|c| c.is_alphanumeric() || c == '_' || c == '/')
|
||||
{
|
||||
return Err(anyhow!("path is not alphanumeric")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// set a secret in the vault
|
||||
pub async fn store_secret<'de, T: serde::Serialize>(
|
||||
&self,
|
||||
val: T,
|
||||
rel_path: &str,
|
||||
) -> Result<(), HttpResponseError> {
|
||||
self.store_secret_for_tee(&self.name, val, rel_path).await
|
||||
}
|
||||
|
||||
/// set a secret in the vault for a different TEE
|
||||
pub async fn store_secret_for_tee<'de, T: serde::Serialize>(
|
||||
&self,
|
||||
tee_name: &str,
|
||||
val: T,
|
||||
rel_path: &str,
|
||||
) -> Result<(), HttpResponseError> {
|
||||
Self::check_rel_path(rel_path)?;
|
||||
|
||||
let value = serde_json::to_value(val)
|
||||
.context("converting value to json")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
|
||||
let value = json!({ "data" : { "_" : value } });
|
||||
|
||||
self.vault_put(
|
||||
"Setting secret",
|
||||
&format!("/v1/secret/data/tee/{}/{}", tee_name, rel_path),
|
||||
&value,
|
||||
)
|
||||
.await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// get a secret from the vault
|
||||
pub async fn load_secret<'de, T: serde::de::DeserializeOwned>(
|
||||
&self,
|
||||
rel_path: &str,
|
||||
) -> Result<Option<T>, HttpResponseError> {
|
||||
self.load_secret_for_tee(&self.name, rel_path).await
|
||||
}
|
||||
|
||||
/// get a secret from the vault for a specific TEE
|
||||
pub async fn load_secret_for_tee<'de, T: serde::de::DeserializeOwned>(
|
||||
&self,
|
||||
tee_name: &str,
|
||||
rel_path: &str,
|
||||
) -> Result<Option<T>, HttpResponseError> {
|
||||
Self::check_rel_path(rel_path)?;
|
||||
let v = self
|
||||
.vault_get(
|
||||
"Getting secret",
|
||||
&format!("/v1/secret/data/tee/{}/{}", tee_name, rel_path),
|
||||
)
|
||||
.await
|
||||
.or_else(|e| match e {
|
||||
VaultSendError::Vault(ref se) => {
|
||||
if se.status_code() == StatusCode::NOT_FOUND {
|
||||
debug!("Secret not found: {}", rel_path);
|
||||
Ok((StatusCode::OK, None))
|
||||
} else {
|
||||
Err(e)
|
||||
}
|
||||
}
|
||||
VaultSendError::SendRequest(_) => Err(e),
|
||||
})?
|
||||
.1
|
||||
.as_ref()
|
||||
.and_then(|v| v.get("data"))
|
||||
.and_then(|v| v.get("data"))
|
||||
.and_then(|v| v.get("_"))
|
||||
.and_then(|v| serde_json::from_value(v.clone()).transpose())
|
||||
.transpose()
|
||||
.context("Error getting value from vault")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?
|
||||
.flatten();
|
||||
Ok(v)
|
||||
}
|
||||
}
|
||||
265
crates/teepot-vault/src/json/http.rs
Normal file
265
crates/teepot-vault/src/json/http.rs
Normal file
|
|
@ -0,0 +1,265 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! Common types for the teepot http JSON API
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
use serde_json::Value;
|
||||
use serde_with::{base64::Base64, serde_as};
|
||||
use std::fmt::Display;
|
||||
|
||||
/// The unseal request data
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct Unseal {
|
||||
/// The unseal key
|
||||
pub key: String,
|
||||
}
|
||||
|
||||
impl Unseal {
|
||||
/// The unseal URL
|
||||
pub const URL: &'static str = "/v1/sys/unseal";
|
||||
}
|
||||
|
||||
/// The init request data
|
||||
#[serde_as]
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct Init {
|
||||
/// PGP keys to encrypt the unseal keys with
|
||||
pub pgp_keys: Vec<String>,
|
||||
/// number of secret shares
|
||||
pub secret_shares: usize,
|
||||
/// secret threshold
|
||||
pub secret_threshold: usize,
|
||||
/// PGP keys to sign commands for the admin tee
|
||||
#[serde_as(as = "Box<[Base64]>")]
|
||||
pub admin_pgp_keys: Box<[Box<[u8]>]>,
|
||||
/// admin threshold
|
||||
pub admin_threshold: usize,
|
||||
/// admin TEE mrenclave
|
||||
pub admin_tee_mrenclave: String,
|
||||
}
|
||||
|
||||
impl Init {
|
||||
/// The init URL
|
||||
pub const URL: &'static str = "/v1/sys/init";
|
||||
}
|
||||
|
||||
/// The init request data
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct VaultInitRequest {
|
||||
/// PGP keys to encrypt the unseal keys with
|
||||
pub pgp_keys: Vec<String>,
|
||||
/// number of secret shares
|
||||
pub secret_shares: usize,
|
||||
/// secret threshold
|
||||
pub secret_threshold: usize,
|
||||
}
|
||||
|
||||
/// The init response data
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct InitResponse {
|
||||
/// The unseal keys (gpg encrypted)
|
||||
pub unseal_keys: Vec<String>,
|
||||
}
|
||||
|
||||
/// The Vault TEE auth request data
|
||||
#[serde_as]
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct AuthRequest {
|
||||
/// The name of the TEE
|
||||
pub name: String,
|
||||
/// The type of the TEE
|
||||
#[serde(rename = "type")]
|
||||
pub tee_type: String,
|
||||
/// The attestation report data base64 encoded
|
||||
#[serde_as(as = "Base64")]
|
||||
pub quote: Box<[u8]>,
|
||||
/// The attestation collateral json encoded
|
||||
pub collateral: String,
|
||||
/// The vault attestation challenge (hex encoded)
|
||||
#[serde_as(as = "Option<serde_with::hex::Hex>")]
|
||||
#[serde(skip_serializing_if = "Option::is_none", default = "Option::default")]
