Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-02-23 00:10:06 -05:00
Code Issues Packages Projects Releases Wiki Activity

attestation: use AWS attestation

Browse Source
This commit is contained in:
Leonard Cohnen 2022-10-21 17:09:10 +02:00 committed by 3u13r
parent f199b08068
commit 015b12d8ff
3 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bootstrapper/cmd/bootstrapper/main.go
View File

@ -91,7 +91,7 @@ func main() {
log.With(zap.Error(err)).Fatalf("Failed to marshal PCRs") log.With(zap.Error(err)).Fatalf("Failed to marshal PCRs")
} }
issuer = initserver.NewIssuerWrapper(&aws.Issuer{}, vmtype.Unknown, nil) issuer = initserver.NewIssuerWrapper(aws.NewIssuer(), vmtype.Unknown, nil)
metadata, err := awscloud.New(ctx) metadata, err := awscloud.New(ctx)
if err != nil { if err != nil {

17
cli/internal/cloudcmd/validators.go
View File

@ -14,6 +14,7 @@ import (
"fmt" "fmt"
"github.com/edgelesssys/constellation/v2/internal/atls" "github.com/edgelesssys/constellation/v2/internal/atls"
"github.com/edgelesssys/constellation/v2/internal/attestation/aws"
"github.com/edgelesssys/constellation/v2/internal/attestation/azure/snp" "github.com/edgelesssys/constellation/v2/internal/attestation/azure/snp"
"github.com/edgelesssys/constellation/v2/internal/attestation/azure/trustedlaunch" "github.com/edgelesssys/constellation/v2/internal/attestation/azure/trustedlaunch"
"github.com/edgelesssys/constellation/v2/internal/attestation/gcp" "github.com/edgelesssys/constellation/v2/internal/attestation/gcp"
@ -34,28 +35,24 @@ type Validator struct {
validator atls.Validator validator atls.Validator
} }
func NewValidator(provider cloudprovider.Provider, config *config.Config) (*Validator, error) { func NewValidator(provider cloudprovider.Provider, conf *config.Config) (*Validator, error) {
v := Validator{} v := Validator{}
if provider == cloudprovider.AWS {
// TODO: Implement AWS validator
return nil, errors.New("no validator for AWS available yet")
}
if provider == cloudprovider.Unknown { if provider == cloudprovider.Unknown {
return nil, errors.New("unknown cloud provider") return nil, errors.New("unknown cloud provider")
} }
v.provider = provider v.provider = provider
if err := v.setPCRs(config); err != nil { if err := v.setPCRs(conf); err != nil {
return nil, err return nil, err
} }
if v.provider == cloudprovider.Azure { if v.provider == cloudprovider.Azure {
v.azureCVM = *config.Provider.Azure.ConfidentialVM v.azureCVM = *conf.Provider.Azure.ConfidentialVM
if v.azureCVM { if v.azureCVM {
idkeydigest, err := hex.DecodeString(config.Provider.Azure.IDKeyDigest) idkeydigest, err := hex.DecodeString(conf.Provider.Azure.IDKeyDigest)
if err != nil { if err != nil {
return nil, fmt.Errorf("bad config: decoding idkeydigest from config: %w", err) return nil, fmt.Errorf("bad config: decoding idkeydigest from config: %w", err)
} }
v.enforceIDKeyDigest = *config.Provider.Azure.EnforceIDKeyDigest v.enforceIDKeyDigest = *conf.Provider.Azure.EnforceIDKeyDigest
v.idkeydigest = idkeydigest v.idkeydigest = idkeydigest
} }
} }
@ -162,6 +159,8 @@ func (v *Validator) updateValidator(cmd *cobra.Command) {
} else { } else {
v.validator = trustedlaunch.NewValidator(v.pcrs, v.enforcedPCRs, log) v.validator = trustedlaunch.NewValidator(v.pcrs, v.enforcedPCRs, log)
} }
case cloudprovider.AWS:
v.validator = aws.NewValidator(v.pcrs, v.enforcedPCRs, log)
case cloudprovider.QEMU: case cloudprovider.QEMU:
v.validator = qemu.NewValidator(v.pcrs, v.enforcedPCRs, log) v.validator = qemu.NewValidator(v.pcrs, v.enforcedPCRs, log)
} }

2
cli/internal/cmd/init.go
View File

@ -231,6 +231,8 @@ func writeRow(wr io.Writer, col1 string, col2 string) {
func getEnforcedPCRs(provider cloudprovider.Provider, config *config.Config) []uint32 { func getEnforcedPCRs(provider cloudprovider.Provider, config *config.Config) []uint32 {
switch provider { switch provider {
case cloudprovider.AWS:
return config.Provider.AWS.EnforcedMeasurements
case cloudprovider.Azure: case cloudprovider.Azure:
return config.Provider.Azure.EnforcedMeasurements return config.Provider.Azure.EnforcedMeasurements
case cloudprovider.GCP: case cloudprovider.GCP: