blob: 80a9608b8c75c3d707e825bc88a7e13094655683 [file] [log] [blame]
Alice Wang748b0322023-07-24 12:51:18 +00001// Copyright 2023, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! This module contains the requests and responses definitions exchanged
16//! between the host and the service VM.
17
18use alloc::vec::Vec;
Alice Wangd80e99e2023-09-15 13:26:01 +000019use core::fmt;
20use log::error;
Alice Wang748b0322023-07-24 12:51:18 +000021use serde::{Deserialize, Serialize};
22
Alice Wang464e4732023-09-06 12:25:22 +000023type MacedPublicKey = Vec<u8>;
24
Alice Wangfbdc85b2023-09-07 12:56:46 +000025/// The main request type to be sent to the service VM.
26#[derive(Clone, Debug, Serialize, Deserialize)]
27pub enum ServiceVmRequest {
28 /// A request to be processed by the service VM.
29 ///
30 /// Each request has a corresponding response item.
31 Process(Request),
32
33 /// Shuts down the service VM. No response is expected from it.
34 Shutdown,
35}
36
37/// Represents a process request to be sent to the service VM.
Alice Wang748b0322023-07-24 12:51:18 +000038///
39/// Each request has a corresponding response item.
40#[derive(Clone, Debug, Serialize, Deserialize)]
41pub enum Request {
42 /// Reverse the order of the bytes in the provided byte array.
43 /// Currently this is only used for testing.
44 Reverse(Vec<u8>),
Alice Wang33f4cae2023-09-05 09:27:39 +000045
46 /// Generates a new ECDSA P-256 key pair that can be attested by the remote
47 /// server.
48 GenerateEcdsaP256KeyPair,
Alice Wang464e4732023-09-06 12:25:22 +000049
50 /// Creates a certificate signing request to be sent to the
51 /// provisioning server.
52 GenerateCertificateRequest(GenerateCertificateRequestParams),
Alice Wang9aeb4062023-10-30 14:19:38 +000053
54 /// Requests the service VM to attest the client VM and issue a certificate
55 /// if the attestation succeeds.
56 RequestClientVmAttestation(ClientVmAttestationParams),
57}
58
59/// Represents the params passed to `Request::RequestClientVmAttestation`.
60#[derive(Clone, Debug, Serialize, Deserialize)]
61pub struct ClientVmAttestationParams {
62 /// The CBOR-encoded CSR signed by the CDI_Leaf_Priv of the client VM's DICE chain
63 /// and the private key to be attested.
64 /// See client_vm_csr.cddl for the definition of the CSR.
65 pub csr: Vec<u8>,
66
67 /// The key blob retrieved from RKPD by virtualizationservice.
68 pub remotely_provisioned_key_blob: Vec<u8>,
Alice Wang20b8ebc2023-11-17 09:54:47 +000069
70 /// The leaf certificate of the certificate chain retrieved from RKPD by
71 /// virtualizationservice.
72 ///
73 /// This certificate is a DER-encoded X.509 certificate that includes the remotely
74 /// provisioned public key.
75 pub remotely_provisioned_cert: Vec<u8>,
Alice Wang748b0322023-07-24 12:51:18 +000076}
77
78/// Represents a response to a request sent to the service VM.
79///
80/// Each response corresponds to a specific request.
81#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
82pub enum Response {
83 /// Reverse the order of the bytes in the provided byte array.
84 Reverse(Vec<u8>),
Alice Wang33f4cae2023-09-05 09:27:39 +000085
86 /// Returns the new ECDSA P-256 key pair.
87 GenerateEcdsaP256KeyPair(EcdsaP256KeyPair),
Alice Wang464e4732023-09-06 12:25:22 +000088
89 /// Returns a CBOR Certificate Signing Request (Csr) serialized into a byte array.
90 GenerateCertificateRequest(Vec<u8>),
Alice Wangd80e99e2023-09-15 13:26:01 +000091
Alice Wang9aeb4062023-10-30 14:19:38 +000092 /// Returns a certificate covering the public key to be attested in the provided CSR.
93 /// The certificate is signed by the remotely provisioned private key and also
94 /// includes an extension that describes the attested client VM.
95 RequestClientVmAttestation(Vec<u8>),
96
Alice Wangd80e99e2023-09-15 13:26:01 +000097 /// Encountered an error during the request processing.
98 Err(RequestProcessingError),
99}
100
101/// Errors related to request processing.
102#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
103pub enum RequestProcessingError {
Alice Wangc8f88f52023-09-25 14:02:17 +0000104 /// An error happened during the interaction with BoringSSL.
105 BoringSslError(bssl_avf_error::Error),
Alice Wangd80e99e2023-09-15 13:26:01 +0000106
107 /// An error happened during the interaction with coset.
108 CosetError,
109
Alice Wang6bc2a702023-09-22 12:42:13 +0000110 /// An unexpected internal error occurred.
111 InternalError,
112
Alice Wangd80e99e2023-09-15 13:26:01 +0000113 /// Any key to sign lacks a valid MAC. Maps to `STATUS_INVALID_MAC`.
114 InvalidMac,
Alice Wangf7c0f942023-09-14 09:33:04 +0000115
116 /// No payload found in a key to sign.
117 KeyToSignHasEmptyPayload,
118
119 /// An error happened when serializing to/from a `Value`.
120 CborValueError,
Alice Wanga2738b72023-09-22 15:31:28 +0000121
122 /// The DICE chain of the service VM is missing.
123 MissingDiceChain,
Alice Wang9aeb4062023-10-30 14:19:38 +0000124
125 /// Failed to decrypt the remotely provisioned key blob.
126 FailedToDecryptKeyBlob,
127
128 /// The requested operation has not been implemented.
129 OperationUnimplemented,
Alice Wang20b8ebc2023-11-17 09:54:47 +0000130
131 /// An error happened during the DER encoding/decoding.
132 DerError,
Alice Wangd3a96402023-11-24 15:37:39 +0000133
134 /// The DICE chain from the client VM is invalid.
135 InvalidDiceChain,
Alice Wangd80e99e2023-09-15 13:26:01 +0000136}
137
138impl fmt::Display for RequestProcessingError {
139 fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
140 match self {
Alice Wangc8f88f52023-09-25 14:02:17 +0000141 Self::BoringSslError(e) => {
142 write!(f, "An error happened during the interaction with BoringSSL: {e}")
Alice Wangd80e99e2023-09-15 13:26:01 +0000143 }
144 Self::CosetError => write!(f, "Encountered an error with coset"),
Alice Wang6bc2a702023-09-22 12:42:13 +0000145 Self::InternalError => write!(f, "An unexpected internal error occurred"),
Alice Wangd80e99e2023-09-15 13:26:01 +0000146 Self::InvalidMac => write!(f, "A key to sign lacks a valid MAC."),
Alice Wangf7c0f942023-09-14 09:33:04 +0000147 Self::KeyToSignHasEmptyPayload => write!(f, "No payload found in a key to sign."),
148 Self::CborValueError => {
149 write!(f, "An error happened when serializing to/from a CBOR Value.")
150 }
Alice Wanga2738b72023-09-22 15:31:28 +0000151 Self::MissingDiceChain => write!(f, "The DICE chain of the service VM is missing"),
Alice Wang9aeb4062023-10-30 14:19:38 +0000152 Self::FailedToDecryptKeyBlob => {
153 write!(f, "Failed to decrypt the remotely provisioned key blob")
154 }
155 Self::OperationUnimplemented => {
156 write!(f, "The requested operation has not been implemented")
157 }
Alice Wang20b8ebc2023-11-17 09:54:47 +0000158 Self::DerError => {
159 write!(f, "An error happened during the DER encoding/decoding")
160 }
Alice Wangd3a96402023-11-24 15:37:39 +0000161 Self::InvalidDiceChain => {
162 write!(f, "The DICE chain from the client VM is invalid")
163 }
Alice Wangd80e99e2023-09-15 13:26:01 +0000164 }
165 }
166}
167
Alice Wangc8f88f52023-09-25 14:02:17 +0000168impl From<bssl_avf_error::Error> for RequestProcessingError {
169 fn from(e: bssl_avf_error::Error) -> Self {
170 Self::BoringSslError(e)
171 }
172}
173
Alice Wangd80e99e2023-09-15 13:26:01 +0000174impl From<coset::CoseError> for RequestProcessingError {
175 fn from(e: coset::CoseError) -> Self {
176 error!("Coset error: {e}");
177 Self::CosetError
178 }
Alice Wang464e4732023-09-06 12:25:22 +0000179}
180
Alice Wangf7c0f942023-09-14 09:33:04 +0000181impl From<ciborium::value::Error> for RequestProcessingError {
182 fn from(e: ciborium::value::Error) -> Self {
183 error!("CborValueError: {e}");
184 Self::CborValueError
185 }
186}
187
Alice Wang20b8ebc2023-11-17 09:54:47 +0000188#[cfg(not(feature = "std"))]
189impl From<der::Error> for RequestProcessingError {
190 fn from(e: der::Error) -> Self {
191 error!("DER encoding/decoding error: {e}");
192 Self::DerError
193 }
194}
195
Alice Wang464e4732023-09-06 12:25:22 +0000196/// Represents the params passed to GenerateCertificateRequest
197#[derive(Clone, Debug, Serialize, Deserialize)]
198pub struct GenerateCertificateRequestParams {
199 /// Contains the set of keys to certify.
200 pub keys_to_sign: Vec<MacedPublicKey>,
201
202 /// challenge contains a byte strong from the provisioning server which will be
203 /// included in the signed data of the CSR structure.
204 /// The supported sizes is between 0 and 64 bytes, inclusive.
205 pub challenge: Vec<u8>,
Alice Wang33f4cae2023-09-05 09:27:39 +0000206}
207
208/// Represents an ECDSA P-256 key pair.
209#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
210pub struct EcdsaP256KeyPair {
211 /// Contains a CBOR-encoded public key specified in:
212 ///
213 /// hardware/interfaces/security/rkp/aidl/android/hardware/security/keymint/MacedPublicKey.aidl
Alice Wang464e4732023-09-06 12:25:22 +0000214 pub maced_public_key: MacedPublicKey,
Alice Wang33f4cae2023-09-05 09:27:39 +0000215
216 /// Contains a handle to the private key.
217 pub key_blob: Vec<u8>,
Alice Wang748b0322023-07-24 12:51:18 +0000218}