|
||||
pub challenge: Option<[u8; 32]>,
|
||||
}
|
||||
|
||||
impl AuthRequest {
|
||||
/// The auth URL
|
||||
pub const URL: &'static str = "/v1/auth/tee/login";
|
||||
}
|
||||
|
||||
/// Vault auth metadata
|
||||
#[derive(Debug, Default, Serialize, Deserialize)]
|
||||
pub struct AuthMetadataField {
|
||||
collateral_expiration_date: String,
|
||||
tee_name: String,
|
||||
}
|
||||
|
||||
/// Vault auth data
|
||||
#[serde_as]
|
||||
#[derive(Debug, Default, Serialize, Deserialize)]
|
||||
pub struct AuthDataField {
|
||||
/// The attestation report data base64 encoded
|
||||
#[serde_as(as = "Base64")]
|
||||
#[serde(default)]
|
||||
pub quote: Box<[u8]>,
|
||||
/// The attestation collateral json encoded
|
||||
#[serde(default)]
|
||||
pub collateral: String,
|
||||
}
|
||||
|
||||
/// Vault auth
|
||||
#[derive(Debug, Default, Serialize, Deserialize)]
|
||||
pub struct AuthField {
|
||||
/// if the auth token is renewable
|
||||
pub renewable: bool,
|
||||
/// the lease duration of the auth token
|
||||
pub lease_duration: isize,
|
||||
/// the policies of the auth token
|
||||
pub policies: Vec<String>,
|
||||
/// the accessor of the auth token
|
||||
pub accessor: String,
|
||||
/// the client token
|
||||
pub client_token: String,
|
||||
/// additional metadata
|
||||
pub metadata: AuthMetadataField,
|
||||
}
|
||||
|
||||
/// The Vault TEE auth response data
|
||||
#[derive(Debug, Default, Serialize, Deserialize)]
|
||||
pub struct AuthResponse {
|
||||
/// vault auth
|
||||
pub auth: AuthField,
|
||||
/// vault auth data
|
||||
pub data: AuthDataField,
|
||||
}
|
||||
|
||||
/// One command datum
|
||||
#[derive(Debug, Serialize, Deserialize, PartialEq)]
|
||||
pub struct VaultCommand {
|
||||
/// The command to execute
|
||||
pub url: String,
|
||||
/// The command to execute
|
||||
pub data: Value,
|
||||
}
|
||||
|
||||
impl Display for VaultCommand {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
||||
if f.alternate() {
|
||||
f.write_str(
|
||||
serde_json::to_string_pretty(self)
|
||||
.unwrap_or("{}".into())
|
||||
.as_str(),
|
||||
)
|
||||
} else {
|
||||
f.write_str(serde_json::to_string(self).unwrap_or("{}".into()).as_str())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Multiple command data
|
||||
#[derive(Debug, Serialize, Deserialize, PartialEq)]
|
||||
pub struct VaultCommands {
|
||||
/// The sha-256 hash of the last command hex encoded
|
||||
pub last_digest: String,
|
||||
/// The actual commands
|
||||
pub commands: Vec<VaultCommand>,
|
||||
}
|
||||
|
||||
/// The command request data
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct VaultCommandRequest {
|
||||
/// The commands to execute
|
||||
///
|
||||
/// The commands are json serialized `VaultCommands`,
|
||||
/// because they are signed with multiple signatures.
|
||||
///
|
||||
/// The commands are executed in order.
|
||||
pub commands: String,
|
||||
/// The signatures of the commands
|
||||
pub signatures: Vec<String>,
|
||||
}
|
||||
|
||||
impl VaultCommandRequest {
|
||||
/// The command request URL
|
||||
pub const URL: &'static str = "/v1/command";
|
||||
}
|
||||
|
||||
/// The command response
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct VaultCommandResponse {
|
||||
/// The status code
|
||||
pub status_code: u16,
|
||||
/// The response body
|
||||
pub value: Option<Value>,
|
||||
}
|
||||
|
||||
/// The command response
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct VaultCommandsResponse {
|
||||
/// The stored digest for the execution
|
||||
pub digest: String,
|
||||
/// The results of the individual commands
|
||||
pub results: Vec<VaultCommandResponse>,
|
||||
}
|
||||
|
||||
impl Display for VaultCommandResponse {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
||||
if f.alternate() {
|
||||
f.write_str(
|
||||
serde_json::to_string_pretty(self)
|
||||
.unwrap_or("{}".into())
|
||||
.as_str(),
|
||||
)
|
||||
} else {
|
||||
f.write_str(serde_json::to_string(self).unwrap_or("{}".into()).as_str())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// The command request URL
|
||||
pub const DIGEST_URL: &str = "/v1/digest";
|
||||
|
||||
/// The signing request
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct SignRequest {
|
||||
/// json serialized `SignRequestData`, because it is signed with multiple signatures.
|
||||
pub sign_request_data: String,
|
||||
/// The signatures of the SignRequestData
|
||||
pub signatures: Vec<String>,
|
||||
}
|
||||
|
||||
impl SignRequest {
|
||||
/// The sign request URL
|
||||
pub const URL: &'static str = "/v1/sign";
|
||||
}
|
||||
|
||||
/// The signing request data
|
||||
#[serde_as]
|
||||
#[derive(Debug, Default, Serialize, Deserialize)]
|
||||
pub struct SignRequestData {
|
||||
/// The sha-256 hash of the last command hex encoded
|
||||
pub last_digest: String,
|
||||
/// The name of the TEE
|
||||
pub tee_name: String,
|
||||
/// The type of the TEE
|
||||
#[serde(rename = "type")]
|
||||
pub tee_type: String,
|
||||
/// The TEE security version number
|
||||
pub tee_svn: u16,
|
||||
/// The data to be signed.
