mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-08-01 11:36:10 -04:00
AB#2316 Configurable enforced PCRs (#361)
* Add warnings for non enforced, untrusted PCRs * Fix global state in Config PCR map Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße
GitHub
parent
9478303f80
commit
ba4471a228
30 changed files with 350 additions and 323 deletions
|
|
@ -5,7 +5,6 @@ import (
|
|||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/edgelesssys/constellation/internal/atls"
|
||||
"github.com/edgelesssys/constellation/internal/attestation/azure"
|
||||
|
|
@ -14,14 +13,14 @@ import (
|
|||
"github.com/edgelesssys/constellation/internal/attestation/vtpm"
|
||||
"github.com/edgelesssys/constellation/internal/cloud/cloudprovider"
|
||||
"github.com/edgelesssys/constellation/internal/config"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
const warningStr = "Warning: not verifying the Constellation cluster's %s measurements\n"
|
||||
|
||||
type Validator struct {
|
||||
provider cloudprovider.Provider
|
||||
pcrs map[uint32][]byte
|
||||
validator atls.Validator
|
||||
provider cloudprovider.Provider
|
||||
pcrs map[uint32][]byte
|
||||
enforcedPCRs []uint32
|
||||
validator atls.Validator
|
||||
}
|
||||
|
||||
func NewValidator(provider cloudprovider.Provider, config *config.Config) (*Validator, error) {
|
||||
|
|
@ -51,6 +50,16 @@ func (v *Validator) UpdateInitPCRs(ownerID, clusterID string) error {
|
|||
func (v *Validator) updatePCR(pcrIndex uint32, encoded string) error {
|
||||
if encoded == "" {
|
||||
delete(v.pcrs, pcrIndex)
|
||||
|
||||
// remove enforced PCR if it exists
|
||||
for i, enforcedIdx := range v.enforcedPCRs {
|
||||
if enforcedIdx == pcrIndex {
|
||||
v.enforcedPCRs[i] = v.enforcedPCRs[len(v.enforcedPCRs)-1]
|
||||
v.enforcedPCRs = v.enforcedPCRs[:len(v.enforcedPCRs)-1]
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
decoded, err := base64.StdEncoding.DecodeString(encoded)
|
||||
|
|
@ -69,29 +78,35 @@ func (v *Validator) setPCRs(config *config.Config) error {
|
|||
switch v.provider {
|
||||
case cloudprovider.GCP:
|
||||
gcpPCRs := config.Provider.GCP.Measurements
|
||||
if err := v.checkPCRs(gcpPCRs); err != nil {
|
||||
enforcedPCRs := config.Provider.GCP.EnforcedMeasurements
|
||||
if err := v.checkPCRs(gcpPCRs, enforcedPCRs); err != nil {
|
||||
return err
|
||||
}
|
||||
v.enforcedPCRs = enforcedPCRs
|
||||
v.pcrs = gcpPCRs
|
||||
case cloudprovider.Azure:
|
||||
azurePCRs := config.Provider.Azure.Measurements
|
||||
if err := v.checkPCRs(azurePCRs); err != nil {
|
||||
enforcedPCRs := config.Provider.Azure.EnforcedMeasurements
|
||||
if err := v.checkPCRs(azurePCRs, enforcedPCRs); err != nil {
|
||||
return err
|
||||
}
|
||||
v.enforcedPCRs = enforcedPCRs
|
||||
v.pcrs = azurePCRs
|
||||
case cloudprovider.QEMU:
|
||||
qemuPCRs := config.Provider.QEMU.Measurements
|
||||
if err := v.checkPCRs(qemuPCRs); err != nil {
|
||||
enforcedPCRs := config.Provider.QEMU.EnforcedMeasurements
|
||||
if err := v.checkPCRs(qemuPCRs, enforcedPCRs); err != nil {
|
||||
return err
|
||||
}
|
||||
v.enforcedPCRs = enforcedPCRs
|
||||
v.pcrs = qemuPCRs
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// V returns the validator as atls.Validator.
