Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-05-02 06:16:08 -04:00
Code Issues Projects Releases Packages Wiki Activity

AB#1915 Local PCR calculation (#243)

Browse source 
* Add QEMU cloud-logging

* Add QEMU metadata endpoints to collect logs during cluster boot

* Send PCRs to QEMU metadata if boot fails on Azure or GCP

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße 2022-07-04 12:59:43 +02:00 • committed by GitHub
parent 70efb92adc
commit 4be29b04dc
9 changed files with 348 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hack/qemu-metadata-api/main.go
View file

@ -5,7 +5,9 @@ import (
"github.com/edgelesssys/constellation/hack/qemu-metadata-api/server"
"github.com/edgelesssys/constellation/hack/qemu-metadata-api/virtwrapper"
"github.com/edgelesssys/constellation/internal/file"
"github.com/edgelesssys/constellation/internal/logger"
"github.com/spf13/afero"
"go.uber.org/zap"
"go.uber.org/zap/zapcore"
"libvirt.org/go/libvirt"
@ -23,7 +25,7 @@ func main() {
}
defer conn.Close()
serv := server.New(log, &virtwrapper.Connect{Conn: conn})
serv := server.New(log, &virtwrapper.Connect{Conn: conn}, file.NewHandler(afero.NewOsFs()))
if err := serv.ListenAndServe(*bindPort); err != nil {
log.With(zap.Error(err)).Fatalf("Failed to serve")
}

103
hack/qemu-metadata-api/server/server.go
View file

@ -1,8 +1,10 @@
package server
import (
"encoding/base64"
"encoding/json"
"fmt"
"io"
"net"
"net/http"
"strings"
@ -10,19 +12,24 @@ import (
"github.com/edgelesssys/constellation/coordinator/cloudprovider/cloudtypes"
"github.com/edgelesssys/constellation/coordinator/role"
"github.com/edgelesssys/constellation/hack/qemu-metadata-api/virtwrapper"
"github.com/edgelesssys/constellation/internal/file"
"github.com/edgelesssys/constellation/internal/logger"
"go.uber.org/zap"
)
const exportedPCRsDir = "/pcrs/"
type Server struct {
log *logger.Logger
virt virConnect
file file.Handler
}
func New(log *logger.Logger, conn virConnect) *Server {
func New(log *logger.Logger, conn virConnect, file file.Handler) *Server {
return &Server{
log: log,
virt: conn,
file: file,
}
}
@ -30,6 +37,8 @@ func (s *Server) ListenAndServe(port string) error {
mux := http.NewServeMux()
mux.Handle("/self", http.HandlerFunc(s.listSelf))
mux.Handle("/peers", http.HandlerFunc(s.listPeers))
mux.Handle("/log", http.HandlerFunc(s.postLog))
mux.Handle("/pcrs", http.HandlerFunc(s.exportPCRs))
server := http.Server{
Handler: mux,
@ -101,6 +110,98 @@ func (s *Server) listPeers(w http.ResponseWriter, r *http.Request) {
log.Infof("Request successful")
}
// postLog writes implements cloud-logging for QEMU instances.
func (s *Server) postLog(w http.ResponseWriter, r *http.Request) {
log := s.log.With(zap.String("peer", r.RemoteAddr))
if r.Method != http.MethodPost {
log.With(zap.String("method", r.Method)).Errorf("Invalid method for /log")
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
return
}
log.Infof("Serving POST request for /log")
if r.Body == nil {
log.Errorf("Request body is empty")
http.Error(w, "Request body is empty", http.StatusBadRequest)
return
}
msg, err := io.ReadAll(r.Body)
if err != nil {
log.With(zap.Error(err)).Errorf("Failed to read request body")
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
log.With(zap.String("message", string(msg))).Infof("Cloud-logging entry")
}
// exportPCRs allows QEMU instances to export their TPM state during boot.
// This can be used to check expected PCRs for GCP/Azure cloud images locally.
func (s *Server) exportPCRs(w http.ResponseWriter, r *http.Request) {
log := s.log.With(zap.String("peer", r.RemoteAddr))
if r.Method != http.MethodPost {
log.With(zap.String("method", r.Method)).Errorf("Invalid method for /log")
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
return
}
log.Infof("Serving POST request for /pcrs")
if r.Body == nil {
log.Errorf("Request body is empty")
http.Error(w, "Request body is empty", http.StatusBadRequest)
return
}
// unmarshal the request body into a map of PCRs
var pcrs map[uint32][]byte
if err := json.NewDecoder(r.Body).Decode(&pcrs); err != nil {
log.With(zap.Error(err)).Errorf("Failed to read request body")
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
// get name of the node sending the export request
var nodeName string
peers, err := s.listAll()
if err != nil {
log.With(zap.Error(err)).Errorf("Failed to list peer metadata")
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
remoteIP, _, err := net.SplitHostPort(r.RemoteAddr)
if err != nil {
log.With(zap.Error(err)).Errorf("Failed to parse remote address")
http.Error(w, fmt.Sprintf("Failed to parse remote address: %s\n", err), http.StatusInternalServerError)
return
}
for _, peer := range peers {
if peer.PublicIPs[0] == remoteIP {
nodeName = peer.Name
}
}
// write PCRs as JSON and YAML to disk
if err := s.file.WriteJSON(exportedPCRsDir+nodeName+"_pcrs.json", pcrs, file.OptOverwrite); err != nil {
log.With(zap.Error(err)).Errorf("Failed to write pcrs to JSON")
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
// convert []byte to base64 encoded strings for YAML encoding
pcrsYAML := make(map[uint32]string)
for k, v := range pcrs {
pcrsYAML[k] = base64.StdEncoding.EncodeToString(v)
}
if err := s.file.WriteYAML(exportedPCRsDir+nodeName+"_pcrs.yaml", pcrsYAML, file.OptOverwrite); err != nil {
log.With(zap.Error(err)).Errorf("Failed to write pcrs to YAML")
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
}
// listAll returns a list of all active peers.
func (s *Server) listAll() ([]cloudtypes.Instance, error) {
net, err := s.virt.LookupNetworkByName("constellation")

