Handle PCK certificates

pallets/attestation/src/mock.rs

@@ -321,6 +321,7 @@ impl pallet_staking_extension::Config for Test {
     type RuntimeEvent = RuntimeEvent;
     type MaxPendingAttestations = MaxPendingAttestations;
     type WeightInfo = ();
+    type PckCertChainVerifier = pallet_staking_extension::pck::MockPckCertChainVerifyer;
 }
 
 parameter_types! {

pallets/propagation/src/mock.rs

@@ -313,6 +313,7 @@ impl pallet_staking_extension::Config for Test {
     type RuntimeEvent = RuntimeEvent;
     type MaxPendingAttestations = MaxPendingAttestations;
     type WeightInfo = ();
+    type PckCertChainVerifier = pallet_staking_extension::pck::MockPckCertChainVerifyer;
 }
 
 parameter_types! {

pallets/registry/src/mock.rs

@@ -310,6 +310,7 @@ impl pallet_staking_extension::Config for Test {
     type RuntimeEvent = RuntimeEvent;
     type MaxPendingAttestations = MaxPendingAttestations;
     type WeightInfo = ();
+    type PckCertChainVerifier = pallet_staking_extension::pck::MockPckCertChainVerifyer;
 }
 
 parameter_types! {

pallets/staking/Cargo.toml

@@ -28,6 +28,10 @@ sp-runtime        ={ version="32.0.0", default-features=false }
 sp-staking        ={ version="27.0.0", default-features=false }
 sp-std            ={ version="14.0.0", default-features=false }
 sp-consensus-babe ={ version="0.33.0", default-features=false }
+x509-verify       ={ version="0.4.6", features=["x509"] }
+spki              ="0.7.3"
+p256              ={ version="0.13.2", default-features=false, features=["ecdsa"] }
+rand              ={ version="0.8.5", default-features=false, features=["alloc"] }
 
 pallet-parameters={ version="0.2.0", path="../parameters", default-features=false }
 entropy-shared={ version="0.2.0", path="../../crates/shared", features=[

pallets/staking/src/benchmarking.rs

@@ -16,6 +16,7 @@
 //! Benchmarking setup for pallet-propgation
 #![allow(unused_imports)]
 use super::*;
+use crate::pck::MOCK_PCK_DERIVED_FROM_NULL_ARRAY;
 #[allow(unused_imports)]
 use crate::Pallet as Staking;
 use entropy_shared::MAX_SIGNERS;
@@ -90,25 +91,35 @@ fn prep_bond_and_validate<T: Config>(
         reward_destination,
     ));
 
-    let server_info = ServerInfo {
+    let joining_server_info = JoiningServerInfo {
         tss_account: threshold,
         x25519_public_key,
         endpoint: vec![20, 20],
-        provisioning_certification_key: BoundedVec::with_max_capacity(),
+        pck_certificate_chain: vec![[0u8; 32].to_vec()],
     };
 
     if validate_also {
         assert_ok!(<Staking<T>>::validate(
             RawOrigin::Signed(bonder.clone()).into(),
             ValidatorPrefs::default(),
-            server_info.clone(),
+            joining_server_info.clone(),
         ));
 
         let validator_id = <T as pallet_session::Config>::ValidatorId::try_from(bonder)
             .or(Err(Error::<T>::InvalidValidatorId))
             .unwrap();
 
-        ThresholdToStash::<T>::insert(&server_info.tss_account, &validator_id);
+        ThresholdToStash::<T>::insert(&joining_server_info.tss_account, &validator_id);
+
+        let server_info = ServerInfo {
+            tss_account: joining_server_info.tss_account,
+            x25519_public_key: joining_server_info.x25519_public_key,
+            endpoint: joining_server_info.endpoint,
+            provisioning_certification_key: MOCK_PCK_DERIVED_FROM_NULL_ARRAY
+                .to_vec()
+                .try_into()
+                .unwrap(),
+        };
         ThresholdServers::<T>::insert(&validator_id, server_info);
     }
 }
@@ -146,7 +157,7 @@ benchmarks! {
       endpoint: vec![20, 20],
       tss_account: _bonder.clone(),
       x25519_public_key: NULL_ARR,
-      provisioning_certification_key: BoundedVec::with_max_capacity(),
+      provisioning_certification_key: MOCK_PCK_DERIVED_FROM_NULL_ARRAY.to_vec().try_into().unwrap(),
     };
     assert_last_event::<T>(Event::<T>::ThresholdAccountChanged(bonder, server_info).into());
   }
@@ -261,14 +272,14 @@ benchmarks! {
     prep_bond_and_validate::<T>(false, caller.clone(), bonder.clone(), threshold.clone(), NULL_ARR);
     let validator_preference = ValidatorPrefs::default();
 
