Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-02-02 10:35:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

cli: fix incorrect actual values for constellation verify on AWS (#2265)

Browse Source 
* cli: fix aws pcr index
This commit is contained in:
3u13r 2023-08-21 13:50:00 +02:00 committed by GitHub
parent 590931f3ac
commit bb654ba1ab
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cli/internal/cmd/BUILD.bazel
View File

@ -56,6 +56,7 @@ go_library(
"//internal/atls", "//internal/atls",
"//internal/attestation/measurements", "//internal/attestation/measurements",
"//internal/attestation/variant", "//internal/attestation/variant",
"//internal/attestation/vtpm",
"//internal/cloud/cloudprovider", "//internal/cloud/cloudprovider",
"//internal/cloud/gcpshared", "//internal/cloud/gcpshared",
"//internal/compatibility", "//internal/compatibility",
@ -82,6 +83,7 @@ go_library(
"@com_github_golang_jwt_jwt_v5//:jwt", "@com_github_golang_jwt_jwt_v5//:jwt",
"@com_github_google_go_sev_guest//abi", "@com_github_google_go_sev_guest//abi",
"@com_github_google_go_sev_guest//kds", "@com_github_google_go_sev_guest//kds",
"@com_github_google_go_tpm_tools//proto/tpm",
"@com_github_google_uuid//:uuid", "@com_github_google_uuid//:uuid",
"@com_github_mattn_go_isatty//:go-isatty", "@com_github_mattn_go_isatty//:go-isatty",
"@com_github_rogpeppe_go_internal//diff", "@com_github_rogpeppe_go_internal//diff",

34
cli/internal/cmd/verify.go
View File

@ -22,12 +22,15 @@ import (
"strconv" "strconv"
"strings" "strings"
tpmProto "github.com/google/go-tpm-tools/proto/tpm"
"github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd" "github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd"
"github.com/edgelesssys/constellation/v2/cli/internal/clusterid" "github.com/edgelesssys/constellation/v2/cli/internal/clusterid"
"github.com/edgelesssys/constellation/v2/cli/internal/cmd/pathprefix" "github.com/edgelesssys/constellation/v2/cli/internal/cmd/pathprefix"
"github.com/edgelesssys/constellation/v2/internal/api/attestationconfigapi" "github.com/edgelesssys/constellation/v2/internal/api/attestationconfigapi"
"github.com/edgelesssys/constellation/v2/internal/atls" "github.com/edgelesssys/constellation/v2/internal/atls"
"github.com/edgelesssys/constellation/v2/internal/attestation/measurements" "github.com/edgelesssys/constellation/v2/internal/attestation/measurements"
"github.com/edgelesssys/constellation/v2/internal/attestation/vtpm"
"github.com/edgelesssys/constellation/v2/internal/config" "github.com/edgelesssys/constellation/v2/internal/config"
"github.com/edgelesssys/constellation/v2/internal/constants" "github.com/edgelesssys/constellation/v2/internal/constants"
"github.com/edgelesssys/constellation/v2/internal/crypto" "github.com/edgelesssys/constellation/v2/internal/crypto"
@ -372,11 +375,19 @@ func (f *attestationDocFormatterImpl) parseCerts(b *strings.Builder, certTypeNam
} }
// parseQuotes parses the base64-encoded quotes and writes their details to the output builder. // parseQuotes parses the base64-encoded quotes and writes their details to the output builder.
func (f *attestationDocFormatterImpl) parseQuotes(b *strings.Builder, quotes []quote, expectedPCRs measurements.M) error { func (f *attestationDocFormatterImpl) parseQuotes(b *strings.Builder, quotes []*tpmProto.Quote, expectedPCRs measurements.M) error {
writeIndentfln(b, 1, "Quote:") writeIndentfln(b, 1, "Quote:")
for pcrNum, expectedPCR := range expectedPCRs { for pcrNum, expectedPCR := range expectedPCRs {
encPCR := quotes[1].Pcrs.Pcrs[fmt.Sprintf("%d", pcrNum)] pcrIdx, err := vtpm.GetSHA256QuoteIndex(quotes)
actualPCR, err := base64.StdEncoding.DecodeString(encPCR) if err != nil {
return fmt.Errorf("get SHA256 quote index: %w", err)
}
if quotes[pcrIdx] == nil {
return fmt.Errorf("quote %d is nil", pcrIdx)
}
actualPCR := quotes[pcrIdx].Pcrs.Pcrs[pcrNum]
if err != nil { if err != nil {
return fmt.Errorf("decode PCR %d: %w", pcrNum, err) return fmt.Errorf("decode PCR %d: %w", pcrNum, err)
} }
@ -621,24 +632,15 @@ type maaTokenClaims struct {
// attestationDoc is the attestation document returned by the verifier. // attestationDoc is the attestation document returned by the verifier.
type attestationDoc struct { type attestationDoc struct {
Attestation struct { Attestation struct {
AkPub string `json:"ak_pub"` AkPub string `json:"ak_pub"`
Quotes []quote `json:"quotes"` Quotes []*tpmProto.Quote `json:"quotes"`
EventLog string `json:"event_log"` EventLog string `json:"event_log"`
TeeAttestation interface{} `json:"TeeAttestation"` TeeAttestation interface{} `json:"TeeAttestation"`
} `json:"Attestation"` } `json:"Attestation"`
InstanceInfo string `json:"InstanceInfo"` InstanceInfo string `json:"InstanceInfo"`
UserData string `json:"UserData"` UserData string `json:"UserData"`
} }
type quote struct {
Quote string `json:"quote"`
RawSig string `json:"raw_sig"`
Pcrs struct {
Hash int `json:"hash"`
Pcrs map[string]string `json:"pcrs"`
} `json:"pcrs"`
}
// azureInstanceInfo is the b64-decoded InstanceInfo field of the attestation document. // azureInstanceInfo is the b64-decoded InstanceInfo field of the attestation document.
// as of now (2023-04-03), it only contains interesting data on Azure. // as of now (2023-04-03), it only contains interesting data on Azure.
type azureInstanceInfo struct { type azureInstanceInfo struct {