mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-02-02 10:35:08 -05:00
add image-measurement tool (#106)
Signed-off-by: Benedict Schlueter <bs@edgeless.systems> Co-authored-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Benedict Schlueter
Benedict Schlüter
parent
c1427123d9
commit
eee2df9723
@ -52,6 +52,7 @@ require (
|
||||
gopkg.in/square/go-jose.v2 v2.6.0
|
||||
gopkg.in/yaml.v3 v3.0.1
|
||||
libvirt.org/go/libvirt v1.8004.0
|
||||
libvirt.org/go/libvirtxml v1.8007.0
|
||||
)
|
||||
|
||||
require (
|
||||
|
||||
@ -455,10 +455,7 @@ github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE
|
||||
github.com/go-openapi/jsonreference v0.19.6 h1:UBIxjkht+AWIgYzCDSv2GN+E/togfwXUJFRTWhl2Jjs=
|
||||
github.com/go-openapi/jsonreference v0.19.6/go.mod h1:diGHMEHg2IqXZGKxqyvWdfWU/aim5Dprw5bqpKkTvns=
|
||||
github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
|
||||
github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
|
||||
github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
|
||||
github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
|
||||
github.com/go-openapi/swag v0.21.1 h1:wm0rhTb5z7qpJRHBdPOMuY4QjVUMbF6/kwoYeRAOrKU=
|
||||
github.com/go-openapi/swag v0.21.1 h1:wm0rhTb5z7qpJRHBdPOMuY4QjVUMbF6/kwoYeRAOrKU=
|
||||
github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
|
||||
github.com/go-playground/assert/v2 v2.0.1 h1:MsBgLAaY856+nPRTKrp3/OZK38U/wa0CcBYNjji3q3A=
|
||||
@ -901,6 +898,7 @@ github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
|
||||
github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
|
||||
github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
|
||||
github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
|
||||
github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
|
||||
github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
|
||||
github.com/onsi/ginkgo/v2 v2.0.0/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
|
||||
github.com/onsi/ginkgo/v2 v2.1.4 h1:GNapqRSid3zijZ9H77KrgVG4/8KqiyRsxcSxe+7ApXY=
|
||||
@ -1786,7 +1784,6 @@ google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ5
|
||||
google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
|
||||
google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
|
||||
google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
|
||||
google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
|
||||
google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
|
||||
google.golang.org/grpc v1.48.0 h1:rQOsyJ/8+ufEDJd/Gdsz7HG220Mh9HAhFHRGnIjda0w=
|
||||
google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
|
||||
@ -1885,6 +1882,8 @@ k8s.io/utils v0.0.0-20220812165043-ad590609e2e5 h1:XmRqFcQlCy/lKRZ39j+RVpokYNroH
|
||||
k8s.io/utils v0.0.0-20220812165043-ad590609e2e5/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
|
||||
libvirt.org/go/libvirt v1.8004.0 h1:SKa5hQNKQfc1VjU4LqLMorqPCxC1lplnz8LwLiMrPyM=
|
||||
libvirt.org/go/libvirt v1.8004.0/go.mod h1:1WiFE8EjZfq+FCVog+rvr1yatKbKZ9FaFMZgEqxEJqQ=
|
||||
libvirt.org/go/libvirtxml v1.8007.0 h1:vklDVA/xhA6mnQffFDTFkqf76TKHcKmsPeU/1qQY06M=
|
||||
libvirt.org/go/libvirtxml v1.8007.0/go.mod h1:7Oq2BLDstLr/XtoQD8Fr3mfDNrzlI3utYKySXF2xkng=
|
||||
pack.ag/amqp v0.11.2/go.mod h1:4/cbmt4EJXSKlG6LCfWHoqmN0uFdy5i/+YFz+fTfhV4=
|
||||
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
|
||||
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
|
||||
|
||||
317
hack/image-measurement/definitions.go