150
hack/qemu-metadata-api/server/server_test.go
View file

@ -6,11 +6,14 @@ import (
"io"
"net/http"
"net/http/httptest"
"strings"
"testing"
"github.com/edgelesssys/constellation/coordinator/cloudprovider/cloudtypes"
"github.com/edgelesssys/constellation/hack/qemu-metadata-api/virtwrapper"
"github.com/edgelesssys/constellation/internal/file"
"github.com/edgelesssys/constellation/internal/logger"
"github.com/spf13/afero"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"libvirt.org/go/libvirt"
@ -63,7 +66,7 @@ func TestListAll(t *testing.T) {
t.Run(name, func(t *testing.T) {
assert := assert.New(t)
server := New(logger.NewTest(t), tc.connect)
server := New(logger.NewTest(t), tc.connect, file.Handler{})
res, err := server.listAll()
@ -140,7 +143,7 @@ func TestListSelf(t *testing.T) {
assert := assert.New(t)
require := require.New(t)
server := New(logger.NewTest(t), tc.connect)
server := New(logger.NewTest(t), tc.connect, file.Handler{})
req, err := http.NewRequest(http.MethodGet, "http://192.0.0.1/self", nil)
require.NoError(err)
@ -202,7 +205,7 @@ func TestListPeers(t *testing.T) {
assert := assert.New(t)
require := require.New(t)
server := New(logger.NewTest(t), tc.connect)
server := New(logger.NewTest(t), tc.connect, file.Handler{})
req, err := http.NewRequest(http.MethodGet, "http://192.0.0.1/peers", nil)
require.NoError(err)
@ -226,6 +229,147 @@ func TestListPeers(t *testing.T) {
}
}
func TestPostLog(t *testing.T) {
testCases := map[string]struct {
remoteAddr string
message io.Reader
method string
wantErr bool
}{
"success": {
remoteAddr: "192.0.100.1:1234",
method: http.MethodPost,
message: strings.NewReader("test message"),
},
"no body": {
remoteAddr: "192.0.100.1:1234",
method: http.MethodPost,
message: nil,
wantErr: true,
},
"incorrect method": {
remoteAddr: "192.0.100.1:1234",
method: http.MethodGet,
message: strings.NewReader("test message"),
wantErr: true,
},
}
for name, tc := range testCases {
t.Run(name, func(t *testing.T) {
assert := assert.New(t)
require := require.New(t)
server := New(logger.NewTest(t), &stubConnect{}, file.NewHandler(afero.NewMemMapFs()))
req, err := http.NewRequest(tc.method, "http://192.0.0.1/logs", tc.message)
require.NoError(err)
req.RemoteAddr = tc.remoteAddr
w := httptest.NewRecorder()
server.postLog(w, req)
if tc.wantErr {
assert.NotEqual(http.StatusOK, w.Code)
} else {
assert.Equal(http.StatusOK, w.Code)
}
})
}
}
func TestExportPCRs(t *testing.T) {
defaultConnect := &stubConnect{
network: stubNetwork{
leases: []libvirt.NetworkDHCPLease{
{
IPaddr: "192.0.100.1",
Hostname: "control-plane-0",
},
},
},
}
testCases := map[string]struct {
remoteAddr string
connect *stubConnect
message string
method string
wantErr bool
}{
"success": {
remoteAddr: "192.0.100.1:1234",
connect: defaultConnect,
method: http.MethodPost,
message: mustMarshal(t, map[uint32][]byte{0: []byte("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")}),
},
"incorrect method": {
remoteAddr: "192.0.100.1:1234",
connect: defaultConnect,
message: mustMarshal(t, map[uint32][]byte{0: []byte("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")}),
method: http.MethodGet,
wantErr: true,
},
"listAll error": {
remoteAddr: "192.0.100.1:1234",
connect: &stubConnect{
getNetworkErr: errors.New("error"),
},
message: mustMarshal(t, map[uint32][]byte{0: []byte("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")}),
method: http.MethodPost,
wantErr: true,
},
"invalid message": {
remoteAddr: "192.0.100.1:1234",
connect: defaultConnect,
method: http.MethodPost,
message: "message",
wantErr: true,
},
"invalid remote address": {
remoteAddr: "localhost",
connect: defaultConnect,
method: http.MethodPost,
message: mustMarshal(t, map[uint32][]byte{0: []byte("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")}),
wantErr: true,
},
}
for name, tc := range testCases {
t.Run(name, func(t *testing.T) {
assert := assert.New(t)
require := require.New(t)
file := file.NewHandler(afero.NewMemMapFs())
server := New(logger.NewTest(t), tc.connect, file)
req, err := http.NewRequest(tc.method, "http://192.0.0.1/pcrs", strings.NewReader(tc.message))
require.NoError(err)
req.RemoteAddr = tc.remoteAddr
w := httptest.NewRecorder()
server.exportPCRs(w, req)
if tc.wantErr {
assert.NotEqual(http.StatusOK, w.Code)
return
}
assert.Equal(http.StatusOK, w.Code)
output, err := file.Read(exportedPCRsDir + tc.connect.network.leases[0].Hostname + "_pcrs.json")
require.NoError(err)
assert.JSONEq(tc.message, string(output))
})
}
}
func mustMarshal(t *testing.T, v interface{}) string {
t.Helper()
b, err := json.Marshal(v)
require.NoError(t, err)
return string(b)
}
type stubConnect struct {
network stubNetwork
getNetworkErr error