|
||||
///
|
||||
/// In case of `tee_type == "sgx"`, it's the SGX Sigstruct Body
|
||||
#[serde_as(as = "Base64")]
|
||||
pub data: Vec<u8>,
|
||||
}
|
||||
|
||||
/// The signing request
|
||||
#[derive(Debug, Serialize, Deserialize)]
|
||||
pub struct SignResponse {
|
||||
/// The stored digest for the execution
|
||||
pub digest: String,
|
||||
/// The signed data for the tee.
|
||||
///
|
||||
/// In case of `tee_type == "sgx"`, it's the SGX Sigstruct
|
||||
pub signed_data: Vec<u8>,
|
||||
}
|
||||
10
crates/teepot-vault/src/json/mod.rs
Normal file
10
crates/teepot-vault/src/json/mod.rs
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023 Matter Labs
|
||||
|
||||
//! Common types for the teepot JSON API
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
pub mod http;
|
||||
pub mod secrets;
|
||||
34
crates/teepot-vault/src/json/secrets.rs
Normal file
34
crates/teepot-vault/src/json/secrets.rs
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! Common types for the teepot secrets JSON API
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
use serde_with::base64::Base64;
|
||||
use serde_with::serde_as;
|
||||
use teepot::sgx::sign::Zeroizing;
|
||||
|
||||
/// Configuration for the admin tee
|
||||
#[serde_as]
|
||||
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
|
||||
pub struct AdminConfig {
|
||||
/// PGP keys to sign commands for the admin tee
|
||||
#[serde_as(as = "Box<[Base64]>")]
|
||||
pub admin_pgp_keys: Box<[Box<[u8]>]>,
|
||||
/// admin threshold
|
||||
pub admin_threshold: usize,
|
||||
}
|
||||
|
||||
/// Configuration for the admin tee
|
||||
#[derive(Debug, Default, Clone, Serialize, Deserialize)]
|
||||
pub struct AdminState {
|
||||
/// last digest of executed commands
|
||||
pub last_digest: String,
|
||||
}
|
||||
|
||||
/// Configuration for the admin tee
|
||||
#[derive(Debug, Default, Clone, Serialize, Deserialize)]
|
||||
pub struct SGXSigningKey {
|
||||
/// private key in PEM format
|
||||
pub pem_pk: Zeroizing<String>,
|
||||
}
|
||||
24
crates/teepot-vault/src/lib.rs
Normal file
24
crates/teepot-vault/src/lib.rs
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! Helper functions to verify Intel SGX enclaves and other TEEs.
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
pub mod client;
|
||||
pub mod json;
|
||||
pub mod server;
|
||||
pub mod tdx;
|
||||
|
||||
/// pad a byte slice to a fixed sized array
|
||||
pub fn pad<const T: usize>(input: &[u8]) -> [u8; T] {
|
||||
let mut output = [0; T];
|
||||
let len = input.len();
|
||||
if len > T {
|
||||
output.copy_from_slice(&input[..T]);
|
||||
} else {
|
||||
output[..len].copy_from_slice(input);
|
||||
}
|
||||
output
|
||||
}
|
||||
56
crates/teepot-vault/src/server/attestation.rs
Normal file
56
crates/teepot-vault/src/server/attestation.rs
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! Common attestation API for all TEEs
|
||||
|
||||
use crate::client::AttestationArgs;
|
||||
use clap::Args;
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
pub use teepot::{
|
||||
quote::{
|
||||
attestation::get_quote_and_collateral, error::QuoteContext, get_quote,
|
||||
verify_quote_with_collateral, QuoteVerificationResult,
|
||||
},
|
||||
sgx::{parse_tcb_levels, Collateral, EnumSet, TcbLevel},
|
||||
};
|
||||
|
||||
/// Options and arguments needed to attest a TEE
|
||||
#[derive(Args, Debug, Clone, Serialize, Deserialize, Default)]
|
||||
pub struct VaultAttestationArgs {
|
||||
/// hex encoded SGX mrsigner of the enclave to attest
|
||||
#[arg(long, env = "VAULT_SGX_MRSIGNER")]
|
||||
pub vault_sgx_mrsigner: Option<String>,
|
||||
/// hex encoded SGX mrenclave of the enclave to attest
|
||||
#[arg(long, env = "VAULT_SGX_MRENCLAVE")]
|
||||
pub vault_sgx_mrenclave: Option<String>,
|
||||
/// URL of the server
|
||||
#[arg(long, required = true, env = "VAULT_ADDR")]
|
||||
pub vault_addr: String,
|
||||
/// allowed TCB levels, comma separated:
|
||||
/// Ok, ConfigNeeded, ConfigAndSwHardeningNeeded, SwHardeningNeeded, OutOfDate, OutOfDateConfigNeeded
|
||||
#[arg(long, value_parser = parse_tcb_levels, env = "VAULT_SGX_ALLOWED_TCB_LEVELS")]
|
||||
pub vault_sgx_allowed_tcb_levels: Option<EnumSet<TcbLevel>>,
|
||||
}
|
||||
|
||||
impl From<VaultAttestationArgs> for AttestationArgs {
|
||||
fn from(value: VaultAttestationArgs) -> Self {
|
||||
AttestationArgs {
|
||||
sgx_mrsigner: value.vault_sgx_mrsigner,
|
||||
sgx_mrenclave: value.vault_sgx_mrenclave,
|
||||
server: value.vault_addr,
|
||||
sgx_allowed_tcb_levels: value.vault_sgx_allowed_tcb_levels,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl From<&VaultAttestationArgs> for AttestationArgs {
|
||||
fn from(value: &VaultAttestationArgs) -> Self {
|
||||
AttestationArgs {
|
||||
sgx_mrsigner: value.vault_sgx_mrsigner.clone(),
|
||||
sgx_mrenclave: value.vault_sgx_mrenclave.clone(),
|
||||
server: value.vault_addr.clone(),
|
||||
sgx_allowed_tcb_levels: value.vault_sgx_allowed_tcb_levels,
|
||||
}
|
||||
}
|
||||
}
|
||||
188
crates/teepot-vault/src/server/mod.rs
Normal file
188
