Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-11-13 00:50:38 -05:00
Code Issues Projects Releases Packages Wiki Activity

internal: refactor oid package to variant package (#1538)

Browse source 
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße 2023-03-29 09:30:13 +02:00 • committed by GitHub
parent db5660e3d6
commit 99b12e4035
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
55 changed files with 287 additions and 240 deletions
Download patch file Download diff file Expand all files Collapse all files

4
cli/internal/cloudcmd/BUILD.bazel
View file

@ -33,7 +33,7 @@ go_library(
"//internal/constants",
"//internal/kubernetes",
"//internal/kubernetes/kubectl",
"//internal/oid",
"//internal/variant",
"//internal/versions",
"//internal/versions/components",
"//internal/versionsapi",
@ -83,7 +83,7 @@ go_test(
"//internal/config",
"//internal/constants",
"//internal/logger",
"//internal/oid",
"//internal/variant",
"//internal/versions",
"//internal/versions/components",
"//operators/constellation-node-operator/api/v1alpha1",

39
cli/internal/cloudcmd/validators.go
View file

@ -18,13 +18,13 @@ import (
"github.com/edgelesssys/constellation/v2/internal/attestation/idkeydigest"
"github.com/edgelesssys/constellation/v2/internal/attestation/measurements"
"github.com/edgelesssys/constellation/v2/internal/config"
"github.com/edgelesssys/constellation/v2/internal/oid"
"github.com/edgelesssys/constellation/v2/internal/variant"
"github.com/spf13/cobra"
)
// Validator validates Platform Configuration Registers (PCRs).
type Validator struct {
attestationVariant oid.Getter
attestationVariant variant.Variant
pcrs measurements.M
idKeyConfig idkeydigest.Config
validator atls.Validator
@ -34,17 +34,17 @@ type Validator struct {
// NewValidator creates a new Validator.
func NewValidator(conf *config.Config, maaURL string, log debugLog) (*Validator, error) {
v := Validator{log: log}
variant, err := oid.FromString(conf.AttestationVariant)
attestVariant, err := variant.FromString(conf.AttestationVariant)
if err != nil {
return nil, fmt.Errorf("parsing attestation variant: %w", err)
}
v.attestationVariant = variant // valid variant
v.attestationVariant = attestVariant // valid variant
if err := v.setPCRs(conf); err != nil {
return nil, err
}
if v.attestationVariant.OID().Equal(oid.AzureSEVSNP{}.OID()) {
if v.attestationVariant.Equal(variant.AzureSEVSNP{}) {
v.idKeyConfig = idkeydigest.Config{
IDKeyDigests: conf.Provider.Azure.IDKeyDigest,
EnforcementPolicy: conf.IDKeyDigestPolicy(),
@ -96,32 +96,11 @@ func (v *Validator) updatePCR(pcrIndex uint32, encoded string) error {
}
func (v *Validator) setPCRs(config *config.Config) error {
switch v.attestationVariant {
case oid.AWSNitroTPM{}:
awsPCRs := config.Provider.AWS.Measurements
if len(awsPCRs) == 0 {
return errors.New("no expected measurement provided")
}
v.pcrs = awsPCRs
case oid.AzureSEVSNP{}, oid.AzureTrustedLaunch{}:
azurePCRs := config.Provider.Azure.Measurements
if len(azurePCRs) == 0 {
return errors.New("no expected measurement provided")
}
v.pcrs = azurePCRs
case oid.GCPSEVES{}:
gcpPCRs := config.Provider.GCP.Measurements
if len(gcpPCRs) == 0 {
return errors.New("no expected measurement provided")
}
v.pcrs = gcpPCRs
case oid.QEMUVTPM{}:
qemuPCRs := config.Provider.QEMU.Measurements
if len(qemuPCRs) == 0 {
return errors.New("no expected measurement provided")
}
v.pcrs = qemuPCRs
measurements := config.GetMeasurements()
if len(measurements) == 0 {
return errors.New("no measurements found in config")
}
v.pcrs = measurements
return nil
}