Normal file
317
hack/image-measurement/definitions.go
Normal file
@ -0,0 +1,317 @@
|
||||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"libvirt.org/go/libvirtxml"
|
||||
)
|
||||
|
||||
var (
|
||||
libvirtImagePath = "/var/lib/libvirt/images/"
|
||||
baseDiskName = "constellation-measurement"
|
||||
stateDiskName = "constellation-measurement-state"
|
||||
bootDiskName = "constellation-measurement-boot"
|
||||
diskPoolName = "constellation-measurement-pool"
|
||||
domainName = "constellation-measurement-vm"
|
||||
networkName = "constellation-measurement-net"
|
||||
|
||||
networkXMLConfig = libvirtxml.Network{
|
||||
Name: networkName,
|
||||
Forward: &libvirtxml.NetworkForward{
|
||||
Mode: "nat",
|
||||
NAT: &libvirtxml.NetworkForwardNAT{
|
||||
Ports: []libvirtxml.NetworkForwardNATPort{
|
||||
{
|
||||
Start: 1024,
|
||||
End: 65535,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
Bridge: &libvirtxml.NetworkBridge{
|
||||
Name: "virbr1",
|
||||
STP: "on",
|
||||
Delay: "0",
|
||||
},
|
||||
DNS: &libvirtxml.NetworkDNS{
|
||||
Enable: "yes",
|
||||
},
|
||||
IPs: []libvirtxml.NetworkIP{
|
||||
{
|
||||
Family: "ipv4",
|
||||
Address: "10.42.0.1",
|
||||
Prefix: 16,
|
||||
DHCP: &libvirtxml.NetworkDHCP{
|
||||
Ranges: []libvirtxml.NetworkDHCPRange{
|
||||
{
|
||||
Start: "10.42.0.2",
|
||||
End: "10.42.255.254",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
poolXMLConfig = libvirtxml.StoragePool{
|
||||
Name: diskPoolName,
|
||||
Type: "dir",
|
||||
Source: &libvirtxml.StoragePoolSource{},
|
||||
Target: &libvirtxml.StoragePoolTarget{
|
||||
Path: libvirtImagePath,
|
||||
Permissions: &libvirtxml.StoragePoolTargetPermissions{
|
||||
Owner: "0",
|
||||
Group: "0",
|
||||
Mode: "0711",
|
||||
},
|
||||
},
|
||||
}
|
||||
volumeBootXMLConfig = libvirtxml.StorageVolume{
|
||||
Type: "file",
|
||||
Name: bootDiskName,
|
||||
Target: &libvirtxml.StorageVolumeTarget{
|
||||
Path: libvirtImagePath + bootDiskName,
|
||||
Format: &libvirtxml.StorageVolumeTargetFormat{
|
||||
Type: "qcow2",
|
||||
},
|
||||
},
|
||||
BackingStore: &libvirtxml.StorageVolumeBackingStore{
|
||||
Path: libvirtImagePath + baseDiskName,
|
||||
Format: &libvirtxml.StorageVolumeTargetFormat{},
|
||||
},
|
||||
Capacity: &libvirtxml.StorageVolumeSize{
|
||||
Unit: "GiB",
|
||||
Value: uint64(10),
|
||||
},
|
||||
}
|
||||
|
||||
volumeBaseXMLConfig = libvirtxml.StorageVolume{
|
||||
Type: "file",
|
||||
Name: baseDiskName,
|
||||
Target: &libvirtxml.StorageVolumeTarget{
|
||||
Path: libvirtImagePath + baseDiskName,
|
||||
Format: &libvirtxml.StorageVolumeTargetFormat{
|
||||
Type: "qcow2",
|
||||
},
|
||||
},
|
||||
Capacity: &libvirtxml.StorageVolumeSize{
|
||||
Unit: "GiB",
|
||||
Value: uint64(10),
|
||||
},
|
||||
}
|
||||
|
||||
volumeStateXMLConfig = libvirtxml.StorageVolume{
|
||||
Type: "file",
|
||||
Name: stateDiskName,
|
||||
Target: &libvirtxml.StorageVolumeTarget{
|
||||
Path: libvirtImagePath + stateDiskName,
|
||||
Format: &libvirtxml.StorageVolumeTargetFormat{
|
||||
Type: "qcow2",
|
||||
},
|
||||
},
|
||||
Capacity: &libvirtxml.StorageVolumeSize{
|
||||
Unit: "GiB",
|
||||
Value: uint64(10),
|
||||
},
|
||||
}
|
||||
|
||||
port = uint(0)
|
||||
domainXMLConfig = libvirtxml.Domain{
|
||||
Title: "measurement-VM",
|
||||
Name: domainName,
|
||||
Type: "kvm",
|
||||
Memory: &libvirtxml.DomainMemory{
|
||||
Value: 2,
|
||||
Unit: "GiB",
|
||||
},
|
||||
Resource: &libvirtxml.DomainResource{
|
