KBS | Refactoring the codebase / update config file format / bring in plugin mechanism

attestation-service/src/config.rs

@@ -10,7 +10,7 @@ use thiserror::Error;
 const AS_WORK_DIR: &str = "AS_WORK_DIR";
 const DEFAULT_WORK_DIR: &str = "/opt/confidential-containers/attestation-service";
 
-#[derive(Clone, Debug, Deserialize)]
+#[derive(Clone, Debug, Deserialize, PartialEq)]
 pub struct Config {
     /// The location for Attestation Service to store data.
     pub work_dir: PathBuf,
@@ -19,6 +19,7 @@ pub struct Config {
     pub policy_engine: String,
 
     /// Configurations for RVPS.
+    #[serde(default)]
     pub rvps_config: RvpsConfig,
 
     /// The Attestation Result Token Broker type.
@@ -28,6 +29,7 @@ pub struct Config {
     pub attestation_token_broker: AttestationTokenBrokerType,
 
     /// The Attestation Result Token Broker Config
+    #[serde(default)]
     pub attestation_token_config: AttestationTokenConfig,
 }
 

attestation-service/src/lib.rs

@@ -6,9 +6,9 @@
 
 pub mod config;
 pub mod policy_engine;
-mod rvps;
-mod token;
-mod utils;
+pub mod rvps;
+pub mod token;
+pub mod utils;
 
 use crate::token::AttestationTokenBroker;
 

attestation-service/src/rvps/mod.rs

@@ -5,7 +5,9 @@
 
 use anyhow::Result;
 use log::{info, warn};
-use reference_value_provider_service::config::{Config as RvpsCrateConfig, DEFAULT_STORAGE_TYPE};
+pub use reference_value_provider_service::config::{
+    Config as RvpsCrateConfig, DEFAULT_STORAGE_TYPE,
+};
 use serde::Deserialize;
 use serde_json::{json, Value};
 use thiserror::Error;
@@ -38,7 +40,7 @@ fn default_store_config() -> Value {
     json!({})
 }
 
-#[derive(Deserialize, Clone, Debug)]
+#[derive(Deserialize, Clone, Debug, PartialEq)]
 pub struct RvpsConfig {
     /// Address of remote RVPS. If this field is given, a remote RVPS will be connected to.
     /// If this field is not given, a built-in RVPS will be used.

attestation-service/src/token/mod.rs

@@ -6,12 +6,12 @@
 use anyhow::*;
 use serde::Deserialize;
 use serde_json::Value;
-use simple::COCO_AS_ISSUER_NAME;
 use strum::{Display, EnumString};
 
 mod simple;
 
-const DEFAULT_TOKEN_TIMEOUT: i64 = 5;
+pub const COCO_AS_ISSUER_NAME: &str = "CoCo-Attestation-Service";
+pub const DEFAULT_TOKEN_TIMEOUT: i64 = 5;
 
 pub trait AttestationTokenBroker {
     /// Issue an signed attestation token with custom claims.
@@ -23,7 +23,7 @@ pub trait AttestationTokenBroker {
     fn pubkey_jwks(&self) -> Result<String>;
 }
 
-#[derive(Deserialize, Debug, Clone, EnumString, Display)]
+#[derive(Deserialize, Debug, Clone, EnumString, Display, PartialEq)]
 pub enum AttestationTokenBrokerType {
     Simple,
 }
@@ -42,9 +42,10 @@ impl AttestationTokenBrokerType {
     }
 }
 
-#[derive(Deserialize, Debug, Clone)]
+#[derive(Deserialize, Debug, Clone, PartialEq)]
 pub struct AttestationTokenConfig {
     /// The Attestation Result Token duration time(in minute)
+    #[serde(default = "default_duration_min")]
     pub duration_min: i64,
 
     #[serde(default = "default_issuer_name")]
@@ -53,11 +54,15 @@ pub struct AttestationTokenConfig {
     pub signer: Option<TokenSignerConfig>,
 }
 
+fn default_duration_min() -> i64 {
+    DEFAULT_TOKEN_TIMEOUT
+}
+
 fn default_issuer_name() -> String {
     COCO_AS_ISSUER_NAME.to_string()
 }
 
-#[derive(Deserialize, Debug, Clone)]
+#[derive(Deserialize, Debug, Clone, PartialEq)]
 pub struct TokenSignerConfig {
     pub key_path: String,
     pub cert_url: Option<String>,

attestation-service/src/token/simple.rs

@@ -18,7 +18,6 @@ use serde_json::{json, Value};
 
 use crate::token::{AttestationTokenBroker, AttestationTokenConfig};
 
-pub const COCO_AS_ISSUER_NAME: &str = "CoCo-Attestation-Service";
 const RSA_KEY_BITS: u32 = 2048;
 const SIMPLE_TOKEN_ALG: &str = "RS384";
 
@@ -92,6 +91,7 @@ impl AttestationTokenBroker for SimpleAttestationTokenBroker {
         let header_value = json!({
             "typ": "JWT",
             "alg": SIMPLE_TOKEN_ALG,
+            "jwk": serde_json::from_str::<Value>(&self.pubkey_jwks()?)?["keys"][0].clone(),
         });
         let header_string = serde_json::to_string(&header_value)?;
         let header_b64 = URL_SAFE_NO_PAD.encode(header_string.as_bytes());
@@ -109,7 +109,6 @@ impl AttestationTokenBroker for SimpleAttestationTokenBroker {
             "iss": self.config.issuer_name.clone(),
             "iat": now.unix_timestamp(),
             "jti": id,
-            "jwk": serde_json::from_str::<Value>(&self.pubkey_jwks()?)?["keys"][0].clone(),
             "nbf": now.unix_timestamp(),
             "exp": exp.unix_timestamp(),
         })