rust/pv: Get request-tag for add-secret requests

Enables API users to get the request tag of an Add-Secret request.
This enables them to check for attestation policies.
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

rust/pv/src/req.rs

@@ -506,6 +506,11 @@ impl<'a> BinReqValues<'a> {
     {
         T::ref_from_prefix(self.req_dep_aad)
     }
+
+    /// Returns a reference to the tag of this [`BinReqValues`].
+    pub(crate) fn tag(&self) -> &[u8] {
+        self.tag
+    }
 }
 
 #[cfg(test)]

rust/pv/src/uvsecret/asrcb.rs

@@ -7,7 +7,7 @@ use crate::{
     assert_size,
     crypto::{hkdf_rfc_5869, AesGcmResult},
     misc::Flags,
-    req::{Aad, Keyslot, ReqEncrCtx},
+    req::{Aad, BinReqValues, Keyslot, ReqEncrCtx},
     request::{BootHdrTags, Confidential, Request},
     secret::{ExtSecret, GuestSecret},
     uv::{ConfigUid, UvFlags},
@@ -17,7 +17,7 @@ use openssl::{
     md::Md,
     pkey::{PKey, Private, Public},
 };
-use pv_core::request::RequestVersion;
+use pv_core::{request::RequestVersion, secret::AddSecretMagic};
 use zerocopy::AsBytes;
 
 /// Authenticated data w/o user data
@@ -282,6 +282,12 @@ impl AddSecretRequest {
         ctx.encrypt_aead(&buf[aad_range], &buf[encr_range])
             .map(|res| res.data())
     }
+
+    /// Get a copy of the add secret request tag
+    pub fn bin_tag(asrcb: &[u8]) -> Result<Vec<u8>> {
+        AddSecretMagic::try_from_bytes(asrcb)?;
+        BinReqValues::get(asrcb).map(|v| v.tag().to_vec())
+    }
 }
 
 impl Request for AddSecretRequest {