||||
Partition: "/machine",
|
||||
},
|
||||
VCPU: &libvirtxml.DomainVCPU{
|
||||
Placement: "static",
|
||||
Current: 2,
|
||||
Value: 2,
|
||||
},
|
||||
CPU: &libvirtxml.DomainCPU{
|
||||
Mode: "custom",
|
||||
Model: &libvirtxml.DomainCPUModel{
|
||||
Fallback: "forbid",
|
||||
Value: "qemu64",
|
||||
},
|
||||
Features: []libvirtxml.DomainCPUFeature{
|
||||
{
|
||||
Policy: "require",
|
||||
Name: "x2apic",
|
||||
},
|
||||
{
|
||||
Policy: "require",
|
||||
Name: "hypervisor",
|
||||
},
|
||||
{
|
||||
Policy: "require",
|
||||
Name: "lahf_lm",
|
||||
},
|
||||
{
|
||||
Policy: "disable",
|
||||
Name: "svm",
|
||||
},
|
||||
},
|
||||
},
|
||||
Features: &libvirtxml.DomainFeatureList{
|
||||
ACPI: &libvirtxml.DomainFeature{},
|
||||
PAE: &libvirtxml.DomainFeature{},
|
||||
SMM: &libvirtxml.DomainFeatureSMM{
|
||||
State: "on",
|
||||
},
|
||||
APIC: &libvirtxml.DomainFeatureAPIC{},
|
||||
},
|
||||
|
||||
OS: &libvirtxml.DomainOS{
|
||||
// If Firmware is set, Loader and NVRam will be chosen automatically
|
||||
Firmware: "efi",
|
||||
Type: &libvirtxml.DomainOSType{
|
||||
Arch: "x86_64",
|
||||
Machine: "q35",
|
||||
Type: "hvm",
|
||||
},
|
||||
BootDevices: []libvirtxml.DomainBootDevice{
|
||||
{
|
||||
Dev: "hd",
|
||||
},
|
||||
},
|
||||
},
|
||||
Devices: &libvirtxml.DomainDeviceList{
|
||||
Emulator: "/usr/bin/qemu-system-x86_64",
|
||||
Disks: []libvirtxml.DomainDisk{
|
||||
{
|
||||
Device: "disk",
|
||||
Driver: &libvirtxml.DomainDiskDriver{
|
||||
Name: "qemu",
|
||||
Type: "qcow2",
|
||||
},
|
||||
Target: &libvirtxml.DomainDiskTarget{
|
||||
Dev: "sda",
|
||||
Bus: "scsi",
|
||||
},
|
||||
Source: &libvirtxml.DomainDiskSource{
|
||||
Index: 2,
|
||||
Volume: &libvirtxml.DomainDiskSourceVolume{
|
||||
Pool: diskPoolName,
|
||||
Volume: bootDiskName,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
Device: "disk",
|
||||
Driver: &libvirtxml.DomainDiskDriver{
|
||||
Name: "qemu",
|
||||
},
|
||||
Target: &libvirtxml.DomainDiskTarget{
|
||||
Dev: "vda",
|
||||
Bus: "virtio",
|
||||
},
|
||||
Source: &libvirtxml.DomainDiskSource{
|
||||
Index: 1,
|
||||
Volume: &libvirtxml.DomainDiskSourceVolume{
|
||||
Pool: diskPoolName,
|
||||
Volume: stateDiskName,
|
||||
},
|
||||
},
|
||||
Alias: &libvirtxml.DomainAlias{
|
||||
Name: "virtio-disk1",
|
||||
},
|
||||
},
|
||||
},
|
||||
Controllers: []libvirtxml.DomainController{
|
||||
{
|
||||
Type: "scsi",
|
||||
Model: "virtio-scsi",
|
||||
},
|
||||
},
|
||||
TPMs: []libvirtxml.DomainTPM{
|
||||
{
|
||||
Model: "tpm-tis",
|
||||
Backend: &libvirtxml.DomainTPMBackend{
|
||||
Emulator: &libvirtxml.DomainTPMBackendEmulator{
|
||||
Version: "2.0",
|
||||
ActivePCRBanks: &libvirtxml.DomainTPMBackendPCRBanks{
|
||||
SHA1: &libvirtxml.DomainTPMBackendPCRBank{},
|
||||
SHA256: &libvirtxml.DomainTPMBackendPCRBank{},
|
||||
SHA384: &libvirtxml.DomainTPMBackendPCRBank{},
|
||||
SHA512: &libvirtxml.DomainTPMBackendPCRBank{},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
Interfaces: []libvirtxml.DomainInterface{
|
||||
{
|
||||
Model: &libvirtxml.DomainInterfaceModel{
|
||||
Type: "virtio",
|
||||
},
|
||||
Source: &libvirtxml.DomainInterfaceSource{
|
||||
Network: &libvirtxml.DomainInterfaceSourceNetwork{
|
||||
Network: networkName,
|
||||
Bridge: "virbr1",
|
||||
},
|
||||
},
|
||||
Alias: &libvirtxml.DomainAlias{
|
||||
Name: "net0",
|
||||
},
|
||||
},
|
||||
},
|
||||
Serials: []libvirtxml.DomainSerial{
|
||||
{
|
||||
