Add Oak Session crate and proto

Bug: 338559296

Change-Id: I25ac385da673f85b294f48d41608a3a89fdf570e

Cargo.toml

@@ -55,6 +55,7 @@ members = [
   "oak_restricted_kernel_sdk",
   "oak_restricted_kernel_launcher",
   "oak_restricted_kernel_orchestrator",
+  "oak_session",
   "oak_sev_guest",
   "oak_sev_snp_attestation_report",
   "oak_simple_io",
@@ -136,6 +137,7 @@ oak_restricted_kernel_sdk = { path = "./oak_restricted_kernel_sdk" }
 oak_restricted_kernel_sdk_proc_macro = { path = "./oak_restricted_kernel_sdk_proc_macro" }
 oak_restricted_kernel_interface = { path = "./oak_restricted_kernel_interface" }
 oak_restricted_kernel_orchestrator = { path = "./oak_restricted_kernel_orchestrator" }
+oak_session = { path = "./oak_session" }
 oak_sev_guest = { path = "./oak_sev_guest", default-features = false }
 oak_sev_snp_attestation_report = { path = "./oak_sev_snp_attestation_report" }
 oak_stage0_dice = { path = "./stage0_dice" }

oak_proto_rust/BUILD

@@ -56,6 +56,7 @@ cargo_build_script(
         "//proto/oak_functions:abi_proto",
         "//proto/oak_functions:lookup_data_proto",
         "//proto/oak_functions:testing_proto",
+        "//proto/session:session_proto",
         "@com_google_protobuf//:protoc",
     ],
     deps = [

oak_proto_rust/build.rs

@@ -27,6 +27,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         "../proto/digest.proto",
         "../proto/oak_functions/abi.proto",
         "../proto/oak_functions/lookup_data.proto",
+        "../proto/session/session.proto",
     ];
     let mut config = prost_build::Config::new();
     config

oak_session/BUILD

@@ -0,0 +1,36 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(
+    default_visibility = ["//visibility:public"],
+    licenses = ["notice"],
+)
+
+rust_library(
+    name = "oak_session",
+    srcs = glob([
+        "src/*.rs",
+    ]),
+    proc_macro_deps = [
+        "@oak_crates_index//:async-trait",
+    ],
+    deps = [
+        "//oak_proto_rust",
+        "@oak_crates_index//:anyhow",
+    ],
+)

oak_session/Cargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "oak_session"
+version = "0.1.0"
+authors = ["Ivan Petrov <[email protected]>"]
+edition = "2021"
+license = "Apache-2.0"
+
+[dependencies]

oak_session/src/lib.rs

@@ -0,0 +1,22 @@
+//
+// Copyright 2024 The Project Oak Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#![no_std]
+
+extern crate alloc;
+
+#[cfg(test)]
+extern crate std;

proto/session/BUILD

@@ -102,6 +102,12 @@ java_grpc_library(
     deps = [":service_unary_java_proto"],
 )
 
+proto_library(
+    name = "session_proto",
+    srcs = ["session.proto"],
+    deps = [":messages_proto"],
+)
+
 build_test(
     name = "build_test",
     targets = [
@@ -110,5 +116,6 @@ build_test(
         ":service_streaming_java_grpc",
         ":service_unary_cc_grpc",
         ":service_unary_java_grpc",
+        ":session_proto",
     ],
 )

proto/session/session.proto

@@ -0,0 +1,76 @@
+//
+// Copyright 2024 The Project Oak Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+syntax = "proto3";
+
+package oak.session.v1;
+
+import "proto/session/messages.proto";
+
+option java_multiple_files = true;
+option java_package = "com.google.oak.session.v1";
+
+// Request message for the remote attestation.
+message AttestRequest {
+  repeated oak.session.v1.EndorsedEvidence endorsed_evidence = 1;
+}
+
+// Request message for the remote attestation.
+message AttestResponse {
+  repeated oak.session.v1.EndorsedEvidence endorsed_evidence = 1;
+}
+
+// Request message for the crypto handshake request needed to establish a set of
+// session keys.
+message HandshakeRequest {
+  // Noise Protocol ephemeral public key 'e'.
+  // <http://www.noiseprotocol.org/noise.html#overview-of-handshake-state-machine>
+  bytes ephemeral_public_key = 1;
+  // Payload encrypted with the current chaining key.
+  bytes ciphertext = 2;
+}
+
+// Response message for the crypto handshake request needed to establish a set
+// of session keys.
+message HandshakeResponse {
+  // Noise Protocol ephemeral public key 'e'.
+  // <http://www.noiseprotocol.org/noise.html#overview-of-handshake-state-machine>
+  bytes ephemeral_public_key = 1;
+  // Payload encrypted with the current chaining key.
+  bytes ciphertext = 2;
+}
+
+// Request message for the Oak protocol attested secure session.
+// This message is a wrapper containing different message types including:
+// attestation, handshake and encrypted data exchange.
+message SessionRequest {
+  oneof request {
+    AttestRequest attest_request = 1;
+    HandshakeRequest handshake_request = 2;
+    bytes ciphertext = 3;
+  }
+}
+
+// Response message for the Oak protocol attested secure session.
+// This message is a wrapper containing different message types including:
+// attestation, handshake and encrypted data exchange.
+message SessionResponse {
+  oneof response {
+    AttestResponse attest_response = 1;
+    HandshakeResponse handshake_response = 2;
+    bytes ciphertext = 3;
+  }
+}