diff --git a/cli/internal/cmd/init_test.go b/cli/internal/cmd/init_test.go index d7ca5070b..52811658c 100644 --- a/cli/internal/cmd/init_test.go +++ b/cli/internal/cmd/init_test.go @@ -400,14 +400,14 @@ func TestAttestation(t *testing.T) { netDialer := testdialer.NewBufconnDialer() newDialer := func(v *cloudcmd.Validator) *dialer.Dialer { validator := &testValidator{ - Getter: oid.QEMU{}, + Getter: oid.QEMUVTPM{}, pcrs: v.PCRS(), } return dialer.New(nil, validator, netDialer) } issuer := &testIssuer{ - Getter: oid.QEMU{}, + Getter: oid.QEMUVTPM{}, pcrs: map[uint32][]byte{ 0: bytes.Repeat([]byte{0xFF}, 32), 1: bytes.Repeat([]byte{0xFF}, 32), diff --git a/internal/attestation/aws/issuer.go b/internal/attestation/aws/issuer.go index 3a02363b8..539587ea4 100644 --- a/internal/attestation/aws/issuer.go +++ b/internal/attestation/aws/issuer.go @@ -23,7 +23,7 @@ import ( // Issuer for AWS TPM attestation. type Issuer struct { - oid.AWS + oid.AWSNitroTPM *vtpm.Issuer } diff --git a/internal/attestation/aws/validator.go b/internal/attestation/aws/validator.go index 99fafe1cc..feec836b3 100644 --- a/internal/attestation/aws/validator.go +++ b/internal/attestation/aws/validator.go @@ -23,7 +23,7 @@ import ( // Validator for AWS TPM attestation. type Validator struct { - oid.AWS + oid.AWSNitroTPM *vtpm.Validator getDescribeClient func(context.Context, string) (awsMetadataAPI, error) } diff --git a/internal/attestation/azure/snp/issuer.go b/internal/attestation/azure/snp/issuer.go index cc08f89be..7e010dbbf 100644 --- a/internal/attestation/azure/snp/issuer.go +++ b/internal/attestation/azure/snp/issuer.go @@ -51,7 +51,7 @@ func GetIDKeyDigest(open vtpm.TPMOpenFunc) ([]byte, error) { // Issuer for Azure TPM attestation. type Issuer struct { - oid.AzureSNP + oid.AzureSEVSNP *vtpm.Issuer } diff --git a/internal/attestation/azure/snp/validator.go b/internal/attestation/azure/snp/validator.go index cffc1e1e5..ae02a79a6 100644 --- a/internal/attestation/azure/snp/validator.go +++ b/internal/attestation/azure/snp/validator.go @@ -38,7 +38,7 @@ const ( // Validator for Azure confidential VM attestation. type Validator struct { - oid.AzureSNP + oid.AzureSEVSNP *vtpm.Validator } diff --git a/internal/attestation/gcp/issuer.go b/internal/attestation/gcp/issuer.go index dd1f67d42..ed1f650cb 100644 --- a/internal/attestation/gcp/issuer.go +++ b/internal/attestation/gcp/issuer.go @@ -20,7 +20,7 @@ import ( // Issuer for GCP confidential VM attestation. type Issuer struct { - oid.GCP + oid.GCPSEVES *vtpm.Issuer } diff --git a/internal/attestation/gcp/validator.go b/internal/attestation/gcp/validator.go index d66f97ba4..fda8d3a27 100644 --- a/internal/attestation/gcp/validator.go +++ b/internal/attestation/gcp/validator.go @@ -30,7 +30,7 @@ import ( // Validator for GCP confidential VM attestation. type Validator struct { - oid.GCP + oid.GCPSEVES *vtpm.Validator } diff --git a/internal/attestation/qemu/issuer.go b/internal/attestation/qemu/issuer.go index 860529b50..46794970e 100644 --- a/internal/attestation/qemu/issuer.go +++ b/internal/attestation/qemu/issuer.go @@ -16,7 +16,7 @@ import ( // Issuer for qemu TPM attestation. type Issuer struct { - oid.QEMU + oid.QEMUVTPM *vtpm.Issuer } diff --git a/internal/attestation/qemu/validator.go b/internal/attestation/qemu/validator.go index 3730e13c3..74145ef7f 100644 --- a/internal/attestation/qemu/validator.go +++ b/internal/attestation/qemu/validator.go @@ -17,7 +17,7 @@ import ( // Validator for QEMU VM attestation. type Validator struct { - oid.QEMU + oid.QEMUVTPM *vtpm.Validator } diff --git a/internal/oid/oid.go b/internal/oid/oid.go index b95081c04..a2df0a71b 100644 --- a/internal/oid/oid.go +++ b/internal/oid/oid.go @@ -25,6 +25,7 @@ package oid import ( "encoding/asn1" + "errors" ) // Getter returns an ASN.1 Object Identifier. @@ -32,6 +33,25 @@ type Getter interface { OID() asn1.ObjectIdentifier } +// FromString returns the OID for the given string. +func FromString(oid string) (Getter, error) { + switch oid { + case dummy: + return Dummy{}, nil + case awsNitroTPM: + return AWSNitroTPM{}, nil + case gcpSEVES: + return GCPSEVES{}, nil + case azureSEVSNP: + return AzureSEVSNP{}, nil + case azureTrustedLaunch: + return AzureTrustedLaunch{}, nil + case qemuVTPM: + return QEMUVTPM{}, nil + } + return nil, errors.New("unknown OID") +} + // Dummy OID for testing. type Dummy struct{} @@ -40,30 +60,50 @@ func (Dummy) OID() asn1.ObjectIdentifier { return asn1.ObjectIdentifier{1, 3, 9900, 1, 1} } -// AWS holds the AWS OID. -type AWS struct{} +// String returns the string representation of the OID. +func (Dummy) String() string { + return dummy +} + +// AWSNitroTPM holds the AWS nitro TPM OID. +type AWSNitroTPM struct{} // OID returns the struct's object identifier. -func (AWS) OID() asn1.ObjectIdentifier { +func (AWSNitroTPM) OID() asn1.ObjectIdentifier { return asn1.ObjectIdentifier{1, 3, 9900, 2, 1} } -// GCP holds the GCP OID. -type GCP struct{} +// String returns the string representation of the OID. +func (AWSNitroTPM) String() string { + return awsNitroTPM +} + +// GCPSEVES holds the GCP SEV-ES OID. +type GCPSEVES struct{} // OID returns the struct's object identifier. -func (GCP) OID() asn1.ObjectIdentifier { +func (GCPSEVES) OID() asn1.ObjectIdentifier { return asn1.ObjectIdentifier{1, 3, 9900, 3, 1} } -// AzureSNP holds the OID for Azure SNP CVMs. -type AzureSNP struct{} +// String returns the string representation of the OID. +func (GCPSEVES) String() string { + return gcpSEVES +} + +// AzureSEVSNP holds the OID for Azure SNP CVMs. +type AzureSEVSNP struct{} // OID returns the struct's object identifier. -func (AzureSNP) OID() asn1.ObjectIdentifier { +func (AzureSEVSNP) OID() asn1.ObjectIdentifier { return asn1.ObjectIdentifier{1, 3, 9900, 4, 1} } +// String returns the string representation of the OID. +func (AzureSEVSNP) String() string { + return azureSEVSNP +} + // AzureTrustedLaunch holds the OID for Azure TrustedLaunch VMs. type AzureTrustedLaunch struct{} @@ -72,10 +112,29 @@ func (AzureTrustedLaunch) OID() asn1.ObjectIdentifier { return asn1.ObjectIdentifier{1, 3, 9900, 4, 2} } -// QEMU holds the QEMU OID. -type QEMU struct{} +// String returns the string representation of the OID. +func (AzureTrustedLaunch) String() string { + return azureTrustedLaunch +} + +// QEMUVTPM holds the QEMUVTPM OID. +type QEMUVTPM struct{} // OID returns the struct's object identifier. -func (QEMU) OID() asn1.ObjectIdentifier { +func (QEMUVTPM) OID() asn1.ObjectIdentifier { return asn1.ObjectIdentifier{1, 3, 9900, 5, 1} } + +// String returns the string representation of the OID. +func (QEMUVTPM) String() string { + return qemuVTPM +} + +const ( + dummy = "dummy" + awsNitroTPM = "aws-nitro-tpm" + gcpSEVES = "gcp-sev-es" + azureSEVSNP = "azure-sev-snp" + azureTrustedLaunch = "azure-trustedlaunch" + qemuVTPM = "qemu-vtpm" +)