46
cli/internal/cloudcmd/validators_test.go
View file

@ -21,7 +21,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/attestation/qemu"
"github.com/edgelesssys/constellation/v2/internal/config"
"github.com/edgelesssys/constellation/v2/internal/logger"
"github.com/edgelesssys/constellation/v2/internal/oid"
"github.com/edgelesssys/constellation/v2/internal/variant"
"github.com/spf13/cobra"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@ -43,7 +43,7 @@ func TestNewValidator(t *testing.T) {
}{
"gcp": {
config: &config.Config{
AttestationVariant: oid.GCPSEVES{}.String(),
AttestationVariant: variant.GCPSEVES{}.String(),
Provider: config.ProviderConfig{
GCP: &config.GCPConfig{
Measurements: testPCRs,
@ -53,7 +53,7 @@ func TestNewValidator(t *testing.T) {
},
"azure cvm": {
config: &config.Config{
AttestationVariant: oid.AzureSEVSNP{}.String(),
AttestationVariant: variant.AzureSEVSNP{}.String(),
Provider: config.ProviderConfig{
Azure: &config.AzureConfig{
Measurements: testPCRs,
@ -63,7 +63,7 @@ func TestNewValidator(t *testing.T) {
},
"azure trusted launch": {
config: &config.Config{
AttestationVariant: oid.AzureTrustedLaunch{}.String(),
AttestationVariant: variant.AzureTrustedLaunch{}.String(),
Provider: config.ProviderConfig{
Azure: &config.AzureConfig{
Measurements: testPCRs,
@ -73,7 +73,7 @@ func TestNewValidator(t *testing.T) {
},
"qemu": {
config: &config.Config{
AttestationVariant: oid.QEMUVTPM{}.String(),
AttestationVariant: variant.QEMUVTPM{}.String(),
Provider: config.ProviderConfig{
QEMU: &config.QEMUConfig{
Measurements: testPCRs,
@ -83,7 +83,7 @@ func TestNewValidator(t *testing.T) {
},
"no pcrs provided": {
config: &config.Config{
AttestationVariant: oid.AzureSEVSNP{}.String(),
AttestationVariant: variant.AzureSEVSNP{}.String(),
Provider: config.ProviderConfig{
Azure: &config.AzureConfig{
Measurements: measurements.M{},
@ -105,7 +105,7 @@ func TestNewValidator(t *testing.T) {
},
"set idkeydigest": {
config: &config.Config{
AttestationVariant: oid.AzureSEVSNP{}.String(),
AttestationVariant: variant.AzureSEVSNP{}.String(),
Provider: config.ProviderConfig{
Azure: &config.AzureConfig{
Measurements: testPCRs,
@ -128,7 +128,7 @@ func TestNewValidator(t *testing.T) {
} else {
assert.NoError(err)
assert.Equal(tc.config.GetMeasurements(), validators.pcrs)
variant, err := oid.FromString(tc.config.AttestationVariant)
variant, err := variant.FromString(tc.config.AttestationVariant)
require.NoError(t, err)
assert.Equal(variant, validators.attestationVariant)
}
@ -156,17 +156,17 @@ func TestValidatorV(t *testing.T) {
}
testCases := map[string]struct {
variant oid.Getter
variant variant.Variant
pcrs measurements.M
wantVs atls.Validator
}{
"gcp": {
variant: oid.GCPSEVES{},
variant: variant.GCPSEVES{},
pcrs: newTestPCRs(),
wantVs: gcp.NewValidator(newTestPCRs(), nil),
},
"azure cvm": {
variant: oid.AzureSEVSNP{},
variant: variant.AzureSEVSNP{},
pcrs: newTestPCRs(),
wantVs: snp.NewValidator(
newTestPCRs(),
@ -175,12 +175,12 @@ func TestValidatorV(t *testing.T) {
),
},
"azure trusted launch": {
variant: oid.AzureTrustedLaunch{},
variant: variant.AzureTrustedLaunch{},
pcrs: newTestPCRs(),
wantVs: trustedlaunch.NewValidator(newTestPCRs(), nil),
},
"qemu": {
variant: oid.QEMUVTPM{},
variant: variant.QEMUVTPM{},
pcrs: newTestPCRs(),
wantVs: qemu.NewValidator(newTestPCRs(), nil),
},
@ -235,50 +235,50 @@ func TestValidatorUpdateInitPCRs(t *testing.T) {
}
testCases := map[string]struct {
variant oid.Getter
variant variant.Variant
pcrs measurements.M
ownerID string
clusterID string
wantErr bool
}{
"gcp update owner ID": {
variant: oid.GCPSEVES{},
variant: variant.GCPSEVES{},
pcrs: newTestPCRs(),
ownerID: one64,
},
"gcp update cluster ID": {
variant: oid.GCPSEVES{},
variant: variant.GCPSEVES{},
pcrs: newTestPCRs(),
clusterID: one64,
},
"gcp update both": {
variant: oid.GCPSEVES{},
variant: variant.GCPSEVES{},
pcrs: newTestPCRs(),
ownerID: one64,
clusterID: one64,
},
"azure update owner ID": {
variant: oid.AzureSEVSNP{},
variant: variant.AzureSEVSNP{},
pcrs: newTestPCRs(),
ownerID: one64,
},
"azure update cluster ID": {
variant: oid.AzureSEVSNP{},
variant: variant.AzureSEVSNP{},
pcrs: newTestPCRs(),
clusterID: one64,
},
"azure update both": {
variant: oid.AzureSEVSNP{},
variant: variant.AzureSEVSNP{},
pcrs: newTestPCRs(),
ownerID: one64,
clusterID: one64,
},
"owner ID and cluster ID empty": {
variant: oid.GCPSEVES{},
variant: variant.GCPSEVES{},
pcrs: newTestPCRs(),
},
"invalid encoding": {
variant: oid.GCPSEVES{},
variant: variant.GCPSEVES{},
pcrs: newTestPCRs(),
ownerID: "invalid",
wantErr: true,
@ -421,7 +421,7 @@ func TestUpdatePCR(t *testing.T) {
}
validators := &Validator{
attestationVariant: oid.GCPSEVES{},
attestationVariant: variant.GCPSEVES{},
pcrs: pcrs,
}
err := validators.updatePCR(tc.pcrIndex, tc.encoded)

