attestation: tdx issuer/validator (#1265)

* Add TDX validator

* Add TDX issuer

---------

Signed-off-by: Daniel Weiße <dw@edgeless.systems>

internal/attestation/initialize/BUILD.bazel

@@ -0,0 +1,29 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_library(
+    name = "initialize",
+    srcs = ["initialize.go"],
+    importpath = "github.com/edgelesssys/constellation/v2/internal/attestation/initialize",
+    visibility = ["//:__subpackages__"],
+    deps = [
+        "//internal/attestation/measurements",
+        "//internal/attestation/tdx",
+        "@com_github_edgelesssys_go_tdx_qpl//tdx",
+        "@com_github_google_go_tpm//tpm2",
+    ],
+)
+
+go_test(
+    name = "initialize_test",
+    srcs = ["initialize_test.go"],
+    embed = [":initialize"],
+    deps = [
+        "//internal/attestation/measurements",
+        "//internal/attestation/simulator",
+        "@com_github_google_go_tpm//tpm2",
+        "@com_github_google_go_tpm_tools//client",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+    ],
+)

internal/attestation/initialize/initialize.go

@@ -0,0 +1,130 @@
+/*
+Copyright (c) Edgeless Systems GmbH
+
+SPDX-License-Identifier: AGPL-3.0-only
+*/
+
+// Package initialize implements functions to mark a node as initialized in the context of cluster attestation.
+// This is done by measuring the cluster ID using the available CC technology.
+package initialize
+
+import (
+	"bytes"
+	"errors"
+	"io"
+
+	"github.com/edgelesssys/constellation/v2/internal/attestation/measurements"
+	"github.com/edgelesssys/constellation/v2/internal/attestation/tdx"
+	tdxapi "github.com/edgelesssys/go-tdx-qpl/tdx"
+	"github.com/google/go-tpm/tpm2"
+)
+
+// MarkNodeAsBootstrapped marks a node as initialized by extending PCRs.
+// clusterID is used to uniquely identify this running instance of Constellation.
+func MarkNodeAsBootstrapped(openDevice func() (io.ReadWriteCloser, error), clusterID []byte) error {
+	device, err := openDevice()
+	if err != nil {
+		return err
+	}
+	defer device.Close()
+
+	// The TDX device is of type *os.File, while the TPM device may be
+	// *os.File or an emulated device over a unix socket.
+	// Therefore, we can't simply use a type switch here,
+	// since the TPM may implement the same methods as the TDX device
+	if handle, ok := tdx.IsTDXDevice(device); ok {
+		return tdxMarkNodeAsBootstrapped(handle, clusterID)
+	}
+	return tpmMarkNodeAsBootstrapped(device, clusterID)
+}
+
+// IsNodeBootstrapped checks if a node is already bootstrapped by reading PCRs.
+func IsNodeBootstrapped(openDevice func() (io.ReadWriteCloser, error)) (bool, error) {
+	device, err := openDevice()
+	if err != nil {
+		return false, err
+	}
+	defer device.Close()
+
+	// The TDX device is of type *os.File, while the TPM device may be
+	// *os.File or an emulated device over a unix socket.
+	// Therefore, we can't simply use a type switch here,
+	// since the TPM may implement the same methods as the TDX device
+	if handle, ok := tdx.IsTDXDevice(device); ok {
+		return tdxIsNodeBootstrapped(handle)
+	}
+	return tpmIsNodeBootstrapped(device)
+}
+
+func tdxIsNodeBootstrapped(handle tdx.Device) (bool, error) {
+	tdMeasure, err := tdxapi.ReadMeasurements(handle)
+	if err != nil {
+		return false, err
+	}
+	return measurementInitialized(tdMeasure[measurements.TDXIndexClusterID][:]), nil
+}
+
+func tpmIsNodeBootstrapped(tpm io.ReadWriteCloser) (bool, error) {
+	idxClusterID := int(measurements.PCRIndexClusterID)
+	pcrs, err := tpm2.ReadPCRs(tpm, tpm2.PCRSelection{
+		Hash: tpm2.AlgSHA256,
+		PCRs: []int{idxClusterID},
+	})
+	if err != nil {
+		return false, err
+	}
+	if len(pcrs[idxClusterID]) == 0 {
+		return false, errors.New("cluster ID PCR does not exist")
+	}
+	return measurementInitialized(pcrs[idxClusterID]), nil
+
+	/* Old code that will be reenabled in the future
+	idxOwner := int(PCRIndexOwnerID)
+	idxCluster := int(PCRIndexClusterID)
+	selection := tpm2.PCRSelection{
+		Hash: tpm2.AlgSHA256,
+		PCRs: []int{idxOwner, idxCluster},
+	}
+
+	pcrs, err := tpm2.ReadPCRs(tpm, selection)
+	if err != nil {
+		return false, err
+	}
+
+	if len(pcrs[idxOwner]) == 0 {
+		return false, errors.New("owner ID PCR does not exist")
+	}
+	if len(pcrs[idxCluster]) == 0 {
+		return false, errors.New("cluster ID PCR does not exist")
+	}
+
+	ownerInitialized := pcrInitialized(pcrs[idxOwner])
+	clusterInitialized := pcrInitialized(pcrs[idxCluster])
+
+	if ownerInitialized == clusterInitialized {
+		return ownerInitialized && clusterInitialized, nil
+	}
+	ownerState := "not initialized"
+	if ownerInitialized {
+		ownerState = "initialized"
+	}
+	clusterState := "not initialized"
+	if clusterInitialized {
+		clusterState = "initialized"
+	}
+	return false, fmt.Errorf("PCRs %v and %v are not consistent: PCR[%v]=%v (%v), PCR[%v]=%v (%v)", idxOwner, idxCluster, idxOwner, pcrs[idxOwner], ownerState, idxCluster, pcrs[idxCluster], clusterState)
+	*/
+}
+
+func tdxMarkNodeAsBootstrapped(handle tdx.Device, clusterID []byte) error {
+	return tdxapi.ExtendRTMR(handle, clusterID, measurements.RTMRIndexClusterID)
+}
+
+func tpmMarkNodeAsBootstrapped(tpm io.ReadWriteCloser, clusterID []byte) error {
+	return tpm2.PCREvent(tpm, measurements.PCRIndexClusterID, clusterID)
+}
+
+// measurementInitialized checks if a PCR value is set to a non-zero value.
+func measurementInitialized(measurement []byte) bool {
+	return !bytes.Equal(measurement, bytes.Repeat([]byte{0x00}, len(measurement)))
+}

