2022-09-05 03:06:08 -04:00
|
|
|
/*
|
|
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
*/
|
|
|
|
|
2022-04-19 11:02:02 -04:00
|
|
|
package cloudcmd
|
|
|
|
|
|
|
|
import (
|
2022-04-27 05:17:41 -04:00
|
|
|
"crypto/sha256"
|
|
|
|
"encoding/base64"
|
2022-08-29 10:41:09 -04:00
|
|
|
"encoding/hex"
|
2022-04-19 11:02:02 -04:00
|
|
|
"errors"
|
|
|
|
"fmt"
|
|
|
|
|
2022-09-21 07:47:57 -04:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/atls"
|
2023-03-14 06:46:27 -04:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/attestation/choose"
|
2023-01-18 10:49:55 -05:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/attestation/idkeydigest"
|
2022-11-15 09:40:49 -05:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/attestation/measurements"
|
2022-09-21 07:47:57 -04:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/config"
|
2023-03-14 06:46:27 -04:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/oid"
|
2022-08-12 09:59:45 -04:00
|
|
|
"github.com/spf13/cobra"
|
2022-04-19 11:02:02 -04:00
|
|
|
)
|
|
|
|
|
2022-11-09 09:57:54 -05:00
|
|
|
// Validator validates Platform Configuration Registers (PCRs).
|
2022-08-09 08:04:40 -04:00
|
|
|
type Validator struct {
|
2023-03-14 06:46:27 -04:00
|
|
|
attestationVariant oid.Getter
|
2022-11-15 09:40:49 -05:00
|
|
|
pcrs measurements.M
|
2023-03-21 07:46:49 -04:00
|
|
|
idKeyConfig idkeydigest.Config
|
2022-08-29 10:41:09 -04:00
|
|
|
validator atls.Validator
|
2023-03-03 10:50:25 -05:00
|
|
|
log debugLog
|
2022-04-19 11:02:02 -04:00
|
|
|
}
|
|
|
|
|
2022-11-09 09:57:54 -05:00
|
|
|
// NewValidator creates a new Validator.
|
2023-03-21 07:46:49 -04:00
|
|
|
func NewValidator(conf *config.Config, maaURL string, log debugLog) (*Validator, error) {
|
2023-03-03 10:50:25 -05:00
|
|
|
v := Validator{log: log}
|
2023-03-14 06:46:27 -04:00
|
|
|
variant, err := oid.FromString(conf.AttestationVariant)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("parsing attestation variant: %w", err)
|
2022-04-27 05:17:41 -04:00
|
|
|
}
|
2023-03-14 06:46:27 -04:00
|
|
|
v.attestationVariant = variant // valid variant
|
|
|
|
|
2022-10-21 11:09:10 -04:00
|
|
|
if err := v.setPCRs(conf); err != nil {
|
2022-04-27 05:17:41 -04:00
|
|
|
return nil, err
|
|
|
|
}
|
2022-08-29 10:41:09 -04:00
|
|
|
|
2023-03-14 06:46:27 -04:00
|
|
|
if v.attestationVariant.OID().Equal(oid.AzureSEVSNP{}.OID()) {
|
2023-03-21 07:46:49 -04:00
|
|
|
v.idKeyConfig = idkeydigest.Config{
|
|
|
|
IDKeyDigests: conf.Provider.Azure.IDKeyDigest,
|
|
|
|
EnforcementPolicy: conf.IDKeyDigestPolicy(),
|
|
|
|
MAAURL: maaURL,
|
|
|
|
}
|
2022-08-29 10:41:09 -04:00
|
|
|
}
|
|
|
|
|
2022-04-27 05:17:41 -04:00
|
|
|
return &v, nil
|
|
|
|
}
|
|
|
|
|
2022-11-09 09:57:54 -05:00
|
|
|
// UpdateInitPCRs sets the owner and cluster PCR values.