4
cli/internal/cmd/BUILD.bazel
View file

@ -61,9 +61,9 @@ go_library(
"//internal/kubernetes/kubectl",
"//internal/license",
"//internal/logger",
"//internal/oid",
"//internal/retry",
"//internal/sigstore",
"//internal/variant",
"//internal/versions",
"//internal/versionsapi",
"//internal/versionsapi/fetcher",
@ -127,7 +127,7 @@ go_test(
"//internal/kms/uri",
"//internal/license",
"//internal/logger",
"//internal/oid",
"//internal/variant",
"//internal/versions",
"//internal/versionsapi",
"//verify/verifyproto",

10
cli/internal/cmd/configgenerate.go
View file

@ -15,7 +15,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/config"
"github.com/edgelesssys/constellation/v2/internal/constants"
"github.com/edgelesssys/constellation/v2/internal/file"
"github.com/edgelesssys/constellation/v2/internal/oid"
"github.com/edgelesssys/constellation/v2/internal/variant"
"github.com/edgelesssys/constellation/v2/internal/versions"
"github.com/siderolabs/talos/pkg/machinery/config/encoder"
"github.com/spf13/afero"
@ -109,13 +109,13 @@ func createConfig(provider cloudprovider.Provider) *config.Config {
// TODO(AB#2976): Replace hardcoded values with user input
switch provider {
case cloudprovider.AWS:
conf.AttestationVariant = oid.AWSNitroTPM{}.String()
conf.AttestationVariant = variant.AWSNitroTPM{}.String()
case cloudprovider.Azure:
conf.AttestationVariant = oid.AzureSEVSNP{}.String()
conf.AttestationVariant = variant.AzureSEVSNP{}.String()
case cloudprovider.GCP:
conf.AttestationVariant = oid.GCPSEVES{}.String()
conf.AttestationVariant = variant.GCPSEVES{}.String()
case cloudprovider.QEMU:
conf.AttestationVariant = oid.QEMUVTPM{}.String()
conf.AttestationVariant = variant.QEMUVTPM{}.String()
}
return conf

