[WIP] AMD SNP: add derived-key endpoint

Makefile

@@ -79,6 +79,13 @@ $(AA_BINARY):
 	@echo build $(AA) for $(TEE_PLATFORM)
 	cd $(AA) && $(MAKE) ttrpc=true ARCH=$(ARCH) LIBC=$(LIBC) ATTESTER=$(ATTESTER)
 
+aa-docker-protobuf:
+	docker run --rm -it -v "$$PWD":/app --workdir /app rust:1.87 sh \
+		-c "cd $(AA) &&  \
+		apt -y update && \
+		apt install -y tss2 libtss2-dev libtss2-esys-3.0.2-0 && \
+		cargo build -p kbs_protocol -p attestation-agent"
+
 $(ASR_BINARY):
 	@echo build $(ASR) for $(TEE_PLATFORM)
 	cd $(ASR) && $(MAKE) ARCH=$(ARCH) LIBC=$(LIBC)

api-server-rest/build.rs

@@ -61,6 +61,20 @@ fn _evidence() {}
 )]
 fn _resource() {}
 
+#[utoipa::path(
+    post,
+    path = "/aa/derived_key",
+    request_body = Vec<u8>,
+    responses(
+        (status = 200, description = "success response",
+                content_type = "application/octet-stream",
+                body = Vec<u8>),
+        (status = 400, description = "invalid user data"),
+        (status = 500, description = "internal server error")
+    )
+)]
+fn _derived_key() {}
+
 fn generate_openapi_document() -> std::io::Result<()> {
     #[derive(OpenApi)]
     #[openapi(
@@ -72,7 +86,7 @@ fn generate_openapi_document() -> std::io::Result<()> {
         (url = "http://127.0.0.1:8006", description = "CoCo Restful API")
      ),
 
-    paths(_token, _evidence, _resource)
+    paths(_token, _evidence, _resource, _derived_key)
  )]
     struct ApiDoc;
     let mut file = File::create("openapi/api.json")?;

api-server-rest/openapi/api.json

@@ -19,6 +19,50 @@
     }
   ],
   "paths": {
+    "/aa/derived_key": {
+      "post": {
+        "tags": [],
+        "operationId": "_derived_key",
+        "requestBody": {
+          "content": {
+            "application/octet-stream": {
+              "schema": {
+                "type": "array",
+                "items": {
+                  "type": "integer",
+                  "format": "int32",
+                  "minimum": 0
+                }
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "success response",
+            "content": {
+              "application/octet-stream": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "integer",
+                    "format": "int32",
+                    "minimum": 0
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "invalid user data"
+          },
+          "500": {
+            "description": "internal server error"
+          }
+        }
+      }
+    },
     "/aa/evidence": {
       "get": {
         "tags": [],

api-server-rest/protos/attestation_agent.proto

@@ -18,7 +18,16 @@ message GetTokenResponse {
     bytes Token = 1;
 }
 
+message GetDerivedKeyRequest {
+    bytes KeyId = 1;
+}
+
+message GetDerivedKeyResponse {
+    bytes DerivedKey = 1;
+}
+
 service AttestationAgentService {
-    rpc GetEvidence(GetEvidenceRequest) returns (GetEvidenceResponse) {};
-    rpc GetToken(GetTokenRequest) returns (GetTokenResponse) {};
+  rpc GetDerivedKey(GetDerivedKeyRequest) returns (GetDerivedKeyResponse) {};
+  rpc GetEvidence(GetEvidenceRequest) returns (GetEvidenceResponse) {};
+  rpc GetToken(GetTokenRequest) returns (GetTokenResponse) {};
 }

api-server-rest/src/aa.rs

@@ -4,7 +4,9 @@
 //
 
 use crate::router::ApiHandler;
-use crate::ttrpc_proto::attestation_agent::{GetEvidenceRequest, GetTokenRequest};
+use crate::ttrpc_proto::attestation_agent::{
+    GetDerivedKeyRequest, GetEvidenceRequest, GetTokenRequest,
+};
 use crate::ttrpc_proto::attestation_agent_ttrpc::AttestationAgentServiceClient;
 use anyhow::*;
 use async_trait::async_trait;
@@ -20,6 +22,7 @@ pub const AA_ROOT: &str = "/aa";
 /// URL for querying CDH get resource API
 const AA_TOKEN_URL: &str = "/token";
 const AA_EVIDENCE_URL: &str = "/evidence";
+const AA_DERIVED_KEY_URL: &str = "/derived_key";
 
 pub struct AAClient {
     client: AttestationAgentServiceClient,
@@ -50,34 +53,52 @@ impl ApiHandler for AAClient {
             .map(|v| form_urlencoded::parse(v.as_bytes()).into_owned().collect())
             .unwrap_or_default();
 
-        if params.len() != 1 {
-            return self.not_allowed();
+        if params.len() == 0 {
+            match url_path {
+                AA_DERIVED_KEY_URL => {
+                    let res = self.get_derived_key();
+                    match res.await {
+                        std::result::Result::Ok(results) => {
+                            return self.octet_stream_response(results)
+                        }
+                        Err(e) => return self.internal_error(e.to_string()),
+                    };
+                }
+                _ => {
+                    return self.not_found();
+                }
+            }
         }
 
-        match url_path {
-            AA_TOKEN_URL => match params.get("token_type") {
-                Some(token_type) => match self.get_token(token_type).await {
-                    std::result::Result::Ok(results) => return self.octet_stream_response(results),
-                    Err(e) => return self.internal_error(e.to_string()),
-                },
-                None => return self.bad_request(),
-            },
-            AA_EVIDENCE_URL => match params.get("runtime_data") {
-                Some(runtime_data) => {
-                    match self.get_evidence(&runtime_data.clone().into_bytes()).await {
+        if params.len() == 1 {
+            match url_path {
+                AA_TOKEN_URL => match params.get("token_type") {
+                    Some(token_type) => match self.get_token(token_type).await {
                         std::result::Result::Ok(results) => {
                             return self.octet_stream_response(results)
                         }
                         Err(e) => return self.internal_error(e.to_string()),
+                    },
+                    None => return self.bad_request(),
+                },
+                AA_EVIDENCE_URL => match params.get("runtime_data") {
+                    Some(runtime_data) => {
+                        match self.get_evidence(&runtime_data.clone().into_bytes()).await {
+                            std::result::Result::Ok(results) => {
+                                return self.octet_stream_response(results)
+                            }
+                            Err(e) => return self.internal_error(e.to_string()),
+                        }
                     }
+                    None => return self.bad_request(),
+                },
+                _ => {
+                    return self.not_found();
                 }
-                None => return self.bad_request(),
-            },
-
-            _ => {
-                return self.not_found();
             }
         }
+
+        return self.not_found();
     }
 }
 
@@ -116,4 +137,15 @@ impl AAClient {
             .await?;
         Ok(res.Evidence)
     }
+
+    pub async fn get_derived_key(&self) -> Result<Vec<u8>> {
+        let req = GetDerivedKeyRequest {
+            ..Default::default()
+        };
+        let res = self
+            .client
+            .get_derived_key(ttrpc::context::with_timeout(TTRPC_TIMEOUT), &req)
+            .await?;
+        Ok(res.DerivedKey)
+    }
 }