crates/teepot-vault/src/server/mod.rs
Normal file
|
|
@ -0,0 +1,188 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! # tee-server
|
||||
|
||||
#![deny(missing_docs)]
|
||||
#![deny(clippy::all)]
|
||||
|
||||
pub mod attestation;
|
||||
pub mod signatures;
|
||||
|
||||
use actix_web::{
|
||||
error, http::StatusCode, web::Bytes, HttpMessage, HttpRequest, HttpResponse, ResponseError,
|
||||
};
|
||||
use anyhow::anyhow;
|
||||
use awc::{
|
||||
error::{PayloadError, SendRequestError},
|
||||
ClientResponse,
|
||||
};
|
||||
use futures_core::Stream;
|
||||
use std::fmt::{Debug, Display, Formatter};
|
||||
pub use teepot::pki;
|
||||
use tracing::error;
|
||||
|
||||
/// Anyhow error with an HTTP status code
|
||||
pub struct AnyHowResponseError {
|
||||
/// error message
|
||||
pub error: anyhow::Error,
|
||||
/// HTTP status code
|
||||
pub status_code: StatusCode,
|
||||
}
|
||||
|
||||
/// Proxy response error
|
||||
pub struct ProxyResponseError {
|
||||
/// HTTP status code
|
||||
pub status_code: StatusCode,
|
||||
/// HTTP body
|
||||
pub body: Option<Bytes>,
|
||||
/// HTTP content type
|
||||
pub content_type: String,
|
||||
}
|
||||
|
||||
/// custom HTTP response error
|
||||
pub enum HttpResponseError {
|
||||
/// Anyhow error
|
||||
Anyhow(AnyHowResponseError),
|
||||
/// Proxy error
|
||||
Proxy(ProxyResponseError),
|
||||
}
|
||||
|
||||
impl std::error::Error for HttpResponseError {}
|
||||
|
||||
/// Attach an HTTP status code to an anyhow error turning it into an HttpResponseError
|
||||
pub trait Status {
|
||||
/// The Ok type
|
||||
type Ok;
|
||||
/// Attach an HTTP status code to an anyhow error turning it into an HttpResponseError
|
||||
fn status(self, status: StatusCode) -> Result<Self::Ok, HttpResponseError>;
|
||||
}
|
||||
|
||||
impl<T> Status for Result<T, anyhow::Error> {
|
||||
type Ok = T;
|
||||
fn status(self, status: StatusCode) -> Result<T, HttpResponseError> {
|
||||
match self {
|
||||
Ok(value) => Ok(value),
|
||||
Err(error) => Err(HttpResponseError::new(error, status)),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl HttpResponseError {
|
||||
fn new(error: anyhow::Error, status_code: StatusCode) -> Self {
|
||||
Self::Anyhow(AnyHowResponseError { error, status_code })
|
||||
}
|
||||
|
||||
/// Create a new HTTP response error from a proxy response
|
||||
pub async fn from_proxy<S>(mut response: ClientResponse<S>) -> Self
|
||||
where
|
||||
S: Stream<Item = Result<Bytes, PayloadError>>,
|
||||
{
|
||||
let status_code = response.status();
|
||||
let body = response.body().await.ok();
|
||||
let content_type = response.content_type().to_string();
|
||||
|
||||
error!(
|
||||
"Vault returned server error: {status_code} {}",
|
||||
body.as_ref()
|
||||
.map_or("", |b| std::str::from_utf8(b).unwrap_or(""))
|
||||
);
|
||||
|
||||
Self::Proxy(ProxyResponseError {
|
||||
status_code,
|
||||
body,
|
||||
content_type,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
impl From<&str> for HttpResponseError {
|
||||
fn from(value: &str) -> Self {
|
||||
error!("{}", value);
|
||||
HttpResponseError::new(
|
||||
anyhow!(value.to_string()),
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
impl From<SendRequestError> for HttpResponseError {
|
||||
fn from(error: SendRequestError) -> Self {
|
||||
error!("Error sending request: {:?}", error);
|
||||
HttpResponseError::new(
|
||||
anyhow!(error.to_string()),
|
||||
StatusCode::INTERNAL_SERVER_ERROR,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
impl Debug for HttpResponseError {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
|
||||
if let Self::Anyhow(e) = self {
|
||||
if f.alternate() {
|
||||
write!(f, "{:#?}", e.error)
|
||||
} else {
|
||||
write!(f, "{:?}", e.error)
|
||||
}
|
||||
} else {
|
||||
write!(f, "HttpResponseError")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Display for HttpResponseError {
|
||||
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
|
||||
if let Self::Anyhow(e) = self {
|
||||
if f.alternate() {
|
||||
write!(f, "{:#}", e.error)
|
||||
} else {
|
||||
write!(f, "{}", e.error)
|
||||
}
|
||||
} else {
|
||||
write!(f, "HttpResponseError")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl ResponseError for HttpResponseError {
|
||||
fn status_code(&self) -> StatusCode {
|
||||
match self {
|
||||
HttpResponseError::Anyhow(e) => e.status_code,
|
||||
HttpResponseError::Proxy(e) => e.status_code,
|
||||
}
|
||||
}
|
||||
|
||||
fn error_response(&self) -> HttpResponse {
|
||||
match self {
|
||||
HttpResponseError::Anyhow(e) => HttpResponse::build(self.status_code())
|
||||
.content_type("application/json")
|
||||
.body(format!(r#"{{"error":"{}"}}"#, e.error)),
|
||||
HttpResponseError::Proxy(e) => {
|
||||
if let Some(ref body) = e.body {
|
||||
HttpResponse::build(self.status_code())
|
||||
.content_type(e.content_type.clone())
|
||||
.body(body.clone())
|
||||
} else {
|
||||
HttpResponse::new(self.status_code())
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Create a new json config
|
||||
