AA: add KBS cert support for launch config

Signed-off-by: Xynnn007 <[email protected]>
Xynnn007 · Apr 7, 2024 · 62bc5a6 · 62bc5a6
1 parent 906a727
commit 62bc5a6
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 3 deletions.
diff --git a/attestation-agent/attestation-agent/src/config/kbs.rs b/attestation-agent/attestation-agent/src/config/kbs.rs
@@ -11,6 +11,9 @@ use super::aa_kbc_params;
 pub struct KbsConfig {
     /// URL Address of KBS.
     pub url: String,
+
+    /// Cert of KBS
+    pub cert: Option<String>,
 }
 
 impl Default for KbsConfig {
@@ -19,6 +22,7 @@ impl Default for KbsConfig {
             aa_kbc_params::get_params().expect("No aa_kbc_params specified in kernel cmdline");
         Self {
             url: aa_kbc_params.uri().into(),
+            cert: None,
         }
     }
 }
diff --git a/attestation-agent/attestation-agent/src/token/kbs.rs b/attestation-agent/attestation-agent/src/token/kbs.rs
@@ -20,16 +20,22 @@ struct Message {
 #[derive(Default)]
 pub struct KbsTokenGetter {
     kbs_host_url: String,
+    cert: Option<String>,
 }
 
 #[async_trait]
 impl GetToken for KbsTokenGetter {
     async fn get_token(&self) -> Result<Vec<u8>> {
         let evidence_provider = Box::new(NativeEvidenceProvider::new()?);
 
-        let mut client =
-            KbsClientBuilder::with_evidence_provider(evidence_provider, &self.kbs_host_url)
-                .build()?;
+        let mut builder =
+            KbsClientBuilder::with_evidence_provider(evidence_provider, &self.kbs_host_url);
+
+        if let Some(cert) = &self.cert {
+            builder.add_kbs_cert(cert);
+        }
+
+        let client = builder.build()?;
 
         let (token, tee_keypair) = client.get_token().await?;
         let message = Message {
@@ -46,6 +52,7 @@ impl KbsTokenGetter {
     pub fn new(config: &KbsConfig) -> Self {
         Self {
             kbs_host_url: config.url.clone(),
+            cert: config.cert.clone(),
         }
     }
 }