|
||||
func (v *Validator) V() atls.Validator {
|
||||
v.updateValidator()
|
||||
func (v *Validator) V(cmd *cobra.Command) atls.Validator {
|
||||
v.updateValidator(cmd)
|
||||
return v.validator
|
||||
}
|
||||
|
||||
|
|
@ -100,60 +115,19 @@ func (v *Validator) PCRS() map[uint32][]byte {
|
|||
return v.pcrs
|
||||
}
|
||||
|
||||
func (v *Validator) updateValidator() {
|
||||
func (v *Validator) updateValidator(cmd *cobra.Command) {
|
||||
switch v.provider {
|
||||
case cloudprovider.GCP:
|
||||
v.validator = gcp.NewValidator(v.pcrs)
|
||||
v.validator = gcp.NewValidator(v.pcrs, v.enforcedPCRs)
|
||||
case cloudprovider.Azure:
|
||||
v.validator = azure.NewValidator(v.pcrs)
|
||||
v.validator = azure.NewValidator(v.pcrs, v.enforcedPCRs)
|
||||
case cloudprovider.QEMU:
|
||||
v.validator = qemu.NewValidator(v.pcrs)
|
||||
v.validator = qemu.NewValidator(v.pcrs, v.enforcedPCRs)
|
||||
}
|
||||
v.validator.AddLogger(warnLogger{cmd: cmd})
|
||||
}
|
||||
|
||||
// Warnings returns warnings for the specifc PCR values that are not verified.
|
||||
//
|
||||
// PCR allocation inspired by https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12#Tab1
|
||||
func (v *Validator) Warnings() string {
|
||||
sb := &strings.Builder{}
|
||||
|
||||
if v.pcrs[0] == nil || v.pcrs[1] == nil {
|
||||
writeWarnFmt(sb, "BIOS")
|
||||
}
|
||||
|
||||
if v.pcrs[2] == nil || v.pcrs[3] == nil {
|
||||
writeWarnFmt(sb, "OPROM")
|
||||
}
|
||||
|
||||
if v.pcrs[4] == nil || v.pcrs[5] == nil {
|
||||
writeWarnFmt(sb, "MBR")
|
||||
}
|
||||
|
||||
// GRUB measures kernel command line and initrd into pcrs 8 and 9
|
||||
if v.pcrs[8] == nil {
|
||||
writeWarnFmt(sb, "kernel command line")
|
||||
}
|
||||
if v.pcrs[9] == nil {
|
||||
writeWarnFmt(sb, "initrd")
|
||||
}
|
||||
|
||||
return sb.String()
|
||||
}
|
||||
|
||||
// WarningsIncludeInit returns warnings for the specific PCR values that are not verified.
|
||||
// Warnings regarding the initialization are included.
|
||||
//
|
||||
// PCR allocation inspired by https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12#Tab1
|
||||
func (v *Validator) WarningsIncludeInit() string {
|
||||
warnings := v.Warnings()
|
||||
if v.pcrs[uint32(vtpm.PCRIndexOwnerID)] == nil || v.pcrs[uint32(vtpm.PCRIndexClusterID)] == nil {
|
||||
warnings = warnings + fmt.Sprintf(warningStr, "initialization status")
|
||||
}
|
||||
|
||||
return warnings
|
||||
}
|
||||
|
||||
func (v *Validator) checkPCRs(pcrs map[uint32][]byte) error {
|
||||
func (v *Validator) checkPCRs(pcrs map[uint32][]byte, enforcedPCRs []uint32) error {
|
||||
if len(pcrs) == 0 {
|
||||
return errors.New("no PCR values provided")
|
||||
}
|
||||
|
|
@ -162,13 +136,20 @@ func (v *Validator) checkPCRs(pcrs map[uint32][]byte) error {
|
|||
return fmt.Errorf("bad config: PCR[%d]: expected length: %d, but got: %d", k, 32, len(v))
|
||||
}
|
||||
}
|
||||
for _, v := range enforcedPCRs {
|
||||
if _, ok := pcrs[v]; !ok {
|
||||
return fmt.Errorf("bad config: PCR[%d] is enforced, but no expected measurement is provided", v)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func writeWarnFmt(sb *strings.Builder, args ...any) {
|
||||
writeFmt(sb, warningStr, args...)