pub fn new_json_cfg() -> actix_web::web::JsonConfig {
|
||||
actix_web::web::JsonConfig::default()
|
||||
.limit(1024 * 1024)
|
||||
.error_handler(json_error_handler)
|
||||
}
|
||||
|
||||
fn json_error_handler(err: error::JsonPayloadError, _: &HttpRequest) -> actix_web::Error {
|
||||
error::InternalError::from_response(
|
||||
"",
|
||||
HttpResponse::BadRequest()
|
||||
.content_type("application/json")
|
||||
.body(format!(r#"{{"error":"json error: {}"}}"#, err)),
|
||||
)
|
||||
.into()
|
||||
}
|
||||
120
crates/teepot-vault/src/server/signatures.rs
Normal file
120
crates/teepot-vault/src/server/signatures.rs
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2024 Matter Labs
|
||||
|
||||
//! Signature checking utilities
|
||||
|
||||
use crate::json::secrets::AdminConfig;
|
||||
use crate::server::{HttpResponseError, Status as _};
|
||||
use actix_web::http::StatusCode;
|
||||
use anyhow::{anyhow, bail, Context, Result};
|
||||
use pgp::types::PublicKeyTrait;
|
||||
use pgp::{Deserializable, SignedPublicKey, StandaloneSignature};
|
||||
use tracing::debug;
|
||||
|
||||
/// Verify a pgp signature for some message given some public keys
|
||||
pub fn verify_sig(sig: &str, msg: &[u8], keys: &[SignedPublicKey]) -> anyhow::Result<usize> {
|
||||
let (signatures, _) =
|
||||
StandaloneSignature::from_string_many(sig).context(format!("reading signature {}", sig))?;
|
||||
|
||||
for signature in signatures {
|
||||
let signature = match signature {
|
||||
Ok(s) => s,
|
||||
Err(e) => {
|
||||
debug!("Failed to parse signature: {}", e);
|
||||
continue;
|
||||
}
|
||||
};
|
||||
|
||||
for (pos, key) in keys.iter().enumerate() {
|
||||
let actual_key = &key.primary_key;
|
||||
if actual_key.is_signing_key() && signature.verify(&actual_key, msg).is_ok() {
|
||||
return Ok(pos);
|
||||
}
|
||||
for sub_key in &key.public_subkeys {
|
||||
if sub_key.is_signing_key() && signature.verify(sub_key, msg).is_ok() {
|
||||
return Ok(pos);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
eprintln!("Failed to verify signature for `{sig}`");
|
||||
bail!("Failed to verify signature for `{sig}`");
|
||||
}
|
||||
|
||||
/// Verify pgp signatures for a message with some threshold
|
||||
pub fn check_sigs(
|
||||
pgp_keys: &[Box<[u8]>],
|
||||
threshold: usize,
|
||||
signatures: &[String],
|
||||
msg: &[u8],
|
||||
) -> Result<(), HttpResponseError> {
|
||||
let mut keys = Vec::new();
|
||||
|
||||
for bytes in pgp_keys {
|
||||
let key = SignedPublicKey::from_bytes(bytes.as_ref())
|
||||
.context("parsing public key")
|
||||
.status(StatusCode::INTERNAL_SERVER_ERROR)?;
|
||||
keys.push(key);
|
||||
}
|
||||
|
||||
let mut verified: usize = 0;
|
||||
|
||||
for sig in signatures {
|
||||
if let Ok(pos) = verify_sig(sig, msg, &keys) {
|
||||
keys.remove(pos);
|
||||
verified += 1;
|
||||
}
|
||||
if verified >= threshold {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if verified < threshold {
|
||||
return Err(anyhow!("not enough valid signatures")).status(StatusCode::BAD_REQUEST);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Verify pgp signatures for a message
|
||||
pub trait VerifySig {
|
||||
/// Verify pgp signatures for a message
|
||||
fn check_sigs(&self, signatures: &[String], msg: &[u8]) -> Result<(), HttpResponseError>;
|
||||
}
|
||||
|
||||
impl VerifySig for AdminConfig {
|
||||
fn check_sigs(&self, signatures: &[String], msg: &[u8]) -> Result<(), HttpResponseError> {
|
||||
check_sigs(&self.admin_pgp_keys, self.admin_threshold, signatures, msg)
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::verify_sig;
|
||||
use base64::{engine::general_purpose, Engine as _};
|
||||
use pgp::{Deserializable, SignedPublicKey};
|
||||
|
||||
const TEST_DATA: &str = include_str!("../../tests/data/test.json");
|
||||
|
||||
// gpg --armor --local-user test@example.com --detach-sign bin/tee-vault-admin/tests/data/test.json
|
||||
const TEST_SIG: &str = include_str!("../../tests/data/test.json.asc");
|
||||
|
||||
// gpg --armor --export 81A312C59D679D930FA9E8B06D728F29A2DBABF8 > bin/tee-vault-admin/tests/data/pub-81A312C59D679D930FA9E8B06D728F29A2DBABF8.asc
|
||||
const TEST_KEY: &str =
|
||||
include_str!("../../tests/data/pub-81A312C59D679D930FA9E8B06D728F29A2DBABF8.asc");
|
||||
|
||||
const TEST_KEY_BASE64: &str =
|
||||
include_str!("../../tests/data/pub-81A312C59D679D930FA9E8B06D728F29A2DBABF8.b64");
|
||||
|
||||
#[test]
|
||||
fn test_sig() {
|
||||
let test_key = SignedPublicKey::from_string(TEST_KEY).unwrap().0;
|
||||
verify_sig(TEST_SIG, TEST_DATA.as_bytes(), &[test_key]).unwrap();
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_key_import() {
|
||||
let str = TEST_KEY_BASE64.lines().collect::<String>();
|
||||
let bytes = general_purpose::STANDARD.decode(str).unwrap();
|
||||
let _ = SignedPublicKey::from_bytes(bytes.as_slice()).unwrap();
|
||||
}
|
||||
}
|
||||
32
crates/teepot-vault/src/tdx/mod.rs
Normal file
32
crates/teepot-vault/src/tdx/mod.rs
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2023-2025 Matter Labs
|
||||
|
||||
//! Intel TDX helper functions.
