Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-06-20 12:14:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

cli: Generalize PCRs to Measurements in preparation for TDX

Browse source
This commit is contained in:
Nils Hanke 2023-03-22 13:40:02 +01:00 • committed by Malte Poll
parent 7e5e3b9d2e
commit c507bd7d95
3 changed files with 17 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

30
cli/internal/cloudcmd/validators.go
View file

@ -24,23 +24,23 @@ func NewValidator(cmd *cobra.Command, config config.AttestationCfg, log debugLog
return choose.Validator(config, warnLogger{cmd: cmd, log: log}) return choose.Validator(config, warnLogger{cmd: cmd, log: log})
} }
// UpdateInitPCRs sets the owner and cluster PCR values. // UpdateInitMeasurements sets the owner and cluster measurement values.
func UpdateInitPCRs(config config.AttestationCfg, ownerID, clusterID string) error { func UpdateInitMeasurements(config config.AttestationCfg, ownerID, clusterID string) error {
m := config.GetMeasurements() m := config.GetMeasurements()
if err := updatePCR(m, uint32(measurements.PCRIndexOwnerID), ownerID); err != nil { if err := updateMeasurement(m, uint32(measurements.PCRIndexOwnerID), ownerID); err != nil {
return err return err
} }
return updatePCR(m, uint32(measurements.PCRIndexClusterID), clusterID) return updateMeasurement(m, uint32(measurements.PCRIndexClusterID), clusterID)
} }
// updatePCR adds a new entry to the measurements of v, or removes the key if the input is an empty string. // updateMeasurement adds a new entry to the measurements of v, or removes the key if the input is an empty string.
// //
// When adding, the input is first decoded from hex or base64. // When adding, the input is first decoded from hex or base64.
// We then calculate the expected PCR by hashing the input using SHA256, // We then calculate the expected measurement by hashing the input using SHA256,
// appending expected PCR for initialization, and then hashing once more. // appending expected measurement for initialization, and then hashing once more.
func updatePCR(m measurements.M, pcrIndex uint32, encoded string) error { func updateMeasurement(m measurements.M, measurementIdx uint32, encoded string) error {
if encoded == "" { if encoded == "" {
delete(m, pcrIndex) delete(m, measurementIdx)
return nil return nil
} }
@ -53,14 +53,14 @@ func updatePCR(m measurements.M, pcrIndex uint32, encoded string) error {
return fmt.Errorf("input [%s] could neither be hex decoded (%w) nor base64 decoded (%w)", encoded, hexErr, err) return fmt.Errorf("input [%s] could neither be hex decoded (%w) nor base64 decoded (%w)", encoded, hexErr, err)
} }
} }
// new_pcr_value := hash(old_pcr_value || data_to_extend) // new_measurement_value := hash(old_pcr_value || data_to_extend)
// Since we use the TPM2_PCR_Event call to extend the PCR, data_to_extend is the hash of our input // Since we use the TPM2_PCR_Event call to extend the PCR, data_to_extend is the hash of our input
hashedInput := sha256.Sum256(decoded) hashedInput := sha256.Sum256(decoded)
oldExpected := m[pcrIndex].Expected oldExpected := m[measurementIdx].Expected
expectedPcr := sha256.Sum256(append(oldExpected[:], hashedInput[:]...)) expectedMeasurement := sha256.Sum256(append(oldExpected[:], hashedInput[:]...))
m[pcrIndex] = measurements.Measurement{ m[measurementIdx] = measurements.Measurement{
Expected: expectedPcr[:], Expected: expectedMeasurement[:],
ValidationOpt: m[pcrIndex].ValidationOpt, ValidationOpt: m[measurementIdx].ValidationOpt,
} }
return nil return nil
} }

2
cli/internal/cloudcmd/validators_test.go
View file

@ -114,7 +114,7 @@ func TestValidatorUpdateInitPCRs(t *testing.T) {
t.Run(name, func(t *testing.T) { t.Run(name, func(t *testing.T) {
assert := assert.New(t) assert := assert.New(t)
err := UpdateInitPCRs(tc.config, tc.ownerID, tc.clusterID) err := UpdateInitMeasurements(tc.config, tc.ownerID, tc.clusterID)
if tc.wantErr { if tc.wantErr {
assert.Error(err) assert.Error(err)

2
cli/internal/cmd/verify.go
View file

@ -94,7 +94,7 @@ func (c *verifyCmd) verify(cmd *cobra.Command, fileHandler file.Handler, verifyC
conf.UpdateMAAURL(flags.maaURL) conf.UpdateMAAURL(flags.maaURL)
c.log.Debugf("Updating expected PCRs") c.log.Debugf("Updating expected PCRs")
attConfig := conf.GetAttestationConfig() attConfig := conf.GetAttestationConfig()
if err := cloudcmd.UpdateInitPCRs(attConfig, flags.ownerID, flags.clusterID); err != nil { if err := cloudcmd.UpdateInitMeasurements(attConfig, flags.ownerID, flags.clusterID); err != nil {
return fmt.Errorf("updating expected PCRs: %w", err) return fmt.Errorf("updating expected PCRs: %w", err)
} }