|
||||
// warnLogger implements logging of warnings for validators.
|
||||
type warnLogger struct {
|
||||
cmd *cobra.Command
|
||||
}
|
||||
|
||||
func writeFmt(sb *strings.Builder, fmtStr string, args ...any) {
|
||||
sb.WriteString(fmt.Sprintf(fmtStr, args...))
|
||||
// Warnf prints a formatted warning from the validator.
|
||||
func (wl warnLogger) Warnf(fmtStr string, args ...interface{}) {
|
||||
wl.cmd.PrintErrf("Warning: %s\n", fmt.Sprintf(fmtStr, args...))
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,6 +12,7 @@ import (
|
|||
"github.com/edgelesssys/constellation/internal/attestation/vtpm"
|
||||
"github.com/edgelesssys/constellation/internal/cloud/cloudprovider"
|
||||
"github.com/edgelesssys/constellation/internal/config"
|
||||
"github.com/spf13/cobra"
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
|
|
@ -93,172 +94,6 @@ func TestNewValidator(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func TestValidatorWarnings(t *testing.T) {
|
||||
zero := []byte("00000000000000000000000000000000")
|
||||
|
||||
testCases := map[string]struct {
|
||||
pcrs map[uint32][]byte
|
||||
wantWarnings []string
|
||||
wantWInclude []string
|
||||
}{
|
||||
"no warnings": {
|
||||
pcrs: map[uint32][]byte{
|
||||
0: zero,
|
||||
1: zero,
|
||||
2: zero,
|
||||
3: zero,
|
||||
4: zero,
|
||||
5: zero,
|
||||
6: zero,
|
||||
7: zero,
|
||||
8: zero,
|
||||
9: zero,
|
||||
10: zero,
|
||||
11: zero,
|
||||
12: zero,
|
||||
},
|
||||
},
|
||||
"no warnings for missing non critical values": {
|
||||
pcrs: map[uint32][]byte{
|
||||
0: zero,
|
||||
1: zero,
|
||||
2: zero,
|
||||
3: zero,
|
||||
4: zero,
|
||||
5: zero,
|
||||
8: zero,
|
||||
9: zero,
|
||||
11: zero,
|
||||
12: zero,
|
||||
},
|
||||
},
|
||||
"warn for BIOS": {
|
||||
pcrs: map[uint32][]byte{
|
||||
0: zero,
|
||||
2: zero,
|
||||
3: zero,
|
||||
4: zero,
|
||||
5: zero,
|
||||
8: zero,
|
||||
9: zero,
|
||||
11: zero,
|
||||
12: zero,
|
||||
},
|
||||
wantWarnings: []string{"BIOS"},
|
||||
},
|
||||
"warn for OPROM": {
|
||||
pcrs: map[uint32][]byte{
|
||||
0: zero,
|
||||
1: zero,
|
||||
3: zero,
|
||||
4: zero,
|
||||
5: zero,
|
||||
8: zero,
|
||||
9: zero,
|
||||
11: zero,
|
||||
12: zero,
|
||||
},
|
||||
wantWarnings: []string{"OPROM"},
|
||||
},
|
||||
"warn for MBR": {
|
||||
pcrs: map[uint32][]byte{
|
||||
0: zero,
|
||||
1: zero,
|
||||
2: zero,
|
||||
3: zero,
|
||||
5: zero,
|
||||
8: zero,
|
||||
9: zero,
|
||||
11: zero,
|
||||
12: zero,
|
||||
},
|
||||
wantWarnings: []string{"MBR"},
|
||||
},
|
||||
"warn for kernel": {
|
||||
pcrs: map[uint32][]byte{
|
||||
0: zero,
|
||||
1: zero,
|
||||
2: zero,
|
||||
3: zero,
|
||||
4: zero,
|
||||
5: zero,
|
||||
9: zero,
|
||||
11: zero,
|
||||
12: zero,
|
||||
},
|
||||
wantWarnings: []string{"kernel"},