|
||||
|
||||
pub mod rtmr;
|
||||
|
||||
pub use intel_tee_quote_verification_rs::Collateral;
|
||||
use tdx_attest_rs::{tdx_att_get_quote, tdx_attest_error_t, tdx_report_data_t};
|
||||
pub use teepot::sgx::tcblevel::{parse_tcb_levels, EnumSet, TcbLevel};
|
||||
use teepot::sgx::QuoteError;
|
||||
|
||||
/// Get a TDX quote
|
||||
pub fn tgx_get_quote(report_data_bytes: &[u8; 64]) -> Result<Box<[u8]>, QuoteError> {
|
||||
let mut tdx_report_data = tdx_report_data_t { d: [0; 64usize] };
|
||||
tdx_report_data.d.copy_from_slice(report_data_bytes);
|
||||
|
||||
let (error, quote) = tdx_att_get_quote(Some(&tdx_report_data), None, None, 0);
|
||||
|
||||
if error == tdx_attest_error_t::TDX_ATTEST_SUCCESS {
|
||||
if let Some(quote) = quote {
|
||||
Ok(quote.into())
|
||||
} else {
|
||||
Err(QuoteError::TdxAttGetQuote {
|
||||
msg: "tdx_att_get_quote: No quote returned".into(),
|
||||
inner: error,
|
||||
})
|
||||
}
|
||||
} else {
|
||||
Err(error.into())
|
||||
}
|
||||
}
|
||||
90
crates/teepot-vault/src/tdx/rtmr.rs
Normal file
90
crates/teepot-vault/src/tdx/rtmr.rs
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
// SPDX-License-Identifier: Apache-2.0
|
||||
// Copyright (c) 2024-2025 Matter Labs
|
||||
|
||||
//! rtmr event data
|
||||
|
||||
use teepot::sgx::QuoteError;
|
||||
|
||||
/// The actual rtmr event data handled in DCAP
|
||||
#[repr(C, packed)]
|
||||
pub struct TdxRtmrEvent {
|
||||
/// Always 1
|
||||
version: u32,
|
||||
|
||||
/// The RTMR that will be extended. As defined in
|
||||
/// https://github.com/confidential-containers/td-shim/blob/main/doc/tdshim_spec.md#td-measurement
|
||||
/// we will use RTMR 3 for guest application code and configuration.
|
||||
rtmr_index: u64,
|
||||
|
||||
/// Data that will be used to extend RTMR
|
||||
extend_data: [u8; 48usize],
|
||||
|
||||
/// Not used in DCAP
|
||||
event_type: u32,
|
||||
|
||||
/// Always 0
|
||||
event_data_size: u32,
|
||||
|
||||
/// Not used in DCAP
|
||||
event_data: Vec<u8>,
|
||||
}
|
||||
|
||||
impl Default for TdxRtmrEvent {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
extend_data: [0; 48],
|
||||
version: 1,
|
||||
rtmr_index: 3,
|
||||
event_type: 0,
|
||||
event_data_size: 0,
|
||||
event_data: Vec::new(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl TdxRtmrEvent {
|
||||
/// use the extend data
|
||||
pub fn with_extend_data(mut self, extend_data: [u8; 48]) -> Self {
|
||||
self.extend_data = extend_data;
|
||||
self
|
||||
}
|
||||
|
||||
/// extend the rtmr index
|
||||
pub fn with_rtmr_index(mut self, rtmr_index: u64) -> Self {
|
||||
self.rtmr_index = rtmr_index;
|
||||
self
|
||||
}
|
||||
|
||||
/// extending the index, consuming self
|
||||
pub fn extend(self) -> Result<(), QuoteError> {
|
||||
let event: Vec<u8> = self.into();
|
||||
|
||||
match tdx_attest_rs::tdx_att_extend(&event) {
|
||||
tdx_attest_rs::tdx_attest_error_t::TDX_ATTEST_SUCCESS => Ok(()),
|
||||
error_code => Err(error_code.into()),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl From<TdxRtmrEvent> for Vec<u8> {
|
||||
fn from(val: TdxRtmrEvent) -> Self {
|
||||
let event_ptr = &val as *const TdxRtmrEvent as *const u8;
|
||||
let event_data_size = std::mem::size_of::<u8>() * val.event_data_size as usize;
|
||||
let res_size = std::mem::size_of::<u32>() * 3
|
||||
+ std::mem::size_of::<u64>()
|
||||
+ std::mem::size_of::<[u8; 48]>()
|
||||
+ event_data_size;
|
||||
let mut res = vec![0; res_size];
|
||||
unsafe {
|
||||
