[aesmd] Fix breaking change in InitQuoteExRequest schema+handling

[phlip9]

Problem

This commit included in v2.30 d630abf6 - Harden AESM IPC request parsing and semantic validation breaks backwards compatibility. Clients or enclaves using v2.29 clients and older can no longer get remote attestations.

Cause

The issue is overly-strict hardening that breaks old clients, even when it is not strictly necessary. Specifically, InitQuoteExRequest.buf_size went from optional to required:

     message InitQuoteExRequest{
         optional    bytes  att_key_id              = 1;
         required    bool   b_pub_key_id            = 3;
-        optional    uint64 buf_size                = 4;
+        required    uint64 buf_size                = 4;
         optional    uint32 timeout                 = 9;
     }

You can see relevant log lines where aesmd rejects a pubkey size request from an old enclave:

Aug 10 22:41:24 aesm_service[2281]: E0000 00:00:1786401684.179879    2281 message_lite.cc:214] Can't parse message of type "aesm.message.Request" because it is missing required fields: (cannot determine missing fields for lite message)

Before the hardening change, v2.29 clients omitted buf_size when b_pub_key_id=false (essentially querying the pubkey size). Making the field required causes aesmd from v2.30 to reject requests generated by prev. SGX releases.

Fix

Fortunately, we can both keep the max buf_size hardening and maintain backwards compatibility. When b_pub_key_id is set, it still correctly rejects buf_size unset or buf_size=0. But when b_pub_key_id is unset, we'll allow buf_size unset or buf_size=0. Recall that proto2 getters return default values for unset optional fields, so buf_size() == 0 when unset. This way old enclaves keep working, and we can enjoy a safer aesmd : )

[phlip9]

cc @fqiu1

[jbdelcuv]

Looks good to me.
@fqiu1 What do you think?

[fqiu1]

LGTM, @phlip9 thank you for providing the fix!

[Copilot]

Pull request overview

Restores backwards compatibility for aesmd IPC InitQuoteExRequest parsing/validation so older (v2.29 and earlier) clients can continue requesting the pubkey-id size without being rejected, while preserving existing buf_size hardening when a pubkey-id buffer is actually requested.

Changes:

• Reverts InitQuoteExRequest.buf_size from required back to optional in the proto2 schema.
• Removes the strict has_buf_size() gate in AEInitQuoteExRequest::check() and relies on semantic validation (buf_size()==0 / !=0) keyed off b_pub_key_id.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
psw/ae/aesm_service/source/core/ipc/messages.proto	Makes InitQuoteExRequest.buf_size optional again to allow old clients to parse successfully.
psw/ae/aesm_service/source/core/ipc/AEInitQuoteExRequest.cpp	Updates request validation to allow buf_size unset/0 when b_pub_key_id is false, while still rejecting unset/0 (and oversize) when b_pub_key_id is true.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[bgotowal]

Hi @phlip9 ! Thanks for submitting the issue and proposing a fix!

The plan is to release a new version by tomorrow with your fix included (internal version of the packages will be updated from 2.30.100.1 to 2.30.101.1). The release will be both announced in GitHub following posting new binaries at download.01.org.

[bgotowal]

Update: Intel® SGX SDK/PSW 2.30.1 containing this change is now released.