|
2022-08-09 08:04:40 -04:00
|
|
|
func (v *Validator) UpdateInitPCRs(ownerID, clusterID string) error {
|
2022-11-24 04:57:58 -05:00
|
|
|
if err := v.updatePCR(uint32(measurements.PCRIndexOwnerID), ownerID); err != nil {
|
2022-04-27 05:17:41 -04:00
|
|
|
return err
|
|
|
|
}
|
2022-11-24 04:57:58 -05:00
|
|
|
return v.updatePCR(uint32(measurements.PCRIndexClusterID), clusterID)
|
2022-04-27 05:17:41 -04:00
|
|
|
}
|
|
|
|
|
2022-11-24 04:57:58 -05:00
|
|
|
// updatePCR adds a new entry to the measurements of v, or removes the key if the input is an empty string.
|
2022-04-27 05:17:41 -04:00
|
|
|
//
|
2022-11-24 04:57:58 -05:00
|
|
|
// When adding, the input is first decoded from hex or base64.
|
2022-04-27 05:17:41 -04:00
|
|
|
// We then calculate the expected PCR by hashing the input using SHA256,
|
|
|
|
// appending expected PCR for initialization, and then hashing once more.
|
2022-08-09 08:04:40 -04:00
|
|
|
func (v *Validator) updatePCR(pcrIndex uint32, encoded string) error {
|
2022-04-27 05:17:41 -04:00
|
|
|
if encoded == "" {
|
|
|
|
delete(v.pcrs, pcrIndex)
|
|
|
|
return nil
|
|
|
|
}
|
2022-11-24 04:57:58 -05:00
|
|
|
|
|
|
|
// decode from hex or base64
|
|
|
|
decoded, err := hex.DecodeString(encoded)
|
2022-04-27 05:17:41 -04:00
|
|
|
if err != nil {
|
2022-11-24 04:57:58 -05:00
|
|
|
hexErr := err
|
|
|
|
decoded, err = base64.StdEncoding.DecodeString(encoded)
|
|
|
|
if err != nil {
|
2023-02-07 06:56:25 -05:00
|
|
|
return fmt.Errorf("input [%s] could neither be hex decoded (%w) nor base64 decoded (%w)", encoded, hexErr, err)
|
2022-11-24 04:57:58 -05:00
|
|
|
}
|
2022-04-27 05:17:41 -04:00
|
|
|
}
|
|
|
|
// new_pcr_value := hash(old_pcr_value || data_to_extend)
|
|
|
|
// Since we use the TPM2_PCR_Event call to extend the PCR, data_to_extend is the hash of our input
|
|
|
|
hashedInput := sha256.Sum256(decoded)
|
2022-11-24 04:57:58 -05:00
|
|
|
oldExpected := v.pcrs[pcrIndex].Expected
|
|
|
|
expectedPcr := sha256.Sum256(append(oldExpected[:], hashedInput[:]...))
|
|
|
|
v.pcrs[pcrIndex] = measurements.Measurement{
|
2023-03-22 06:47:39 -04:00
|
|
|
Expected: expectedPcr,
|
|
|
|
ValidationOpt: v.pcrs[pcrIndex].ValidationOpt,
|
2022-11-24 04:57:58 -05:00
|
|
|
}
|
2022-04-27 05:17:41 -04:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-08-09 08:04:40 -04:00
|
|
|
func (v *Validator) setPCRs(config *config.Config) error {
|
2023-03-14 06:46:27 -04:00
|
|
|
switch v.attestationVariant {
|
|
|
|
case oid.AWSNitroTPM{}:
|
2022-10-21 06:24:18 -04:00
|
|
|
awsPCRs := config.Provider.AWS.Measurements
|
2022-11-24 04:57:58 -05:00
|
|
|
if len(awsPCRs) == 0 {
|
|
|
|
return errors.New("no expected measurement provided")
|
2022-04-19 11:02:02 -04:00
|
|
|
}
|
2022-10-21 06:24:18 -04:00
|
|
|
v.pcrs = awsPCRs
|
2023-03-14 06:46:27 -04:00
|
|
|
case oid.AzureSEVSNP{}, oid.AzureTrustedLaunch{}:
|
2022-05-16 12:54:25 -04:00
|
|
|