-    let server_info = ServerInfo {
+    let joining_server_info = JoiningServerInfo {
         tss_account: threshold.clone(),
         x25519_public_key: NULL_ARR,
         endpoint: vec![20],
-        provisioning_certification_key: BoundedVec::with_max_capacity(),
+        pck_certificate_chain: vec![[0u8; 32].to_vec()],
     };
 
-  }:  _(RawOrigin::Signed(bonder.clone()), validator_preference, server_info)
+  }:  _(RawOrigin::Signed(bonder.clone()), validator_preference, joining_server_info)
   verify {
     assert_last_event::<T>(Event::<T>::AttestationCheckQueued(bonder).into());
   }

pallets/staking/src/lib.rs

@@ -41,6 +41,8 @@ use serde::{Deserialize, Serialize};
 
 pub use crate::weights::WeightInfo;
 
+pub mod pck;
+
 #[cfg(test)]
 mod mock;
 
@@ -69,6 +71,7 @@ pub mod pallet {
         DefaultNoBound,
     };
     use frame_system::pallet_prelude::*;
+    use pck::PckCertChainVerifier;
     use rand_chacha::{
         rand_core::{RngCore, SeedableRng},
         ChaCha20Rng, ChaChaRng,
@@ -98,6 +101,7 @@ pub mod pallet {
         type MaxPendingAttestations: Get<u32>;
         /// The weight information of this pallet.
         type WeightInfo: WeightInfo;
+        type PckCertChainVerifier: PckCertChainVerifier;
     }
 
     /// A unique identifier of a subgroup or partition of validators that have the same set of
@@ -120,6 +124,15 @@ pub mod pallet {
         pub endpoint: TssServerURL,
         pub provisioning_certification_key: VerifyingKey,
     }
+
+    #[derive(Encode, Decode, Clone, Eq, PartialEq, RuntimeDebug, TypeInfo)]
+    pub struct JoiningServerInfo<AccountId> {
+        pub tss_account: AccountId,
+        pub x25519_public_key: X25519PublicKey,
+        pub endpoint: TssServerURL,
+        pub pck_certificate_chain: Vec<Vec<u8>>,
+    }
+
     /// Info that is requiered to do a proactive refresh
     #[derive(Clone, Encode, Decode, Eq, PartialEq, RuntimeDebug, TypeInfo, Default)]
     pub struct RefreshInfo {
@@ -344,6 +357,10 @@ pub mod pallet {
         NoUnnominatingWhenSigner,
         NoUnnominatingWhenNextSigner,
         NoChangingThresholdAccountWhenSigner,
+        PckCertificateParse,
+        PckCertificateVerify,
+        PckCertificateBadPublicKey,
+        PckCertificateNoCertificate,
     }
 
     #[pallet::event]
@@ -546,10 +563,30 @@ pub mod pallet {
         pub fn validate(
             origin: OriginFor<T>,
             prefs: ValidatorPrefs,
-            server_info: ServerInfo<T::AccountId>,
+            joining_server_info: JoiningServerInfo<T::AccountId>,
         ) -> DispatchResult {
             let who = ensure_signed(origin.clone())?;
 
+            let provisioning_certification_key =
+                T::PckCertChainVerifier::verify_pck_certificate_chain(
+                    joining_server_info.pck_certificate_chain,
+                )
+                .map_err(|error| match error {
+                    pck::PckParseVerifyError::Parse => Error::<T>::PckCertificateParse,
+                    pck::PckParseVerifyError::Verify => Error::<T>::PckCertificateVerify,
+                    pck::PckParseVerifyError::BadPublicKey => {
+                        Error::<T>::PckCertificateBadPublicKey
+                    },
+                    pck::PckParseVerifyError::NoCertificate => {
+                        Error::<T>::PckCertificateNoCertificate
+                    },
+                })?;
+            let server_info = ServerInfo::<T::AccountId> {
+                tss_account: joining_server_info.tss_account,
+                x25519_public_key: joining_server_info.x25519_public_key,
+                endpoint: joining_server_info.endpoint,
+                provisioning_certification_key,
+            };
             ensure!(
                 server_info.endpoint.len() as u32 <= T::MaxEndpointLength::get(),
                 Error::<T>::EndpointTooLong