runtime-sdk: Add provider-related endorsement constraints

Author: kostko

Cargo.lock

@@ -23,6 +23,7 @@ use oasis_runtime_sdk::{
 };
 use oasis_runtime_sdk_rofl_market::{
     self as market,
+    policy::{ProviderLabel, LABEL_PROVIDER},
     types::{Deployment, Instance, InstanceId, InstanceStatus},
 };
 use rand::Rng;
@@ -990,6 +991,13 @@ impl Manager {
             deployment_hash(deployment),
         );
 
+        let provider_label = ProviderLabel {
+            provider: self.cfg.provider_address,
+            instance: instance.id,
+        };
+        let provider_label = BASE64_STANDARD.encode(cbor::to_vec(provider_label));
+        labels.insert(LABEL_PROVIDER.to_string(), provider_label);
+
         let _ = self
             .env
             .host()

rofl-scheduler/src/manager.rs

@@ -13,6 +13,7 @@ oasis-runtime-sdk-evm = { path = "../evm" }
 
 # Third party.
 anyhow = "1.0"
+base64 = "0.22.1"
 ethabi = { version = "18.0.0", default-features = false, features = ["std"] }
 once_cell = "1.8.0"
 rustc-hex = "2.0.1"

runtime-sdk/modules/rofl-market/Cargo.toml

@@ -16,6 +16,7 @@ mod config;
 mod error;
 mod event;
 mod payment;
+pub mod policy;
 pub mod state;
 #[cfg(test)]
 mod test;

runtime-sdk/modules/rofl-market/src/lib.rs

@@ -0,0 +1,123 @@
+use std::collections::BTreeMap;
+
+use base64::prelude::*;
+
+use oasis_runtime_sdk::{
+    core::{
+        common::crypto::signature::{PublicKey, Signature},
+        consensus::registry::{EndorsedCapabilityTEE, Node},
+        host::attestation::{LabelAttestation, ATTEST_LABELS_SIGNATURE_CONTEXT},
+    },
+    modules::rofl::{
+        policy::{AllowedEndorsement, EndorsementPolicyEvaluator},
+        Error,
+    },
+    types::address::Address,
+    Context,
+};
+
+use crate::{state, types::InstanceId};
+
+/// Name of the ROFL app instance metadata key used to store the provider attestation.
+const METADATA_KEY_POLICY_PROVIDER_ATTESTATION: &str = "net.oasis.policy.provider";
+/// Name of the provider label set by the scheduler.
+pub const LABEL_PROVIDER: &str = "net.oasis.provider";
+
+/// Value of the `LABEL_PROVIDER` label as set by the scheduler.
+#[derive(Clone, Debug, Default, cbor::Encode, cbor::Decode)]
+pub struct ProviderLabel {
+    /// Address of the provider.
+    pub provider: Address,
+    /// Instance identifier.
+    pub instance: InstanceId,
+}
+
+/// Provider attestation metadata stored in `METADATA_KEY_POLICY_PROVIDER_ATTESTATION` label.
+#[derive(Clone, Debug, Default, cbor::Encode, cbor::Decode)]
+pub struct ProviderAttestation {
+    /// A CBOR-serialized `LabelAttestation`.
+    pub label_attestation: Vec<u8>,
+    /// Signature from endorsing node.
+    pub signature: Signature,
+}
+
+/// An endorsement policy evaluator that supports provider-related constraints via lookups
+/// in ROFL market module state.
+pub struct ProviderEndorsementPolicyEvaluator;
+
+impl EndorsementPolicyEvaluator for ProviderEndorsementPolicyEvaluator {
+    fn verify_atom<C: Context>(
+        _ctx: &C,
+        policy: &AllowedEndorsement,
+        ect: &EndorsedCapabilityTEE,
+        endorsing_node_id: PublicKey,
+        _endorsing_node: &Option<Node>,
+        metadata: &BTreeMap<String, String>,
+    ) -> Result<(), Error> {
+        match policy {
+            AllowedEndorsement::Provider(address) => {
+                // Check if the endorsing node is endorsed by the given provider.
+                let provider = state::get_provider(*address).ok_or(Error::NodeNotAllowed)?;
+                if !provider.nodes.contains(&endorsing_node_id) {
+                    return Err(Error::NodeNotAllowed);
+                }
+                Ok(())
+            }
+            AllowedEndorsement::ProviderMachineAdmin(expected_admin) => {
+                let pa: ProviderAttestation = cbor::from_slice(
+                    &BASE64_STANDARD
+                        .decode(
+                            metadata
+                                .get(METADATA_KEY_POLICY_PROVIDER_ATTESTATION)
+                                .ok_or(Error::NodeNotAllowed)?,
+                        )
+                        .map_err(|_| Error::NodeNotAllowed)?,
+                )
+                .map_err(|_| Error::NodeNotAllowed)?;
+
+                // Verify node label attestation.
+                pa.signature
+                    .verify(
+                        &endorsing_node_id,
+                        ATTEST_LABELS_SIGNATURE_CONTEXT,
+                        &pa.label_attestation,
+                    )
+                    .map_err(|_| Error::NodeNotAllowed)?;
+                let label_attestation: LabelAttestation =
+                    cbor::from_slice(&pa.label_attestation).map_err(|_| Error::NodeNotAllowed)?;
+                if label_attestation.rak != ect.capability_tee.rak {
+                    return Err(Error::NodeNotAllowed);
+                }
+
+                // Extract provider label (set by the provider's scheduler).
+                let provider_label: ProviderLabel = cbor::from_slice(
+                    &BASE64_STANDARD
+                        .decode(
+                            label_attestation
+                                .labels
+                                .get(LABEL_PROVIDER)
+                                .ok_or(Error::NodeNotAllowed)?,
+                        )
+                        .map_err(|_| Error::NodeNotAllowed)?,
+                )
+                .map_err(|_| Error::NodeNotAllowed)?;
+
+                let provider =
+                    state::get_provider(provider_label.provider).ok_or(Error::NodeNotAllowed)?;
+                if !provider.nodes.contains(&endorsing_node_id) {
+                    return Err(Error::NodeNotAllowed);
+                }
+
+                let instance =
+                    state::get_instance(provider_label.provider, provider_label.instance)
+                        .ok_or(Error::NodeNotAllowed)?;
+                if &instance.admin != expected_admin {
+                    return Err(Error::NodeNotAllowed);
+                }
+
+                Ok(())
+            }
+            _ => Err(Error::NodeNotAllowed),
+        }
+    }
+}

runtime-sdk/modules/rofl-market/src/policy.rs

@@ -23,7 +23,9 @@ struct Config;
 
 impl core::Config for Config {}
 
-impl rofl::Config for Config {}
+impl rofl::Config for Config {
+    type EndorsementPolicyEvaluator = rofl::policy::BasicEndorsementPolicyEvaluator;
+}
 
 impl super::Config for Config {
     type Rofl = rofl::Module<Config>;

runtime-sdk/modules/rofl-market/src/test.rs

@@ -1,14 +1,16 @@
-use std::{sync::Arc, time::Duration};
+use std::{collections::BTreeMap, sync::Arc, time::Duration};
 
 use anyhow::{anyhow, Result};
+use base64::{prelude::BASE64_STANDARD, Engine};
 use tokio::sync::mpsc;
 
 use crate::{
     core::{
-        common::logger::get_logger,
+        common::{crypto::signature::Signature, logger::get_logger},
         consensus::{
             beacon::EpochTime, state::beacon::ImmutableState as BeaconState, verifier::Verifier,
         },
+        host::attestation::{AttestLabelsRequest, LabelAttestation},
     },
     modules::rofl::types::{AppInstanceQuery, Register, Registration},
 };
@@ -134,7 +136,7 @@ where
             "epoch" => epoch,
         );
 
-        let metadata = match self.state.app.clone().get_metadata(self.env.clone()).await {
+        let mut metadata = match self.state.app.clone().get_metadata(self.env.clone()).await {
             Ok(metadata) => metadata,
             Err(err) => {
                 slog::error!(self.logger, "failed to get instance metadata"; "err" => ?err);
@@ -143,6 +145,11 @@ where
             }
         };
 
+        // Include provider-specific metadata if available.
+        if let Err(err) = self.collect_provider_metadata(&mut metadata).await {
+            slog::error!(self.logger, "failed to collect provider metadata"; "err" => ?err);
+        }
+
         // Refresh registration.
         let ect = self
             .state
@@ -191,4 +198,49 @@ where
 
         Ok(())
     }
+
+    async fn collect_provider_metadata(
+        &self,
+        metadata: &mut BTreeMap<String, String>,
+    ) -> Result<()> {
+        let rsp = self
+            .env
+            .host()
+            .attestation()
+            .attest_labels(AttestLabelsRequest {
+                labels: vec![LABEL_PROVIDER.to_string()],
+            })
+            .await?;
+
+        // Decode the attestation to check if the provider label is set and skip setting
+        // metadata in case it is not.
+        let la: LabelAttestation = cbor::from_slice(&rsp.attestation)?;
+        if la.labels.get(LABEL_PROVIDER) == Some(&String::new()) {
+            return Ok(());
+        }
+
+        let pa = ProviderAttestation {
+            label_attestation: rsp.attestation,
+            signature: rsp.signature,
+        };
+
+        let pa = BASE64_STANDARD.encode(cbor::to_vec(pa));
+        metadata.insert(METADATA_KEY_POLICY_PROVIDER_ATTESTATION.to_string(), pa);
+
+        Ok(())
+    }
+}
+
+/// Name of the ROFL app instance metadata key used to store the provider attestation.
+const METADATA_KEY_POLICY_PROVIDER_ATTESTATION: &str = "net.oasis.policy.provider";
+/// Name of the provider label set by the scheduler.
+const LABEL_PROVIDER: &str = "net.oasis.provider";
+
+/// Provider attestation metadata stored in `METADATA_KEY_POLICY_PROVIDER_ATTESTATION` label.
+#[derive(Clone, Debug, Default, cbor::Encode, cbor::Decode)]
+struct ProviderAttestation {
+    /// A CBOR-serialized `LabelAttestation`.
+    pub label_attestation: Vec<u8>,
+    /// Signature from endorsing node.
+    pub signature: Signature,
 }

runtime-sdk/src/modules/rofl/app/registration.rs

@@ -1,5 +1,7 @@
 use crate::types::token;
 
+use super::policy::EndorsementPolicyEvaluator;
+
 /// Module configuration.
 pub trait Config: 'static {
     /// Gas cost of rofl.Create call.
@@ -37,4 +39,10 @@ pub trait Config: 'static {
 
     /// Maximum key identifier length for rofl.DeriveKey call.
     const DERIVE_KEY_MAX_KEY_ID_LENGTH: usize = 128;
+
+    /// Maximum number of endorsment policy atoms.
+    const MAX_ENDORSEMENT_POLICY_ATOMS: usize = 32;
+
+    /// Endorsement policy evaluator.
+    type EndorsementPolicyEvaluator: EndorsementPolicyEvaluator;
 }