azurePCRs := config.Provider.Azure.Measurements
|
2022-11-24 04:57:58 -05:00
|
|
|
if len(azurePCRs) == 0 {
|
|
|
|
return errors.New("no expected measurement provided")
|
2022-04-19 11:02:02 -04:00
|
|
|
}
|
2022-04-27 05:17:41 -04:00
|
|
|
v.pcrs = azurePCRs
|
2023-03-14 06:46:27 -04:00
|
|
|
case oid.GCPSEVES{}:
|
2022-10-21 06:24:18 -04:00
|
|
|
gcpPCRs := config.Provider.GCP.Measurements
|
2022-11-24 04:57:58 -05:00
|
|
|
if len(gcpPCRs) == 0 {
|
|
|
|
return errors.New("no expected measurement provided")
|
2022-10-21 06:24:18 -04:00
|
|
|
}
|
|
|
|
v.pcrs = gcpPCRs
|
2023-03-14 06:46:27 -04:00
|
|
|
case oid.QEMUVTPM{}:
|
2022-05-16 12:54:25 -04:00
|
|
|
qemuPCRs := config.Provider.QEMU.Measurements
|
2022-11-24 04:57:58 -05:00
|
|
|
if len(qemuPCRs) == 0 {
|
|
|
|
return errors.New("no expected measurement provided")
|
2022-05-02 04:54:54 -04:00
|
|
|
}
|
|
|
|
v.pcrs = qemuPCRs
|
2022-04-19 11:02:02 -04:00
|
|
|
}
|
2022-04-27 05:17:41 -04:00
|
|
|
return nil
|
2022-04-19 11:02:02 -04:00
|
|
|
}
|
|
|
|
|
2022-08-09 08:04:40 -04:00
|
|
|
// V returns the validator as atls.Validator.
|
2022-08-12 09:59:45 -04:00
|
|
|
func (v *Validator) V(cmd *cobra.Command) atls.Validator {
|
|
|
|
v.updateValidator(cmd)
|
2022-08-09 08:04:40 -04:00
|
|
|
return v.validator
|
2022-04-19 11:02:02 -04:00
|
|
|
}
|
|
|
|
|
2022-08-09 08:04:40 -04:00
|
|
|
// PCRS returns the validator's PCR map.
|
2022-11-15 09:40:49 -05:00
|
|
|
func (v *Validator) PCRS() measurements.M {
|
2022-08-09 08:04:40 -04:00
|
|
|
return v.pcrs
|
|
|
|
}
|
|
|
|
|
2022-08-12 09:59:45 -04:00
|
|
|
func (v *Validator) updateValidator(cmd *cobra.Command) {
|
2023-03-03 10:50:25 -05:00
|
|
|
log := warnLogger{cmd: cmd, log: v.log}
|
2023-03-14 06:46:27 -04:00
|
|
|
|
|
|
|
// Use of a valid variant has been check in NewValidator so we may drop the error
|
2023-03-21 07:46:49 -04:00
|
|
|
v.validator, _ = choose.Validator(v.attestationVariant, v.pcrs, v.idKeyConfig, log)
|
2022-04-27 05:17:41 -04:00
|
|
|
}
|
|
|
|
|
2022-08-12 09:59:45 -04:00
|
|
|
// warnLogger implements logging of warnings for validators.
|
|
|
|
type warnLogger struct {
|
|
|
|
cmd *cobra.Command
|
2023-03-03 10:50:25 -05:00
|
|
|
log debugLog
|
2022-07-20 10:44:41 -04:00
|
|
|
}
|
|
|
|
|
2023-03-03 10:50:25 -05:00
|
|
|
// Infof messages are reduced to debug messages, since we don't want
|
|
|
|
// the extra info when using the CLI without setting the debug flag.
|
|
|
|
func (wl warnLogger) Infof(fmtStr string, args ...any) {
|
|
|
|
wl.log.Debugf(fmtStr, args...)
|
|
|
|
}
|
2022-10-14 10:29:21 -04:00
|
|
|
|
2022-08-12 09:59:45 -04:00
|
|
|
// Warnf prints a formatted warning from the validator.
|
2022-10-25 09:51:23 -04:00
|
|
|
func (wl warnLogger) Warnf(fmtStr string, args ...any) {
|
2022-08-12 09:59:45 -04:00
|
|
|
wl.cmd.PrintErrf("Warning: %s\n", fmt.Sprintf(fmtStr, args...))
|
2022-04-19 11:02:02 -04:00
|
|
|
}
|