Start integrating SPDM into sled-agent

sled-agent/Cargo.toml

@@ -7,6 +7,7 @@ license = "MPL-2.0"
 [dependencies]
 anyhow = "1.0.51"
 async-trait = "0.1.51"
+bytes = "1.1"
 cfg-if = "1.0"
 chrono = { version = "0.4", features = [ "serde" ] }
 dropshot = { git = "https://github.com/oxidecomputer/dropshot", branch = "main" }
@@ -23,12 +24,14 @@ serde = { version = "1.0", features = [ "derive" ] }
 serde_json = "1.0"
 slog = { version = "2.5", features = [ "max_level_trace", "release_max_level_debug" ] }
 smf = "0.2"
+spdm = { git = "https://github.com/oxidecomputer/spdm", rev = "9742f6e" }
 socket2 = { version = "0.4", features = [ "all" ] }
 structopt = "0.3"
 tar = "0.4"
 tempfile = "3.2"
 thiserror = "1.0"
 tokio = { version = "1.14", features = [ "full" ] }
+tokio-util = { version = "0.6", features = ["codec"] }
 toml = "0.5.6"
 uuid = { version = "0.8", features = [ "serde", "v4" ] }
 zone = "0.1"
@@ -41,6 +44,8 @@ openapi-lint = { git = "https://github.com/oxidecomputer/openapi-lint", branch =
 openapiv3 = "0.5.0"
 serial_test = "0.5"
 subprocess = "0.2.8"
+slog-async = "2.6"
+slog-term = "2.8"
 
 #
 # Disable doc builds by default for our binaries to work around issue

sled-agent/src/bootstrap/agent.rs

@@ -7,6 +7,7 @@
 use super::client::types as bootstrap_types;
 use super::client::Client as BootstrapClient;
 use super::discovery;
+use super::spdm::SpdmError;
 use super::views::ShareResponse;
 use omicron_common::api::external::Error as ExternalError;
 use omicron_common::backoff::{
@@ -46,6 +47,9 @@ pub enum BootstrapError {
     #[error("Error making HTTP request")]
     Api(#[from] anyhow::Error),
 
+    #[error("Error running SPDM protocol: {0}")]
+    Spdm(#[from] SpdmError),
+
     #[error("Not enough peers to unlock storage")]
     NotEnoughPeers,
 }

sled-agent/src/bootstrap/mod.rs

@@ -12,4 +12,5 @@ mod http_entrypoints;
 mod multicast;
 mod params;
 pub mod server;
+mod spdm;
 mod views;

sled-agent/src/bootstrap/spdm/error.rs

@@ -0,0 +1,32 @@
+//! Wrap errors returned from the `spdm` crate and std::io::Error.
+
+use spdm::{requester::RequesterError, responder::ResponderError};
+use thiserror::Error;
+
+/// Describes errors that arise from use of the SPDM protocol library
+#[derive(Error, Debug)]
+pub enum SpdmError {
+    #[error("requester error: {0}")]
+    Requester(RequesterError),
+
+    #[error("responder error: {0}")]
+    Responder(ResponderError),
+
+    #[error(transparent)]
+    Io(#[from] std::io::Error),
+
+    #[error("invalid state transition: expected {expected}, got {got}")]
+    InvalidState { expected: &'static str, got: &'static str },
+}
+
+impl From<RequesterError> for SpdmError {
+    fn from(e: RequesterError) -> Self {
+        SpdmError::Requester(e)
+    }
+}
+
+impl From<ResponderError> for SpdmError {
+    fn from(e: ResponderError) -> Self {
+        SpdmError::Responder(e)
+    }
+}

sled-agent/src/bootstrap/spdm/mod.rs

@@ -0,0 +1,57 @@
+//! Instantiate a SPDM requester and responder with particular capabilities,
+//! algorithms, and credentials.
+//!
+//! Sled agents run the SPDM protocol over a tokio TCP stream with a 2 byte size
+//! header for framing.
+
+mod error;
+mod requester;
+mod responder;
+
+use std::io::{Error, ErrorKind};
+
+use bytes::{Bytes, BytesMut};
+use futures::{SinkExt, StreamExt};
+use slog::Logger;
+use tokio::net::TcpStream;
+use tokio_util::codec::{Framed, LengthDelimitedCodec};
+
+// 2^16 - 2 bytes for a header
+const MAX_BUF_SIZE: usize = 65534;
+
+pub use error::SpdmError;
+
+pub struct Transport {
+    framed: Framed<TcpStream, LengthDelimitedCodec>,
+}
+
+impl Transport {
+    // We use 2-byte size framed headers.
+    #[allow(dead_code)]
+    pub const HEADER_LEN: usize = 2;
+
+    #[allow(dead_code)]
+    pub fn new(sock: TcpStream) -> Transport {
+        Transport {
+            framed: LengthDelimitedCodec::builder()
+                .length_field_length(Self::HEADER_LEN)
+                .new_framed(sock),
+        }
+    }
+
+    pub async fn send(&mut self, data: &[u8]) -> Result<(), SpdmError> {
+        let data = Bytes::copy_from_slice(data);
+        self.framed.send(data).await.map_err(|e| e.into())
+    }
+
+    pub async fn recv(&mut self, log: &Logger) -> Result<BytesMut, SpdmError> {
+        if let Some(rsp) = self.framed.next().await {
+            let rsp = rsp?;
+            debug!(log, "Received {:x?}", &rsp[..]);
+            Ok(rsp)
+        } else {
+            Err(Error::new(ErrorKind::ConnectionAborted, "SPDM channel closed")
+                .into())
+        }
+    }
+}