(self, request: GetAppKeyRequest)
| 293 | |
| 294 | impl KmsRpc for RpcHandler { |
| 295 | async fn get_app_key(self, request: GetAppKeyRequest) -> Result<AppKeyResponse> { |
| 296 | if request.api_version > 1 { |
| 297 | bail!("Unsupported API version: {}", request.api_version); |
| 298 | } |
| 299 | self.ensure_self_allowed() |
| 300 | .await |
| 301 | .context("KMS self authorization failed")?; |
| 302 | let BootConfig { |
| 303 | boot_info, |
| 304 | gateway_app_id, |
| 305 | } = self |
| 306 | .ensure_app_boot_allowed(&request.vm_config) |
| 307 | .await |
| 308 | .context("App not allowed")?; |
| 309 | let app_id = boot_info.app_id; |
| 310 | let instance_id = boot_info.instance_id; |
| 311 | |
| 312 | let context_data = vec![&app_id[..], &instance_id[..], b"app-disk-crypt-key"]; |
| 313 | let app_disk_key = kdf::derive_dh_secret(&self.state.root_ca.key, &context_data) |
| 314 | .context("Failed to derive app disk key")?; |
| 315 | let env_crypt_key = { |
| 316 | let secret = |
| 317 | kdf::derive_dh_secret(&self.state.root_ca.key, &[&app_id[..], b"env-encrypt-key"]) |
| 318 | .context("Failed to derive env encrypt key")?; |
| 319 | let secret = x25519_dalek::StaticSecret::from(secret); |
| 320 | secret.to_bytes() |
| 321 | }; |
| 322 | |
| 323 | let (k256_key, k256_signature) = { |
| 324 | let (k256_app_key, signature) = derive_k256_key(&self.state.k256_key, &app_id) |
| 325 | .context("Failed to derive app ecdsa key")?; |
| 326 | (k256_app_key.to_bytes().to_vec(), signature) |
| 327 | }; |
| 328 | |
| 329 | Ok(AppKeyResponse { |
| 330 | ca_cert: self.state.root_ca.pem_cert.clone(), |
| 331 | disk_crypt_key: app_disk_key.to_vec(), |
| 332 | env_crypt_key: env_crypt_key.to_vec(), |
| 333 | k256_key, |
| 334 | k256_signature, |
| 335 | tproxy_app_id: gateway_app_id.clone(), |
| 336 | gateway_app_id, |
| 337 | os_image_hash: boot_info.os_image_hash, |
| 338 | }) |
| 339 | } |
| 340 | |
| 341 | async fn get_app_env_encrypt_pub_key(self, request: AppId) -> Result<PublicKeyResponse> { |
| 342 | self.ensure_self_allowed() |
no test coverage detected