internal/attestation/initialize/initialize_test.go

@@ -0,0 +1,93 @@
+/*
+Copyright (c) Edgeless Systems GmbH
+
+SPDX-License-Identifier: AGPL-3.0-only
+*/
+
+package initialize
+
+import (
+	"errors"
+	"io"
+	"testing"
+
+	"github.com/edgelesssys/constellation/v2/internal/attestation/measurements"
+	"github.com/edgelesssys/constellation/v2/internal/attestation/simulator"
+	"github.com/google/go-tpm-tools/client"
+	"github.com/google/go-tpm/tpm2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// simTPMNOPCloser is a wrapper for the generic TPM simulator with a NOP Close() method.
+type simTPMNOPCloser struct {
+	io.ReadWriteCloser
+}
+
+func (s simTPMNOPCloser) Close() error {
+	return nil
+}
+
+func TestMarkNodeAsBootstrapped(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+
+	tpm, err := simulator.OpenSimulatedTPM()
+	require.NoError(err)
+	defer tpm.Close()
+	pcrs, err := client.ReadAllPCRs(tpm)
+	require.NoError(err)
+
+	assert.NoError(MarkNodeAsBootstrapped(func() (io.ReadWriteCloser, error) {
+		return &simTPMNOPCloser{tpm}, nil
+	}, []byte{0x0, 0x1, 0x2, 0x3}))
+
+	pcrsInitialized, err := client.ReadAllPCRs(tpm)
+	require.NoError(err)
+
+	for i := range pcrs {
+		assert.NotEqual(pcrs[i].Pcrs[uint32(measurements.PCRIndexClusterID)], pcrsInitialized[i].Pcrs[uint32(measurements.PCRIndexClusterID)])
+	}
+}
+
+func TestFailOpener(t *testing.T) {
+	assert := assert.New(t)
+
+	assert.Error(MarkNodeAsBootstrapped(func() (io.ReadWriteCloser, error) { return nil, errors.New("failed") }, []byte{0x0, 0x1, 0x2, 0x3}))
+}
+
+func TestIsNodeInitialized(t *testing.T) {
+	testCases := map[string]struct {
+		pcrValueClusterID []byte
+		wantInitialized   bool
+		wantErr           bool
+	}{
+		"uninitialized PCRs results in uninitialized node": {},
+		"initializing PCRs result in initialized node": {
+			pcrValueClusterID: []byte{0x4, 0x5, 0x6, 0x7},
+			wantInitialized:   true,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			assert := require.New(t)
+			require := require.New(t)
+			tpm, err := simulator.OpenSimulatedTPM()
+			require.NoError(err)
+			defer tpm.Close()
+			if tc.pcrValueClusterID != nil {
+				require.NoError(tpm2.PCREvent(tpm, measurements.PCRIndexClusterID, tc.pcrValueClusterID))
+			}
+			initialized, err := IsNodeBootstrapped(func() (io.ReadWriteCloser, error) {
+				return &simTPMNOPCloser{tpm}, nil
+			})
+			if tc.wantErr {
+				assert.Error(err)
+				return
+			}
+			require.NoError(err)
+			require.Equal(tc.wantInitialized, initialized)
+		})
+	}
+}