Fix CDH & kbs_protocol

attestation-agent/kbs_protocol/Cargo.toml

@@ -21,6 +21,7 @@ serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true
 thiserror.workspace = true
+tokio.workspace = true
 ttrpc = { workspace = true, optional = true}
 url.workspace = true
 zeroize.workspace = true
@@ -42,7 +43,7 @@ passport = []
 # use a client of attestation-agent to get token for kbs
 aa_token = ["ttrpc-codegen", "passport", "ttrpc/async", "protobuf"]
 
-background_check = []
+background_check = ["tokio/time"]
 all-attesters = ["attester/all-attesters"]
 tdx-attester = ["attester/tdx-attester"]
 sgx-attester = ["attester/sgx-attester"]

attestation-agent/kbs_protocol/src/client/rcar_client.rs

@@ -3,6 +3,8 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 
+use std::time::Duration;
+
 use anyhow::{bail, Context};
 use async_trait::async_trait;
 use kbs_types::{Attestation, Challenge, ErrorInformation, Request, Response};
@@ -22,6 +24,13 @@ use crate::{
     Error, Result,
 };
 
+/// When executing get token, RCAR handshake should retry if failed to
+/// make the logic robust. This constant is the max retry times.
+const RCAR_MAX_ATTEMPT: i32 = 5;
+
+/// The interval (seconds) between RCAR handshake retries.
+const RCAR_RETRY_TIMEOUT_SECOND: u64 = 1;
+
 #[derive(Deserialize, Debug, Clone)]
 struct AttestationResponseData {
     // Attestation token in JWT format
@@ -36,14 +45,48 @@ impl KbsClient<Box<dyn EvidenceProvider>> {
     pub async fn get_token(&mut self) -> Result<(Token, TeeKeyPair)> {
         if let Some(token) = &self.token {
             if token.check_valid().is_err() {
-                self.rcar_handshake()
-                    .await
-                    .map_err(|e| Error::RcarHandshake(e.to_string()))?;
+                let mut retry_times = 1;
+                loop {
+                    let res = self
+                        .rcar_handshake()
+                        .await
+                        .map_err(|e| Error::RcarHandshake(e.to_string()));
+                    match res {
+                        Ok(_) => break,
+                        Err(e) => {
+                            if retry_times >= RCAR_MAX_ATTEMPT {
+                                return Err(Error::RcarHandshake(format!("Get token failed because of RCAR handshake retried {RCAR_MAX_ATTEMPT} times.")));
+                            } else {
+                                warn!("RCAR handshake failed: {e}, retry {retry_times}...");
+                                retry_times += 1;
+                                tokio::time::sleep(Duration::from_secs(RCAR_RETRY_TIMEOUT_SECOND))
+                                    .await;
+                            }
+                        }
+                    }
+                }
             }
         } else {
-            self.rcar_handshake()
-                .await
-                .map_err(|e| Error::RcarHandshake(e.to_string()))?;
+            let mut retry_times = 1;
+            loop {
+                let res = self
+                    .rcar_handshake()
+                    .await
+                    .map_err(|e| Error::RcarHandshake(e.to_string()));
+                match res {
+                    Ok(_) => break,
+                    Err(e) => {
+                        if retry_times >= RCAR_MAX_ATTEMPT {
+                            return Err(Error::RcarHandshake(format!("Get token failed because of RCAR handshake retried {RCAR_MAX_ATTEMPT} times.")));
+                        } else {
+                            warn!("RCAR handshake failed: {e}, retry {retry_times}...");
+                            retry_times += 1;
+                            tokio::time::sleep(Duration::from_secs(RCAR_RETRY_TIMEOUT_SECOND))
+                                .await;
+                        }
+                    }
+                }
+            }
         }
 
         assert!(self.token.is_some());

confidential-data-hub/Makefile

@@ -38,7 +38,10 @@ endif
 ifdef PROVIDER
     features += $(PROVIDER)
 else
-    features += aliyun
+    ifneq ($(ARCH), s390x)
+        $(info INFO: Aliyun KMS plugins will be built in by default)
+        features += aliyun
+    endif
 endif
 
 ifeq ($(LIBC), musl)

confidential-data-hub/docs/kms-providers/alibaba.md

@@ -89,7 +89,7 @@ Then, let's
 # define the parameters
 KEY_ID=$(cat kms-key-id.txt)
 KMS_INSTANCE_ID=$(cat kms-instance-id.txt)
-CLIENT_KEY_PASSWORD_FILE_PATH=$(pwd)/ClientKeyPassword.txt
+CLIENT_KEY_PASSWORD_FILE_PATH=$(pwd)/ClientKeyPassword.json
 CERT_PATH=$(pwd)/ca.pem
 CLIENT_KEY_FILE_PATH=$(pwd)/ClientKeyContent.json
 

confidential-data-hub/kms/src/plugins/mod.rs

@@ -17,6 +17,7 @@ pub mod kbs;
 #[derive(AsRefStr, EnumString)]
 pub enum DecryptorProvider {
     #[cfg(feature = "aliyun")]
+    #[strum(ascii_case_insensitive)]
     Aliyun,
 }