for (i, chunk) in res.iter_mut().enumerate().take(res_size - event_data_size) {
|
||||
*chunk = *event_ptr.add(i);
|
||||
}
|
||||
}
|
||||
let event_data = val.event_data;
|
||||
for i in 0..event_data_size {
|
||||
res[i + res_size - event_data_size] = event_data[i];
|
||||
}
|
||||
|
||||
res
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQGNBGTBKKQBDACo28S5h7rvfcj89OIv66evSsOExJJ363oYWBfs0GPkgPG/bS2p
|
||||
gIFe5+yqvW5q2tnDYHz0WJkYQcwTqQQpt/Ma+UV+uaHc2pJfKvsmpI9o3xf+eV3C
|
||||
9HrU+6lwr8efkBkjLrfzkroQf0II/eX9omePt4qXNMX07UKI1ZrmXWmn5BlXiwkQ
|
||||
l0M9XWwS3PZ2aiM2MMUjfmDAdi5pc10UgZddlbInjK8guXj9/HQt23l3W1df83QN
|
||||
lxC+sDmlekwugeg0HckcgTjGICvML+gwsX/GVDMJe/O8D7Sy7KKrO23xwus7p8At
|
||||
4C5+0WCqARBKQbTE0IZTyUZUgt6xnn1BhFHBCblpI2KPkRXSUWBkb/Npr40Y2uMi
|
||||
BZNk2Iwdyuim8+Zs5pHCISvR09COswFgM+K7ikv7EMMr1YsEcFGH4sE3GQXVw4qO
|
||||
NdITNBAz/5+cPWAOUOske6BeUjLaC4XaG4wY2Rg7RVoDCqhKav+VYE2B/X0pNVSf
|
||||
PyZKirkMllHVwA8AEQEAAbQXdGVzdCA8dGVzdEBleGFtcGxlLmNvbT6JAdEEEwEI
|
||||
ADsWIQSBoxLFnWedkw+p6LBtco8potur+AUCZMEopAIbAwULCQgHAgIiAgYVCgkI
|
||||
CwIEFgIDAQIeBwIXgAAKCRBtco8potur+Cb2C/9sc2VYpi8eYnPrclU/28SoecG9
|
||||
cyPAZ5D+AQfAnVPLDdeBgLLr4FrMkRLvFNEoNwSFWAHNde77ChKFVPjqs1ubR+P6
|
||||
RJ8YjeuF5l5objn/xXd+fe79gjBfWRVUR36+q9TvJwr51bL/cFNv0eGpvxV4OhiX
|
||||
ImF99Ik3HtXX2w5b8rkH2DcW39HlQvxqOY3OTskmVn0nv5l6Q9CHrIXsaug11Bp/
|
||||
EQPyMG/E0Qa1SWCIyDwphEQzIUFIBg0zlAUC2Tlh9PYrgZJ5GjNY18a0ZglwTp48
|
||||
IpwOUXwT9IzOKyrM1jA9lg8P5ih/MLZKIMvroKrry+IZXQAujnvH0HwMehDuepR+
|
||||
liOx1byI2VitOkl7GpAZ03t+ae/KrsjJ+Dx/oFFkDVQAF2dDJHiFzZD8DHucIngY
|
||||
4b8Wq7N+8hzyk8AgKFK9rq3HqPH5L+NsJEzS1xOQeaGlI1H1knnAgRuIBZdZewrR
|
||||
/UosYei3mZtEclHU+YqeeBAsVoKKSVi2ryu8RCk=
|
||||
=LKzc
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
mQGNBGTBKKQBDACo28S5h7rvfcj89OIv66evSsOExJJ363oYWBfs0GPkgPG/bS2pgIFe5+yqvW5q
|
||||
2tnDYHz0WJkYQcwTqQQpt/Ma+UV+uaHc2pJfKvsmpI9o3xf+eV3C9HrU+6lwr8efkBkjLrfzkroQ
|
||||
f0II/eX9omePt4qXNMX07UKI1ZrmXWmn5BlXiwkQl0M9XWwS3PZ2aiM2MMUjfmDAdi5pc10UgZdd
|
||||
lbInjK8guXj9/HQt23l3W1df83QNlxC+sDmlekwugeg0HckcgTjGICvML+gwsX/GVDMJe/O8D7Sy
|
||||
7KKrO23xwus7p8At4C5+0WCqARBKQbTE0IZTyUZUgt6xnn1BhFHBCblpI2KPkRXSUWBkb/Npr40Y
|
||||
2uMiBZNk2Iwdyuim8+Zs5pHCISvR09COswFgM+K7ikv7EMMr1YsEcFGH4sE3GQXVw4qONdITNBAz
|
||||
/5+cPWAOUOske6BeUjLaC4XaG4wY2Rg7RVoDCqhKav+VYE2B/X0pNVSfPyZKirkMllHVwA8AEQEA
|
||||
AbQXdGVzdCA8dGVzdEBleGFtcGxlLmNvbT6JAdEEEwEIADsWIQSBoxLFnWedkw+p6LBtco8potur
|
||||
+AUCZMEopAIbAwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRBtco8potur+Cb2C/9sc2VY
|
||||
pi8eYnPrclU/28SoecG9cyPAZ5D+AQfAnVPLDdeBgLLr4FrMkRLvFNEoNwSFWAHNde77ChKFVPjq
|
||||
s1ubR+P6RJ8YjeuF5l5objn/xXd+fe79gjBfWRVUR36+q9TvJwr51bL/cFNv0eGpvxV4OhiXImF9
|
||||
9Ik3HtXX2w5b8rkH2DcW39HlQvxqOY3OTskmVn0nv5l6Q9CHrIXsaug11Bp/EQPyMG/E0Qa1SWCI
|
||||
yDwphEQzIUFIBg0zlAUC2Tlh9PYrgZJ5GjNY18a0ZglwTp48IpwOUXwT9IzOKyrM1jA9lg8P5ih/
|
||||
MLZKIMvroKrry+IZXQAujnvH0HwMehDuepR+liOx1byI2VitOkl7GpAZ03t+ae/KrsjJ+Dx/oFFk
|
||||
DVQAF2dDJHiFzZD8DHucIngY4b8Wq7N+8hzyk8AgKFK9rq3HqPH5L+NsJEzS1xOQeaGlI1H1knnA
|
||||
gRuIBZdZewrR/UosYei3mZtEclHU+YqeeBAsVoKKSVi2ryu8RCk=
|
||||
16
crates/teepot-vault/tests/data/test.json
Normal file
16
crates/teepot-vault/tests/data/test.json
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"last_digest": "",
|
||||
"commands": [
|
||||
{
|
||||
"url": "/v1/auth/tee/tees/test",
|
||||
"data": {
|
||||
"lease": "1000",
|
||||
"name": "test",
|
||||
"sgx_allowed_tcb_levels": "Ok,SwHardeningNeeded",
|
||||