|
||||
},
|
||||
"warn for initrd": {
|
||||
pcrs: map[uint32][]byte{
|
||||
0: zero,
|
||||
1: zero,
|
||||
2: zero,
|
||||
3: zero,
|
||||
4: zero,
|
||||
5: zero,
|
||||
8: zero,
|
||||
11: zero,
|
||||
12: zero,
|
||||
},
|
||||
wantWarnings: []string{"initrd"},
|
||||
},
|
||||
"warn for initialization": {
|
||||
pcrs: map[uint32][]byte{
|
||||
0: zero,
|
||||
1: zero,
|
||||
2: zero,
|
||||
3: zero,
|
||||
4: zero,
|
||||
5: zero,
|
||||
8: zero,
|
||||
9: zero,
|
||||
11: zero,
|
||||
},
|
||||
wantWInclude: []string{"initialization"},
|
||||
},
|
||||
"multi warning": {
|
||||
pcrs: map[uint32][]byte{},
|
||||
wantWarnings: []string{
|
||||
"BIOS",
|
||||
"OPROM",
|
||||
"MBR",
|
||||
"initrd",
|
||||
"kernel",
|
||||
},
|
||||
wantWInclude: []string{"initialization"},
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
validators := Validator{pcrs: tc.pcrs}
|
||||
|
||||
warnings := validators.Warnings()
|
||||
warningsInclueInit := validators.WarningsIncludeInit()
|
||||
|
||||
if len(tc.wantWarnings) == 0 {
|
||||
assert.Empty(warnings)
|
||||
}
|
||||
for _, w := range tc.wantWarnings {
|
||||
assert.Contains(warnings, w)
|
||||
}
|
||||
for _, w := range tc.wantWarnings {
|
||||
assert.Contains(warningsInclueInit, w)
|
||||
}
|
||||
if len(tc.wantWInclude) == 0 {
|
||||
assert.Equal(len(warnings), len(warningsInclueInit))
|
||||
} else {
|
||||
assert.Greater(len(warningsInclueInit), len(warnings))
|
||||
}
|
||||
for _, w := range tc.wantWInclude {
|
||||
assert.Contains(warningsInclueInit, w)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidatorV(t *testing.T) {
|
||||
zero := []byte("00000000000000000000000000000000")
|
||||
newTestPCRs := func() map[uint32][]byte {
|
||||
|
|
@ -287,17 +122,17 @@ func TestValidatorV(t *testing.T) {
|
|||
"gcp": {
|
||||
provider: cloudprovider.GCP,
|
||||
pcrs: newTestPCRs(),
|
||||
wantVs: gcp.NewValidator(newTestPCRs()),
|
||||
wantVs: gcp.NewValidator(newTestPCRs(), nil),
|
||||
},
|
||||
"azure": {
|
||||
provider: cloudprovider.Azure,
|
||||
pcrs: newTestPCRs(),
|
||||
wantVs: azure.NewValidator(newTestPCRs()),
|
||||
wantVs: azure.NewValidator(newTestPCRs(), nil),
|
||||
},
|
||||
"qemu": {
|
||||
provider: cloudprovider.QEMU,
|
||||
pcrs: newTestPCRs(),
|
||||
wantVs: qemu.NewValidator(newTestPCRs()),
|
||||
wantVs: qemu.NewValidator(newTestPCRs(), nil),
|
||||
},
|
||||
}
|
||||
|
||||
|
|
@ -307,7 +142,7 @@ func TestValidatorV(t *testing.T) {
|
|||
|
||||
validators := &Validator{provider: tc.provider, pcrs: tc.pcrs}
|
||||
|
||||
resultValidator := validators.V()
|
||||
resultValidator := validators.V(&cobra.Command{})
|
||||
|
||||
assert.Equal(tc.wantVs.OID(), resultValidator.OID())
|
||||
})
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue