[dice] Move bcc_main_flow to the library libdiced_open_dice
This cl splits the existing BccMainFlow wrapper with retries
into a raw version and a retry version. The former is
available in both std and nostd environment. The latter
returns a ZerorizeOnDrop struct containing Attestation CDI
and Sealing CDI. This struct is going to replace the
`DiceContext` in microdroid as it is sets all the CDIs to
zero when the struct goes out of scope, which is more secure.
This is part of the project of merging the two existing dice
wrapper libraries into one library libdiced_open_dice.
Test: atest diced_utils_test diced_sample_inputs_test \
diced_test diced_vendor_test diced_open_dice_cbor_test
Test: m pvmfw_img microdroid_manager && atest \
microdroid_manager_test
Bug: 267575445
Change-Id: I94444619fe2dcddf8541a6c9971c7e565c44dda1
diff --git a/diced/src/hal_node.rs b/diced/src/hal_node.rs
index 1efee8b..ca470e5 100644
--- a/diced/src/hal_node.rs
+++ b/diced/src/hal_node.rs
@@ -343,6 +343,16 @@
bcc: Vec<u8>,
}
+ impl From<dice::OwnedDiceArtifacts> for InsecureSerializableArtifacts {
+ fn from(dice_artifacts: dice::OwnedDiceArtifacts) -> Self {
+ Self {
+ cdi_attest: dice_artifacts.cdi_values.cdi_attest,
+ cdi_seal: dice_artifacts.cdi_values.cdi_seal,
+ bcc: dice_artifacts.bcc[..].to_vec(),
+ }
+ }
+ }
+
impl DiceArtifacts for InsecureSerializableArtifacts {
fn cdi_attest(&self) -> &[u8; dice::CDI_SIZE] {
&self.cdi_attest
@@ -394,10 +404,8 @@
/// Test the resident artifact batched derivation in process.
#[test]
fn derive_with_resident_artifacts() -> Result<()> {
- let (cdi_attest, cdi_seal, bcc) = diced_sample_inputs::make_sample_bcc_and_cdis()?;
-
- let artifacts =
- ResidentArtifacts::new(cdi_attest[..].try_into()?, cdi_seal[..].try_into()?, &bcc)?;
+ let artifacts: ResidentArtifacts =
+ diced_sample_inputs::make_sample_bcc_and_cdis()?.try_into()?;
let input_values = &[
make_input_values(
@@ -433,18 +441,13 @@
/// the same test vector as the in process test above.
#[test]
fn derive_with_insecure_artifacts() -> Result<()> {
- let (cdi_attest, cdi_seal, bcc) = diced_sample_inputs::make_sample_bcc_and_cdis()?;
+ let dice_artifacts = diced_sample_inputs::make_sample_bcc_and_cdis()?;
// Safety: ResidentHal can only be used in single threaded environments.
// On-device Rust tests run each test in a separate process.
- let hal_impl = unsafe {
- ResidentHal::new(InsecureSerializableArtifacts {
- cdi_attest: cdi_attest[..].try_into()?,
- cdi_seal: cdi_seal[..].try_into()?,
- bcc,
- })
- }
- .expect("Failed to create ResidentHal.");
+ let hal_impl =
+ unsafe { ResidentHal::new(InsecureSerializableArtifacts::from(dice_artifacts)) }
+ .expect("Failed to create ResidentHal.");
let bcc_handover = hal_impl
.derive(&[
@@ -474,18 +477,13 @@
/// must yield the same outcome as three derivations with the same input values.
#[test]
fn demote() -> Result<()> {
- let (cdi_attest, cdi_seal, bcc) = diced_sample_inputs::make_sample_bcc_and_cdis()?;
+ let dice_artifacts = diced_sample_inputs::make_sample_bcc_and_cdis()?;
// Safety: ResidentHal can only be used in single threaded environments.
// On-device Rust tests run each test in a separate process.
- let hal_impl = unsafe {
- ResidentHal::new(InsecureSerializableArtifacts {
- cdi_attest: cdi_attest[..].try_into()?,
- cdi_seal: cdi_seal[..].try_into()?,
- bcc,
- })
- }
- .expect("Failed to create ResidentHal.");
+ let hal_impl =
+ unsafe { ResidentHal::new(InsecureSerializableArtifacts::from(dice_artifacts)) }
+ .expect("Failed to create ResidentHal.");
hal_impl
.demote(&[