4
cli/internal/cmd/configgenerate_test.go
View file

@ -15,7 +15,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/constants"
"github.com/edgelesssys/constellation/v2/internal/file"
"github.com/edgelesssys/constellation/v2/internal/logger"
"github.com/edgelesssys/constellation/v2/internal/oid"
"github.com/edgelesssys/constellation/v2/internal/variant"
"github.com/edgelesssys/constellation/v2/internal/versions"
"github.com/spf13/afero"
"github.com/stretchr/testify/assert"
@ -94,7 +94,7 @@ func TestConfigGenerateDefaultGCPSpecific(t *testing.T) {
require.NoError(cg.configGenerate(cmd, fileHandler, cloudprovider.GCP))
// TODO(AB#2976): Remove this once attestation variants are dynamically created
wantConf.AttestationVariant = oid.GCPSEVES{}.String()
wantConf.AttestationVariant = variant.GCPSEVES{}.String()
var readConfig config.Config
err := fileHandler.ReadYAML(constants.ConfigFilename, &readConfig)

18
cli/internal/cmd/init_test.go
View file

@ -33,7 +33,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/kms/uri"
"github.com/edgelesssys/constellation/v2/internal/license"
"github.com/edgelesssys/constellation/v2/internal/logger"
"github.com/edgelesssys/constellation/v2/internal/oid"
"github.com/edgelesssys/constellation/v2/internal/variant"
"github.com/edgelesssys/constellation/v2/internal/versions"
"github.com/spf13/afero"
"github.com/stretchr/testify/assert"
@ -399,14 +399,14 @@ func TestAttestation(t *testing.T) {
netDialer := testdialer.NewBufconnDialer()
newDialer := func(v *cloudcmd.Validator) *dialer.Dialer {
validator := &testValidator{
Getter: oid.QEMUVTPM{},
Getter: variant.QEMUVTPM{},
pcrs: v.PCRS(),
}
return dialer.New(nil, validator, netDialer)
}
issuer := &testIssuer{
Getter: oid.QEMUVTPM{},
Getter: variant.QEMUVTPM{},
pcrs: map[uint32][]byte{
0: bytes.Repeat([]byte{0xFF}, 32),
1: bytes.Repeat([]byte{0xFF}, 32),
@ -436,7 +436,7 @@ func TestAttestation(t *testing.T) {
cfg := config.Default()
cfg.Image = "image"
cfg.AttestationVariant = oid.QEMUVTPM{}.String()
cfg.AttestationVariant = variant.QEMUVTPM{}.String()
cfg.RemoveProviderExcept(cloudprovider.QEMU)
cfg.Provider.QEMU.Measurements[0] = measurements.WithAllBytes(0x00, measurements.Enforce)
cfg.Provider.QEMU.Measurements[1] = measurements.WithAllBytes(0x11, measurements.Enforce)
@ -460,7 +460,7 @@ func TestAttestation(t *testing.T) {
}
type testValidator struct {
oid.Getter
variant.Getter
pcrs measurements.M
}
@ -482,7 +482,7 @@ func (v *testValidator) Validate(_ context.Context, attDoc []byte, _ []byte) ([]
}
type testIssuer struct {
oid.Getter
variant.Getter
pcrs map[uint32][]byte
}
@ -530,7 +530,7 @@ func defaultConfigWithExpectedMeasurements(t *testing.T, conf *config.Config, cs
switch csp {
case cloudprovider.Azure:
conf.AttestationVariant = oid.AzureSEVSNP{}.String()
conf.AttestationVariant = variant.AzureSEVSNP{}.String()
conf.Provider.Azure.SubscriptionID = "01234567-0123-0123-0123-0123456789ab"
conf.Provider.Azure.TenantID = "01234567-0123-0123-0123-0123456789ab"
conf.Provider.Azure.Location = "test-location"
@ -542,7 +542,7 @@ func defaultConfigWithExpectedMeasurements(t *testing.T, conf *config.Config, cs
conf.Provider.Azure.Measurements[9] = measurements.WithAllBytes(0x11, measurements.Enforce)
conf.Provider.Azure.Measurements[12] = measurements.WithAllBytes(0xcc, measurements.Enforce)
case cloudprovider.GCP:
conf.AttestationVariant = oid.GCPSEVES{}.String()
conf.AttestationVariant = variant.GCPSEVES{}.String()
conf.Provider.GCP.Region = "test-region"
conf.Provider.GCP.Project = "test-project"
conf.Provider.GCP.Zone = "test-zone"
@ -551,7 +551,7 @@ func defaultConfigWithExpectedMeasurements(t *testing.T, conf *config.Config, cs
conf.Provider.GCP.Measurements[9] = measurements.WithAllBytes(0x11, measurements.Enforce)
conf.Provider.GCP.Measurements[12] = measurements.WithAllBytes(0xcc, measurements.Enforce)
case cloudprovider.QEMU:
conf.AttestationVariant = oid.QEMUVTPM{}.String()
conf.AttestationVariant = variant.QEMUVTPM{}.String()
conf.Provider.QEMU.Measurements[4] = measurements.WithAllBytes(0x44, measurements.Enforce)
conf.Provider.QEMU.Measurements[9] = measurements.WithAllBytes(0x11, measurements.Enforce)
conf.Provider.QEMU.Measurements[12] = measurements.WithAllBytes(0xcc, measurements.Enforce)