Source: &libvirtxml.DomainChardevSource{
|
||||
Pty: &libvirtxml.DomainChardevSourcePty{
|
||||
Path: "/dev/pts/4",
|
||||
},
|
||||
},
|
||||
Target: &libvirtxml.DomainSerialTarget{
|
||||
Type: "isa-serial",
|
||||
Port: &port,
|
||||
Model: &libvirtxml.DomainSerialTargetModel{
|
||||
Name: "isa-serial",
|
||||
},
|
||||
},
|
||||
Log: &libvirtxml.DomainChardevLog{
|
||||
File: "/tmp/libvirt.log",
|
||||
},
|
||||
},
|
||||
},
|
||||
Consoles: []libvirtxml.DomainConsole{
|
||||
{
|
||||
TTY: "/dev/pts/4",
|
||||
Source: &libvirtxml.DomainChardevSource{
|
||||
Pty: &libvirtxml.DomainChardevSourcePty{
|
||||
Path: "/dev/pts/4",
|
||||
},
|
||||
},
|
||||
Target: &libvirtxml.DomainConsoleTarget{
|
||||
Type: "serial",
|
||||
Port: &port,
|
||||
},
|
||||
},
|
||||
},
|
||||
RNGs: []libvirtxml.DomainRNG{
|
||||
{
|
||||
Model: "virtio",
|
||||
Backend: &libvirtxml.DomainRNGBackend{
|
||||
Random: &libvirtxml.DomainRNGBackendRandom{
|
||||
Device: "/dev/urandom",
|
||||
},
|
||||
},
|
||||
Alias: &libvirtxml.DomainAlias{
|
||||
Name: "rng0",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
OnPoweroff: "destroy",
|
||||
OnCrash: "destroy",
|
||||
OnReboot: "restart",
|
||||
}
|
||||
)
|
||||
350
hack/image-measurement/main.go
Normal file
350
hack/image-measurement/main.go
Normal file
@ -0,0 +1,350 @@
|
||||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/signal"
|
||||
"syscall"
|
||||
|
||||
"github.com/edgelesssys/constellation/hack/image-measurement/server"
|
||||
"github.com/edgelesssys/constellation/internal/logger"
|
||||
"go.uber.org/multierr"
|
||||
"go.uber.org/zap"
|
||||
"go.uber.org/zap/zapcore"
|
||||
"libvirt.org/go/libvirt"
|
||||
)
|
||||
|
||||
// Usage:
|
||||
// go build
|
||||
//./image-measurement --path=disk.raw --type=raw
|
||||
|
||||
type libvirtInstance struct {
|
||||
conn *libvirt.Connect
|
||||
log *logger.Logger
|
||||
imagePath string
|
||||
}
|
||||
|
||||
func (l *libvirtInstance) uploadBaseImage(baseVolume *libvirt.StorageVol) (err error) {
|
||||
stream, err := l.conn.NewStream(libvirt.STREAM_NONBLOCK)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() { _ = stream.Free() }()
|
||||
file, err := os.Open(l.imagePath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error while opening %s: %s", l.imagePath, err)
|
||||
}
|
||||
defer func() {
|
||||
err = multierr.Append(err, file.Close())
|
||||
}()
|
||||
|
||||
fi, err := file.Stat()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := baseVolume.Upload(stream, 0, uint64(fi.Size()), 0); err != nil {
|
||||
return err
|
||||
}
|
||||
transferredBytes := 0
|
||||
buffer := make([]byte, 4*1024*1024)
|
||||
for {
|
||||
_, err := file.Read(buffer)
|
||||
if err != nil && err != io.EOF {
|
||||
return err
|
||||
}
|
||||
if err == io.EOF {
|
||||
break
|
||||
}
|
||||
num, err := stream.Send(buffer)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
transferredBytes += num
|
||||
|
||||
}
|
||||
if transferredBytes < int(fi.Size()) {
|
||||
return fmt.Errorf("only send %d out of %d bytes", transferredBytes, fi.Size())
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (l *libvirtInstance) createLibvirtInstance() error {
|
||||
domainXMLString, err := domainXMLConfig.Marshal()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
poolXMLString, err := poolXMLConfig.Marshal()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
volumeBootXMLString, err := volumeBootXMLConfig.Marshal()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
