-
Notifications
You must be signed in to change notification settings - Fork 98
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
In both AA and CDH there is logic to retrieve aa_kbc_params through various means. This change moves all related logic into a single place to guarantee consistency and make it easier to iterate on the way we retrieve aa_kbc_params (it is expected that the current approaches will be replaced by init_data in some fashion). Besides kernel cmdline and kata-agent config a third option that takes precedence over the other approaches has been added. This will help with testing, so we don't need to rely on the peerpod detection heurstic for that. A dependency to `attestation_agent` has been added to the CDH/KMS project to gain access to AA's `aa_kbc_params` module. I think this dependency is warranted, since this code is already coupled to AA implicitly (by depending on aa_kbc_params). Signed-off-by: Magnus Kulke <[email protected]>
- Loading branch information
Showing
9 changed files
with
135 additions
and
153 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| use log::debug; | ||
| use serde::Deserialize; | ||
| use std::convert::TryFrom; | ||
| use std::env; | ||
| use std::path::Path; | ||
| use std::sync::OnceLock; | ||
| use thiserror::Error; | ||
| use tokio::fs; | ||
|
|
||
| const PEER_POD_CONFIG_PATH: &str = "/run/peerpod/daemon.json"; | ||
| static KATA_AGENT_CONFIG_PATH: OnceLock<String> = OnceLock::new(); | ||
| static AA_KBC_PARAMS: OnceLock<Option<String>> = OnceLock::new(); | ||
|
|
||
| #[derive(Error, Debug)] | ||
| pub enum ParamError { | ||
| #[error("ohai")] | ||
| Ohai, | ||
| #[error("illegal aa_kbc_params format: {0}")] | ||
| IllegalFormat(String), | ||
| #[error("unable to read `aa_kbc_params` entry from kata-agent config file")] | ||
| AgentConfigParsing(#[from] toml::de::Error), | ||
| #[error("io error")] | ||
| Io(#[from] std::io::Error), | ||
| #[error("no `agent.aa_kbc_params` provided in kernel commandline")] | ||
| MissingInCmdline, | ||
| } | ||
|
|
||
| pub struct AaKbcParams { | ||
| kbc: String, | ||
| uri: String, | ||
| } | ||
|
|
||
| impl AaKbcParams { | ||
| pub fn kbc(&self) -> &str { | ||
| &self.kbc | ||
| } | ||
|
|
||
| pub fn uri(&self) -> &str { | ||
| &self.uri | ||
| } | ||
| } | ||
|
|
||
| impl TryFrom<String> for AaKbcParams { | ||
| type Error = ParamError; | ||
|
|
||
| fn try_from(value: String) -> Result<Self, ParamError> { | ||
| let segments: Vec<&str> = value.split("::").collect(); | ||
|
|
||
| if segments.len() != 2 { | ||
| return Err(ParamError::IllegalFormat(value)); | ||
| } | ||
|
|
||
| let params = AaKbcParams { | ||
| kbc: segments[0].into(), | ||
| uri: segments[1].into(), | ||
| }; | ||
|
|
||
| Ok(params) | ||
| } | ||
| } | ||
|
|
||
| async fn get_value() -> Result<String, ParamError> { | ||
| // first check env | ||
| if let Some(value) = AA_KBC_PARAMS.get_or_init(|| env::var("AA_KBC_PARAMS").ok()) { | ||
| debug!("get aa_kbc_params from env"); | ||
| return Ok(value.clone()); | ||
| } | ||
| // then whether we are in a peer pod | ||
| if Path::new(PEER_POD_CONFIG_PATH).exists() { | ||
| return from_config_file().await; | ||
| } | ||
| // finally use the kernel cmdline | ||
| from_cmdline().await | ||
| } | ||
|
|
||
| pub async fn get_params() -> Result<AaKbcParams, ParamError> { | ||
| let value = get_value().await?; | ||
| value.try_into() | ||
| } | ||
|
|
||
| // We only care about the aa_kbc_params value at the moment | ||
| #[derive(Debug, Deserialize)] | ||
| struct AgentConfig { | ||
| aa_kbc_params: String, | ||
| } | ||
|
|
||
| async fn from_config_file() -> Result<String, ParamError> { | ||
| debug!("get aa_kbc_params from file"); | ||
|
|
||
| // check env for KATA_AGENT_CONFIG_PATH, fall back to default path | ||
| let path: &String = KATA_AGENT_CONFIG_PATH.get_or_init(|| { | ||
| env::var("KATA_AGENT_CONFIG_PATH").unwrap_or_else(|_| "/etc/agent-config.toml".into()) | ||
| }); | ||
|
|
||
| debug!("reading agent config from {}", path); | ||
| let agent_config_str = std::fs::read_to_string(path)?; | ||
|
|
||
| let agent_config: AgentConfig = toml::from_str(&agent_config_str)?; | ||
|
|
||
| Ok(agent_config.aa_kbc_params) | ||
| } | ||
|
|
||
| async fn from_cmdline() -> Result<String, ParamError> { | ||
| debug!("get aa_kbc_params from kernel cmdline"); | ||
| let cmdline = fs::read_to_string("/proc/cmdline").await?; | ||
| let value = cmdline | ||
| .split_ascii_whitespace() | ||
| .find(|para| para.starts_with("agent.aa_kbc_params=")) | ||
| .ok_or(ParamError::MissingInCmdline)? | ||
| .strip_prefix("agent.aa_kbc_params=") | ||
| .expect("must have a prefix"); | ||
| Ok(value.into()) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters