Skip to content

Commit 3493d02

Browse files
authored
Merge branch 'google:main' into main
2 parents 71092b7 + b71451e commit 3493d02

File tree

6 files changed

+418
-0
lines changed

6 files changed

+418
-0
lines changed

keymanager/km_common/Cargo.toml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@ memmap2 = "0.9.9"
99
prost = "0.13"
1010
uuid = { version = "1.20.0", features = ["v4", "serde"] }
1111
zeroize = { version = "1.8.2", features = ["derive"] }
12+
thiserror = "2.0"
13+
bssl-crypto = { path = "../third_party/bssl-crypto" }
14+
clear_on_drop = "0.2"
15+
16+
[dev-dependencies]
17+
hex = "0.4"
1218

1319
[build-dependencies]
1420
prost-build = "0.13"
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[package]
2+
name = "bssl-crypto"
3+
version = "0.2.0"
4+
edition = "2021"
5+
publish = false
6+
license = "Apache-2.0"
7+
8+
[lib]
9+
path = "../../boringssl/rust/bssl-crypto/src/lib.rs"
10+
11+
[dependencies]
12+
bssl-sys = { path = "../bssl-sys" }
13+
14+
[features]
15+
default = []
16+
# `std` depends on the Rust `std` crate, but adds some useful trait impls if
17+
# available.
18+
std = []
19+
# `mlalgs` enables ML-KEM and ML-DSA support. This requires Rust 1.82.
20+
mlalgs = []
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[package]
2+
name = "bssl-sys"
3+
version = "0.1.0"
4+
edition = "2018"
5+
publish = false
6+
license = "Apache-2.0"
7+
8+
# This exists to workaround a limitation in cargo:
9+
# https://github.com/rust-lang/cargo/issues/3544
10+
links = "bssl"
11+
12+
[lints.rust]
13+
unexpected_cfgs = { level = "warn", check-cfg = ['cfg(bindgen_rs_file)'] }
14+
15+
[lib]
16+
path = "../../boringssl/rust/bssl-sys/src/lib.rs"
17+
18+
[build-dependencies]
19+
cmake = "0.1"
20+
Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
// Copyright 2021 The BoringSSL Authors
2+
// FORKED FROM upstream BoringSSL. Modified to include implicit cmake build via cmake crate.
3+
//
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
//
8+
// https://www.apache.org/licenses/LICENSE-2.0
9+
//
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
16+
use std::env;
17+
use std::path::Path;
18+
use std::process::Command;
19+
20+
// Keep in sync with the list in include/openssl/opensslconf.h
21+
const OSSL_CONF_DEFINES: &[&str] = &[
22+
"OPENSSL_NO_ASYNC",
23+
"OPENSSL_NO_BF",
24+
"OPENSSL_NO_BLAKE2",
25+
"OPENSSL_NO_BUF_FREELISTS",
26+
"OPENSSL_NO_CAMELLIA",
27+
"OPENSSL_NO_CAPIENG",
28+
"OPENSSL_NO_CAST",
29+
"OPENSSL_NO_CMS",
30+
"OPENSSL_NO_COMP",
31+
"OPENSSL_NO_CT",
32+
"OPENSSL_NO_DANE",
33+
"OPENSSL_NO_DEPRECATED",
34+
"OPENSSL_NO_DGRAM",
35+
"OPENSSL_NO_DYNAMIC_ENGINE",
36+
"OPENSSL_NO_EC_NISTP_64_GCC_128",
37+
"OPENSSL_NO_EC2M",
38+
"OPENSSL_NO_EGD",
39+
"OPENSSL_NO_ENGINE",
40+
"OPENSSL_NO_GMP",
41+
"OPENSSL_NO_GOST",
42+
"OPENSSL_NO_HEARTBEATS",
43+
"OPENSSL_NO_HW",
44+
"OPENSSL_NO_IDEA",
45+
"OPENSSL_NO_JPAKE",
46+
"OPENSSL_NO_KRB5",
47+
"OPENSSL_NO_MD2",
48+
"OPENSSL_NO_MDC2",
49+
"OPENSSL_NO_OCB",
50+
"OPENSSL_NO_OCSP",
51+
"OPENSSL_NO_RC2",
52+
"OPENSSL_NO_RC5",
53+
"OPENSSL_NO_RFC3779",
54+
"OPENSSL_NO_RIPEMD",
55+
"OPENSSL_NO_RMD160",
56+
"OPENSSL_NO_SCTP",
57+
"OPENSSL_NO_SEED",
58+
"OPENSSL_NO_SM2",
59+
"OPENSSL_NO_SM3",
60+
"OPENSSL_NO_SM4",
61+
"OPENSSL_NO_SRP",
62+
"OPENSSL_NO_SSL_TRACE",
63+
"OPENSSL_NO_SSL2",
64+
"OPENSSL_NO_SSL3",
65+
"OPENSSL_NO_SSL3_METHOD",
66+
"OPENSSL_NO_STATIC_ENGINE",
67+
"OPENSSL_NO_STORE",
68+
"OPENSSL_NO_WHIRLPOOL",
69+
];
70+
71+
fn get_cpp_runtime_lib() -> Option<String> {
72+
println!("cargo:rerun-if-env-changed=BORINGSSL_RUST_CPPLIB");
73+
74+
if let Ok(cpp_lib) = env::var("BORINGSSL_RUST_CPPLIB") {
75+
return Some(cpp_lib);
76+
}
77+
78+
if env::var_os("CARGO_CFG_UNIX").is_some() {
79+
match env::var("CARGO_CFG_TARGET_OS").unwrap().as_ref() {
80+
"macos" => Some("c++".into()),
81+
_ => Some("stdc++".into()),
82+
}
83+
} else {
84+
None
85+
}
86+
}
87+
88+
fn main() {
89+
let target = env::var("TARGET").unwrap();
90+
let out_dir = env::var("OUT_DIR").unwrap();
91+
let manifest_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
92+
93+
// Locate the BoringSSL source relative to this cargo manifest
94+
// keymanager/third_party/bssl-sys -> keymanager/boringssl
95+
let bssl_source_dir = Path::new(&manifest_dir).join("../../boringssl");
96+
97+
// Auto-init git submodule if BoringSSL source is missing.
98+
if !bssl_source_dir.join("CMakeLists.txt").exists() {
99+
let _ = Command::new("git")
100+
.args(["submodule", "update", "--init", "--recursive", "boringssl"])
101+
.current_dir(Path::new(&manifest_dir).join("../.."))
102+
.status();
103+
}
104+
105+
if !bssl_source_dir.join("CMakeLists.txt").exists() {
106+
panic!(
107+
"BoringSSL source not found at {}. Run 'git submodule update --init --recursive'",
108+
bssl_source_dir.display()
109+
);
110+
}
111+
112+
// Rebuild when the BoringSSL source tree changes (e.g. submodule update).
113+
// Cargo 1.50+ recursively scans directories for mtime changes.
114+
println!("cargo:rerun-if-changed={}", bssl_source_dir.display());
115+
116+
// Use cmake crate to build BoringSSL.
117+
// The cmake crate itself panics with a diagnostic "is `cmake` not installed?"
118+
// message if cmake is not found, so no pre-check is needed (standard practice
119+
// per cmake-rs, libz-sys, and other sys crates).
120+
let dst = cmake::Config::new(&bssl_source_dir)
121+
.define("RUST_BINDINGS", &target)
122+
.build_target("bssl_sys") // We specifically want this target which generates bindings
123+
.build();
124+
125+
// The cmake crate installs artifacts to `dst`.
126+
// However, BoringSSL's internal structure when built might be different.
127+
// Usually artifacts are in `dst/build` if we didn't install, but `cmake` crate defaults to install.
128+
// BoringSSL install target puts libs in `lib/` and includes in `include/`.
129+
// BUT `bssl_sys` target might not install the wrapper?
130+
// Let's verify where `cmake` crate puts it. It usually puts build artifacts in `build/`.
131+
132+
// cmake::Config::build() guarantees this path exists on success (it
133+
// panics on failure), but assert for clarity since the layout matters.
134+
let build_dir = dst.join("build");
135+
assert!(
136+
build_dir.exists(),
137+
"Expected cmake build directory not found at {}. This is a bug in the build script.",
138+
build_dir.display()
139+
);
140+
141+
// Link Search Paths
142+
// Note: We might need to look in `dst/lib` if it was installed, or `build_dir` if not.
143+
// BoringSSL puts static libs in the top level of build dir usually, or `crypto/` `ssl/` subdirs.
144+
// Let's add multiple search paths to be safe, similar to original script logic but adapted.
145+
146+
println!("cargo:rustc-link-search=native={}", build_dir.display());
147+
println!(
148+
"cargo:rustc-link-search=native={}/crypto",
149+
build_dir.display()
150+
);
151+
println!("cargo:rustc-link-search=native={}/ssl", build_dir.display());
152+
println!(
153+
"cargo:rustc-link-search=native={}/rust/bssl-sys",
154+
build_dir.display()
155+
);
156+
157+
// Also check `dst/lib` just in case `cmake` crate installed them there
158+
println!("cargo:rustc-link-search=native={}/lib", dst.display());
159+
160+
// Link Libraries
161+
println!("cargo:rustc-link-lib=static=crypto");
162+
println!("cargo:rustc-link-lib=static=ssl");
163+
println!("cargo:rustc-link-lib=static=rust_wrapper");
164+
165+
if let Some(cpp_lib) = get_cpp_runtime_lib() {
166+
println!("cargo:rustc-link-lib={}", cpp_lib);
167+
}
168+
169+
println!("cargo:conf={}", OSSL_CONF_DEFINES.join(","));
170+
171+
// Generate/Copy Bindings
172+
// The `bssl_sys` target generates `wrapper_{target}.rs` in `rust/bssl-sys` inside build dir.
173+
let bssl_sys_build_dir = build_dir.join("rust/bssl-sys");
174+
let bindgen_source_file = bssl_sys_build_dir.join(format!("wrapper_{}.rs", target));
175+
176+
// We also need the prefix header from source
177+
let prefix_inc_source_file =
178+
bssl_source_dir.join("rust/bssl-sys/boringssl_prefix_symbols_bindgen.rs.in");
179+
180+
let bindgen_out_file = Path::new(&out_dir).join("bindgen.rs");
181+
182+
let bindgen_source = std::fs::read_to_string(&bindgen_source_file).expect(&format!(
183+
"Could not read bindings from '{}'. Did the build fail?",
184+
bindgen_source_file.display(),
185+
));
186+
187+
println!("cargo:rerun-if-changed={}", bindgen_source_file.display());
188+
189+
let prefix_source = match env::var("BORINGSSL_PREFIX") {
190+
Ok(prefix) => std::fs::read_to_string(&prefix_inc_source_file)
191+
.expect(&format!(
192+
"Could not read prefixing data from '{}'",
193+
prefix_inc_source_file.display(),
194+
))
195+
.replace("${BORINGSSL_PREFIX}", prefix.as_str()),
196+
Err(env::VarError::NotPresent) => "".to_string(),
197+
Err(e) => panic!("failed to read BORINGSSL_PREFIX variable: {}", e),
198+
};
199+
200+
std::fs::write(
201+
&bindgen_out_file,
202+
format!("{}{}", bindgen_source, prefix_source),
203+
)
204+
.expect(&format!(
205+
"Could not write bindings to '{}'",
206+
bindgen_out_file.display()
207+
));
208+
209+
println!(
210+
"cargo:rerun-if-changed={}",
211+
prefix_inc_source_file.display()
212+
);
213+
println!("cargo:rerun-if-env-changed=BORINGSSL_PREFIX");
214+
}
Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
// Package models contains structs for Confidential VM attestation.
2+
package models
3+
4+
import (
5+
attestpb "github.com/google/go-tpm-tools/proto/attest"
6+
)
7+
8+
// VMAttestation represents a standalone attestation over a challenge provided by the workload.
9+
type VMAttestation struct {
10+
// Label provided by the attesting entity. For Confidential Space, this shall be "WORKLOAD_ATTESTATION".
11+
Label []byte `json:"label"`
12+
13+
// Challenge provided by the workload.
14+
Challenge []byte `json:"challenge"`
15+
16+
// Optional, provided by WSD.
17+
ExtraData []byte `json:"extra_data,omitempty"`
18+
19+
// Quote from the CVM.
20+
Quote *VMAttestationQuote `json:"vm_attestation_quote"`
21+
22+
// Attestation reports for attached devices.
23+
DeviceReports []DeviceAttestationReport `json:"device_reports,omitempty"`
24+
}
25+
26+
// VMAttestationQuote represents a quote from a Confidential VM.
27+
type VMAttestationQuote struct {
28+
// A TDX with CCEL and RTMR Attestation Quote.
29+
TDXCCELQuote *TDXCCELQuote `json:"tdx_ccel_quote,omitempty"`
30+
31+
// A vTPM Attestation Quote.
32+
// TODO: Fork the definition of attestpb.Attestation to here.
33+
VTPMAttestation *attestpb.Attestation `json:"vtpm_attestation,omitempty"`
34+
}
35+
36+
// TDXCCELQuote represents a TDX attestation with CCEL event logs.
37+
type TDXCCELQuote struct {
38+
// The CCEL event log. Formatted as described in the UEFI 2.10.
39+
// Contains events for guest OS boot.
40+
CCELBootEventLog []byte `json:"ccel_boot_event_log"`
41+
42+
// Formatted as a Canonical Event Log.
43+
// The event log containing Attested COS launcher events.
44+
CELLaunchEventLog []byte `json:"cel_launch_event_log"`
45+
46+
// The TDX attestation quote.
47+
TDQuote []byte `json:"td_quote"`
48+
}
49+
50+
// DeviceAttestationReport represents an attestation report from a device.
51+
// TODO: Define this.
52+
type DeviceAttestationReport struct {
53+
}

0 commit comments

Comments
 (0)