volumeBaseXMLString, err := volumeBaseXMLConfig.Marshal()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
volumeStateXMLString, err := volumeStateXMLConfig.Marshal()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
networkXMLString, err := networkXMLConfig.Marshal()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
l.log.Infof("creating network")
|
||||
network, err := l.conn.NetworkCreateXML(networkXMLString)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() { _ = network.Free() }()
|
||||
|
||||
l.log.Infof("creating storage pool")
|
||||
poolObject, err := l.conn.StoragePoolDefineXML(poolXMLString, libvirt.STORAGE_POOL_DEFINE_VALIDATE)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error defining libvirt storage pool: %s", err)
|
||||
}
|
||||
defer func() { _ = poolObject.Free() }()
|
||||
if err := poolObject.Build(libvirt.STORAGE_POOL_BUILD_NEW); err != nil {
|
||||
return fmt.Errorf("error building libvirt storage pool: %s", err)
|
||||
}
|
||||
if err := poolObject.Create(libvirt.STORAGE_POOL_CREATE_NORMAL); err != nil {
|
||||
return fmt.Errorf("error creating libvirt storage pool: %s", err)
|
||||
}
|
||||
volumeBaseObject, err := poolObject.StorageVolCreateXML(volumeBaseXMLString, 0)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error creating libvirt storage volume 'base': %s", err)
|
||||
}
|
||||
defer func() { _ = volumeBaseObject.Free() }()
|
||||
|
||||
l.log.Infof("uploading image to libvirt")
|
||||
if err := l.uploadBaseImage(volumeBaseObject); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
l.log.Infof("creating storage volume 'boot'")
|
||||
bootVol, err := poolObject.StorageVolCreateXML(volumeBootXMLString, 0)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error creating libvirt storage volume 'boot': %s", err)
|
||||
}
|
||||
defer func() { _ = bootVol.Free() }()
|
||||
|
||||
l.log.Infof("creating storage volume 'state'")
|
||||
stateVol, err := poolObject.StorageVolCreateXML(volumeStateXMLString, 0)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error creating libvirt storage volume 'state': %s", err)
|
||||
}
|
||||
defer func() { _ = stateVol.Free() }()
|
||||
|
||||
l.log.Infof("creating domain")
|
||||
domain, err := l.conn.DomainCreateXML(domainXMLString, libvirt.DOMAIN_NONE)
|
||||
if err != nil {
|
||||
return fmt.Errorf("error creating libvirt domain: %s", err)
|
||||
}
|
||||
defer func() { _ = domain.Free() }()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (l *libvirtInstance) deleteNetwork() error {
|
||||
nets, err := l.conn.ListAllNetworks(libvirt.CONNECT_LIST_NETWORKS_ACTIVE)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
for _, net := range nets {
|
||||
_ = net.Free()
|
||||
}
|
||||
}()
|
||||
for _, net := range nets {
|
||||
name, err := net.GetName()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if name != networkName {
|
||||
continue
|
||||
}
|
||||
if err := net.Destroy(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (l *libvirtInstance) deleteDomain() error {
|
||||
doms, err := l.conn.ListAllDomains(libvirt.CONNECT_LIST_DOMAINS_ACTIVE)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
for _, dom := range doms {
|
||||
_ = dom.Free()
|
||||
}
|
||||
}()
|
||||
for _, dom := range doms {
|
||||
name, err := dom.GetName()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if name != domainName {
|
||||
continue
|
||||
}
|
||||