"sgx_mrsigner": "c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d",
|
||||
"token_policies": "test",
|
||||
"types": "sgx"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
26
crates/teepot-vault/tests/data/test.json.asc
Normal file
26
crates/teepot-vault/tests/data/test.json.asc
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCAAdFiEEC0Pk344t4+guABNk9RmhFDs/vjIFAmT5sBwACgkQ9RmhFDs/
|
||||
vjIJ2g/9E8kRdvz8hhxOyJRPpNZ9bcGJ+FvMjG7geEdixqu1Bwpfyj+UhGRY7Dgq
|
||||
4T46w/Hmr8YBZTI3xpafUSldyEvZnFXRuIQoBR+JQYNu8s9Jm9yDIyLLA86quiY8
|
||||
nU+x6x89sSOOvmTpRUBi6htTC4h0zZHHfAcmu0YS2pMmxXYJX7Rw3T7AJE0Uc4O/
|
||||
+0Ho1PMFB4BRmnNGlqBFc2u/yXEy38AWrmcheoPNtbdWmI/3leKikW5l2cXfPRuT
|
||||
tazc92NiIK6qu209jlusMBpADdu8FSAI9ax4dKL1uE8KQyUIKQVQq3sBqQsPTgiW
|
||||
XT6XznFdWawtW1y2jzt0DbdCt2osSwV7rPYbn6yxEpzQWuPL75JiDmJMktgBV38t
|
||||
FKBpQl1ZDF9wARwsxBvNRaL0XPSurTtf/x4olue91D3I2fNeymS6P1DNXvLGXPD5
|
||||
46C2TvS1305wPjCpFAEgS58WpiiJppCYDsU0A7DEHbaIgk5mQ/iEdBOBvrn0xton
|
||||
Rni5mXt0Vi0WfE8GriR25YajtAOI2/rxTSZjiSJI51WmdnV/lkJiY1YF0ws+KUXG
|
||||
r2E+Bea0kwcnCMYFzraxwLwiS4mgamdQmp8DNALYZe8m/k+dNKI6tDEdWFMTiwda
|
||||
PJMDc3+lUOcZCN6+umLUOVvNWQZ2QtZ4RSTzbJyDww4ysgTpFHOJAcUEAAEIAC8W
|
||||
IQSBoxLFnWedkw+p6LBtco8potur+AUCZPmwIREcdGVzdEBleGFtcGxlLmNvbQAK
|
||||
CRBtco8potur+CMVDACm+OMPck8lmOnNGphP7kKtMcyMyIvsI2Ik/fB3A2z+iXnX
|
||||
TQljubYTqN4Hzv5MECoUhm3GiWJOYjGoXnpec1zAk4VAewin1814Dldq/9CQ+YlN
|
||||
W7HKjCiCBSdk2tPEBUK6gfV+OU9N2mNp/+biuwNTVHpPokIiwBE3MKjtUc0W0xLU
|
||||
N+S/mb1l0MsA91PPRlZqovEFs6214zo8e31pXcWbLbfhbVY32pqDk4eG1JAFjjGM
|
||||
oBASk7z1TH8Ealfj3xr8/HCbfyoaMcSmQzYdEr4E7XOp955IjRU91RrHxYjcxQ9f
|
||||
0VUwak08k6hNBD502jstv5ePJBWoFXYXKuBlaH224Xvhe+9GnaUXsU8rI+OMHJes
|
||||
g4/98+bparaQ8pjhLeh5BoIhojg0y4qNaFmbJraZxG3uhyH0nDVfepOsUj4QOadS
|
||||
VbuULwAy97q+UFwUWuVn/XVzrb3B35TpIJWpvJLF6w5f3pyy58XsVOfVmNyyGuyU
|
||||
jMWUGxIGAsXZusCmsNs=
|
||||
=qVV5
|
||||
-----END PGP SIGNATURE-----
|
||||
16
crates/teepot-vault/tests/data/test2.json
Normal file
16
crates/teepot-vault/tests/data/test2.json
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"last_digest": "564623a3afcedc19737f7002885bb62529bd8125f4dd6b0d6efd57ab768fb773",
|
||||
"commands": [
|
||||
{
|
||||
"url": "/v1/auth/tee/tees/test",
|
||||
"data": {
|
||||
"lease": "1000",
|
||||
"name": "test",
|
||||
"sgx_allowed_tcb_levels": "Ok,SwHardeningNeeded",
|
||||
"sgx_mrsigner": "c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d",
|
||||
"token_policies": "test",
|
||||
"types": "sgx"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
14
crates/teepot-vault/tests/data/test2.json.asc
Normal file
14
crates/teepot-vault/tests/data/test2.json.asc
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQHFBAABCAAvFiEEgaMSxZ1nnZMPqeiwbXKPKaLbq/gFAmTSQ7sRHHRlc3RAZXhh
|
||||
bXBsZS5jb20ACgkQbXKPKaLbq/jd0Av/Zruw1+nsVFwVIF98IhK4rWoW4vV3Xims
|
||||
wMpAxoV2wTlk55xHbGkWa0BHnjvJr3XlwyJtEI4fT4rL53AgsSd/kp0/2Ml6ExgN
|
||||
LGgziTf+Ct6oHPSM8YDtBXWtFv8YwieSxTYNA1hlCkwpN1d1k8JLZj4i1+U1AhPL
|
||||
nYtM2PLOxxkdFCx7ecp2GCKqsZa1qR+dc+igAHJ4mKKKR9bhhtTxf1tH3nf1BAWu
|
||||
G3Kw+CZISX4IvuUFVC/AA/+g2ySBoLhmk01lzjYvlJHQyJiOlSpHo1nGBvQHZ9cO
|
||||
32I0dn+GOlnzCnsYX4JBsiGrNXG1PfEqL0MbNdrVf8grRC96zwQ9ITio25DaRe1r
|
||||
rO+i68aAS3f9XGGJ1YHUKCAAmCnwPz+x34gH6r6r8LOI+ZRnFKbUDd7Fbuy47EXb
|
||||
oKe3/oGfnY6avn+/2dR1qeHwnN+CSW64UDChWFXyxCD17go7crGq1MhpNvlmmuxW
|
||||
HRI4+gMa4DpiCrzDgCS4ZVaZyzIwIvWw
|
||||
=X/H8
|
||||
-----END PGP SIGNATURE-----
|
||||
Loading…
Add table
Add a link
Reference in a new issue