4
cli/internal/cmd/verify_test.go
View file

@ -25,7 +25,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/grpc/dialer"
"github.com/edgelesssys/constellation/v2/internal/grpc/testdialer"
"github.com/edgelesssys/constellation/v2/internal/logger"
"github.com/edgelesssys/constellation/v2/internal/oid"
"github.com/edgelesssys/constellation/v2/internal/variant"
"github.com/edgelesssys/constellation/v2/verify/verifyproto"
"github.com/spf13/afero"
"github.com/stretchr/testify/assert"
@ -247,7 +247,7 @@ func TestVerifyClient(t *testing.T) {
Nonce: tc.nonce,
}
err = verifier.Verify(context.Background(), addr, request, atls.NewFakeValidator(oid.Dummy{}))
err = verifier.Verify(context.Background(), addr, request, atls.NewFakeValidator(variant.Dummy{}))
if tc.wantErr {
assert.Error(err)

2
cli/internal/helm/BUILD.bazel
View file

@ -362,7 +362,7 @@ go_test(
"//internal/deploy/helm",
"//internal/file",
"//internal/logger",
"//internal/oid",
"//internal/variant",
"@com_github_pkg_errors//:errors",
"@com_github_spf13_afero//:afero",
"@com_github_stretchr_testify//assert",

12
cli/internal/helm/loader_test.go
View file

@ -23,7 +23,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
"github.com/edgelesssys/constellation/v2/internal/config"
"github.com/edgelesssys/constellation/v2/internal/deploy/helm"
"github.com/edgelesssys/constellation/v2/internal/oid"
"github.com/edgelesssys/constellation/v2/internal/variant"
"github.com/pkg/errors"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@ -62,7 +62,7 @@ func TestConstellationServices(t *testing.T) {
}{
"AWS": {
config: &config.Config{
AttestationVariant: oid.AWSNitroTPM{}.String(),
AttestationVariant: variant.AWSNitroTPM{}.String(),
Provider: config.ProviderConfig{AWS: &config.AWSConfig{}},
},
valuesModifier: prepareAWSValues,
@ -70,7 +70,7 @@ func TestConstellationServices(t *testing.T) {
},
"Azure": {
config: &config.Config{
AttestationVariant: oid.AzureSEVSNP{}.String(),
AttestationVariant: variant.AzureSEVSNP{}.String(),
Provider: config.ProviderConfig{Azure: &config.AzureConfig{
DeployCSIDriver: toPtr(true),
EnforceIDKeyDigest: idkeydigest.StrictChecking,
@ -87,7 +87,7 @@ func TestConstellationServices(t *testing.T) {
},
"GCP": {
config: &config.Config{
AttestationVariant: oid.GCPSEVES{}.String(),
AttestationVariant: variant.GCPSEVES{}.String(),
Provider: config.ProviderConfig{GCP: &config.GCPConfig{
DeployCSIDriver: toPtr(true),
}},
@ -97,7 +97,7 @@ func TestConstellationServices(t *testing.T) {
},
"OpenStack": {
config: &config.Config{
AttestationVariant: oid.Dummy{}.String(),
AttestationVariant: variant.Dummy{}.String(),
Provider: config.ProviderConfig{OpenStack: &config.OpenStackConfig{}},
},
valuesModifier: prepareOpenStackValues,
@ -105,7 +105,7 @@ func TestConstellationServices(t *testing.T) {
},
"QEMU": {
config: &config.Config{
AttestationVariant: oid.QEMUVTPM{}.String(),
AttestationVariant: variant.QEMUVTPM{}.String(),
Provider: config.ProviderConfig{QEMU: &config.QEMUConfig{}},
},
valuesModifier: prepareQEMUValues,