sp-sim: Add a simulated RoT

gateway/tests/integration_tests/location_discovery.rs

@@ -28,8 +28,8 @@ async fn discovery_both_locations() {
     // both instances should report the same serial number for switch 0 and
     // switch 1, and it should match the expected values from the config
     for (switch, expected_serial) in [
-        (0, "00010001000100010001000100010001"),
-        (1, "01000100010001000100010001000100"),
+        (0, "00000000000000000000000000000001"),
+        (1, "00000000000000000000000000000002"),
     ] {
         for client in [client0, client1] {
             let url =

gateway/tests/sp_sim_config.test.toml

@@ -10,25 +10,35 @@
 [[simulated_sps.sidecar]]
 multicast_addr = "::1"
 bind_addrs = ["[::1]:0", "[::1]:0"]
-serial_number = [0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1]
+serial_number = "00000000000000000000000000000001"
+manufacturing_root_cert_seed = "01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de"
+device_id_cert_seed = "01de000000000000000000000000000000000000000000000000000000000000"
 
 [[simulated_sps.sidecar]]
 multicast_addr = "::1"
 bind_addrs = ["[::1]:0", "[::1]:0"]
-serial_number = [1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0]
+serial_number = "00000000000000000000000000000002"
+manufacturing_root_cert_seed = "01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de"
+device_id_cert_seed = "01de000000000000000000000000000000000000000000000000000000000001"
 
 [[simulated_sps.gimlet]]
 multicast_addr = "::1"
 bind_addrs = ["[::1]:0", "[::1]:0"]
-serial_number = [0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3]
+serial_number = "00000000000000000000000000000003"
+manufacturing_root_cert_seed = "01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de"
+device_id_cert_seed = "01de000000000000000000000000000000000000000000000000000000000002"
+
 [[simulated_sps.gimlet.components]]
 name = "sp3"
 serial_console = "[::1]:0"
 
 [[simulated_sps.gimlet]]
 multicast_addr = "::1"
 bind_addrs = ["[::1]:0", "[::1]:0"]
-serial_number = [4, 4, 4, 4, 5, 5, 5, 5, 6, 6, 6, 6, 7, 7, 7, 7]
+serial_number = "00000000000000000000000000000004"
+manufacturing_root_cert_seed = "01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de"
+device_id_cert_seed = "01de000000000000000000000000000000000000000000000000000000000003"
+
 [[simulated_sps.gimlet.components]]
 name = "sp3"
 serial_console = "[::1]:0"

sp-sim/Cargo.toml

@@ -10,9 +10,10 @@ async-trait = "0.1.53"
 dropshot = { git = "https://github.com/oxidecomputer/dropshot", branch = "main", features = [ "usdt-probes" ] }
 futures = "0.3"
 gateway-messages = { path = "../gateway-messages", default-features = false, features = ["std"] }
-hex = "0.4.3"
+hex = { version = "0.4.3", features = ["serde"] }
 omicron-common = { path = "../common" }
 slog-dtrace = "0.2"
+sprockets-rot = { git = "http://github.com/oxidecomputer/sprockets", rev = "0361fd13ff19cda6696242fe40f1325fca30d3d1" }
 structopt = "0.3"
 thiserror = "1.0"
 toml = "0.5.9"

sp-sim/examples/config.toml

@@ -5,20 +5,29 @@
 [[simulated_sps.sidecar]]
 multicast_addr = "ff15:0:1de::0"
 bind_addrs = ["[::]:33300", "[::]:33301"]
-serial_number = [0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1]
+serial_number = "00000000000000000000000000000001"
+manufacturing_root_cert_seed = "01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de"
+device_id_cert_seed = "01de000000000000000000000000000000000000000000000000000000000000"
+
 
 [[simulated_sps.gimlet]]
 multicast_addr = "ff15:0:1de::1"
 bind_addrs = ["[::]:33310", "[::]:33311"]
-serial_number = [0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3]
+serial_number = "00000000000000000000000000000002"
+manufacturing_root_cert_seed = "01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de"
+device_id_cert_seed = "01de000000000000000000000000000000000000000000000000000000000001"
+
 [[simulated_sps.gimlet.components]]
 name = "sp3"
 serial_console = "[::1]:33312"
 
 [[simulated_sps.gimlet]]
 multicast_addr = "ff15:0:1de::2"
 bind_addrs = ["[::]:33320", "[::]:33321"]
-serial_number = [4, 4, 4, 4, 5, 5, 5, 5, 6, 6, 6, 6, 7, 7, 7, 7]
+serial_number = "00000000000000000000000000000003"
+manufacturing_root_cert_seed = "01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de01de"
+device_id_cert_seed = "01de000000000000000000000000000000000000000000000000000000000002"
+
 [[simulated_sps.gimlet.components]]
 name = "sp3"
 serial_console = "[::1]:33322"

sp-sim/src/config.rs

@@ -25,7 +25,14 @@ pub struct SpCommonConfig {
     #[serde(skip_serializing_if = "Option::is_none", default)]
     pub bind_addrs: Option<[SocketAddrV6; 2]>,
     /// Fake serial number
+    #[serde(with = "hex")]
     pub serial_number: SerialNumber,
+    /// 32-byte seed to create a manufacturing root certificate.
+    #[serde(with = "hex")]
+    pub manufacturing_root_cert_seed: [u8; 32],
+    /// 32-byte seed to create a Device ID certificate.
+    #[serde(with = "hex")]
+    pub device_id_cert_seed: [u8; 32],
 }
 
 /// Configuration of a simulated sidecar SP
@@ -119,3 +126,14 @@ impl std::cmp::PartialEq<std::io::Error> for LoadError {
         }
     }
 }
+
+impl GimletConfig {
+    pub fn from_file<P: AsRef<Path>>(path: P) -> Result<Self, LoadError> {
+        let path = path.as_ref();
+        let contents = std::fs::read_to_string(&path)
+            .map_err(|err| LoadError::Io { path: path.into(), err })?;
+        let config = toml::from_str(&contents)
+            .map_err(|err| LoadError::Parse { path: path.into(), err })?;
+        Ok(config)
+    }
+}

sp-sim/src/gimlet.rs

@@ -3,6 +3,7 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 use crate::config::GimletConfig;
+use crate::rot::RotSprocketExt;
 use crate::server;
 use crate::server::UdpServer;
 use crate::{Responsiveness, SimulatedSp};
@@ -22,6 +23,9 @@ use gateway_messages::SpMessageKind;
 use gateway_messages::SpPort;
 use gateway_messages::SpState;
 use slog::{debug, error, info, warn, Logger};
+use sprockets_rot::common::msgs::{RotRequestV1, RotResponseV1};
+use sprockets_rot::common::Ed25519PublicKey;
+use sprockets_rot::{RotSprocket, RotSprocketError};
 use std::collections::HashMap;
 use std::net::{SocketAddr, SocketAddrV6};
 use std::sync::{Arc, Mutex};
@@ -33,6 +37,8 @@ use tokio::sync::oneshot;
 use tokio::task::{self, JoinHandle};
 
 pub struct Gimlet {
+    rot: Mutex<RotSprocket>,
+    manufacturing_public_key: Ed25519PublicKey,
     local_addrs: Option<[SocketAddrV6; 2]>,
     serial_number: SerialNumber,
     serial_console_addrs: HashMap<String, SocketAddrV6>,
@@ -56,6 +62,10 @@ impl SimulatedSp for Gimlet {
         hex::encode(self.serial_number)
     }
 
+    fn manufacturing_public_key(&self) -> Ed25519PublicKey {
+        self.manufacturing_public_key
+    }
+
     fn local_addr(&self, port: SpPort) -> Option<SocketAddrV6> {
         let i = match port {
             SpPort::One => 0,
@@ -71,6 +81,13 @@ impl SimulatedSp for Gimlet {
             rx.await.unwrap();
         }
     }
+
+    fn rot_request(
+        &self,
+        request: RotRequestV1,
+    ) -> Result<RotResponseV1, RotSprocketError> {
+        self.rot.lock().unwrap().handle_deserialized(request)
+    }
 }
 
 impl Gimlet {
@@ -182,7 +199,11 @@ impl Gimlet {
             None
         };
 
+        let (manufacturing_public_key, rot) =
+            RotSprocket::bootstrap_from_config(&gimlet.common);
         Ok(Self {
+            rot: Mutex::new(rot),
+            manufacturing_public_key,
             local_addrs,
             serial_number: gimlet.common.serial_number,
             serial_console_addrs,

sp-sim/src/lib.rs

@@ -4,6 +4,7 @@
 
 pub mod config;
 mod gimlet;
+mod rot;
 mod server;
 mod sidecar;
 
@@ -15,6 +16,10 @@ pub use gimlet::Gimlet;
 pub use server::logger;
 pub use sidecar::Sidecar;
 pub use slog::Logger;
+pub use sprockets_rot::common::msgs::RotRequestV1;
+pub use sprockets_rot::common::msgs::RotResponseV1;
+use sprockets_rot::common::Ed25519PublicKey;
+pub use sprockets_rot::RotSprocketError;
 use std::net::SocketAddrV6;
 
 pub mod ignition_id {
@@ -33,13 +38,22 @@ pub trait SimulatedSp {
     /// Hexlified serial number.
     fn serial_number(&self) -> String;
 
+    /// Public key for the manufacturing cert used to sign this SP's RoT certs.
+    fn manufacturing_public_key(&self) -> Ed25519PublicKey;
+
     /// Listening UDP address of the given port of this simulated SP, if it was
     /// configured to listen.
     fn local_addr(&self, port: SpPort) -> Option<SocketAddrV6>;
 
     /// Simulate the SP being unresponsive, in which it ignores all incoming
     /// messages.
     async fn set_responsiveness(&self, r: Responsiveness);
+
+    /// Send a request to the (simulated) RoT.
+    fn rot_request(
+        &self,
+        request: RotRequestV1,
+    ) -> Result<RotResponseV1, RotSprocketError>;
 }
 
 pub struct SimRack {