if err := dom.Destroy(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (l *libvirtInstance) deleteVolume(pool *libvirt.StoragePool) error {
|
||||
volumes, err := pool.ListAllStorageVolumes(0)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
for _, volume := range volumes {
|
||||
_ = volume.Free()
|
||||
}
|
||||
}()
|
||||
for _, volume := range volumes {
|
||||
name, err := volume.GetName()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if name != stateDiskName && name != bootDiskName && name != baseDiskName {
|
||||
continue
|
||||
}
|
||||
if err := volume.Delete(libvirt.STORAGE_VOL_DELETE_NORMAL); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (l *libvirtInstance) deletePool() error {
|
||||
pools, err := l.conn.ListAllStoragePools(libvirt.CONNECT_LIST_STORAGE_POOLS_DIR)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer func() {
|
||||
for _, pool := range pools {
|
||||
_ = pool.Free()
|
||||
}
|
||||
}()
|
||||
for _, pool := range pools {
|
||||
name, err := pool.GetName()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if name != diskPoolName {
|
||||
continue
|
||||
}
|
||||
active, err := pool.IsActive()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if active {
|
||||
if err := l.deleteVolume(&pool); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := pool.Destroy(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := pool.Delete(libvirt.STORAGE_POOL_DELETE_NORMAL); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
// If something fails and the Pool becomes inactive, we cannot delete/destroy it anymore.
|
||||
// We have to undefine it in this case
|
||||
if err := pool.Undefine(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (l *libvirtInstance) deleteLibvirtInstance() error {
|
||||
var err error
|
||||
err = multierr.Append(err, l.deleteNetwork())
|
||||
err = multierr.Append(err, l.deleteDomain())
|
||||
err = multierr.Append(err, l.deletePool())
|
||||
return err
|
||||
}
|
||||
|
||||
func (l *libvirtInstance) obtainMeasurements() (err error) {
|
||||
// sanity check
|
||||
if err := l.deleteLibvirtInstance(); err != nil {
|
||||
return err
|
||||
}
|
||||
done := make(chan struct{}, 1)
|
||||
serv := server.New(l.log, done)
|
||||
go func() {
|
||||
if err := serv.ListenAndServe("8080"); err != http.ErrServerClosed {
|
||||
l.log.With(zap.Error(err)).Fatalf("Failed to serve")
|
||||
}
|
||||
}()
|
||||
defer func() {
|
||||
err = multierr.Append(err, l.deleteLibvirtInstance())
|
||||
}()
|
||||
if err := l.createLibvirtInstance(); err != nil {
|
||||
return err
|
||||
}
|
||||
sigs := make(chan os.Signal, 1)
|
||||
signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
|
||||
l.log.Infof("waiting for PCRs or CTRL+C")
|
||||
select {
|
||||
case <-done:
|
||||
break
|
||||
case <-sigs:
|
||||
break
|
||||
}
|
||||
signal.Stop(sigs)
|
||||
close(sigs)
|
||||
if err := serv.Shutdown(); err != nil {
|
||||
return err
|
||||
}
|
||||
close(done)
|
||||
return nil
|
||||
}
|
||||
|
||||
func main() {
|
||||
var imageLocation string
|
||||
var imageType string
|
||||
flag.StringVar(&imageLocation, "path", "", "path to the image to measure (required)")
|
||||
flag.StringVar(&imageType, "type", "", "type of the image. One of 'qcow2' or 'raw' (required)")
|
||||
flag.Parse()
|
||||
log := logger.New(logger.JSONLog, zapcore.InfoLevel)
|
||||
|
||||
if imageLocation == "" || imageType == "" {
|
||||
flag.Usage()
|
||||
os.Exit(1)
|
||||
}
|
||||
volumeBootXMLConfig.BackingStore.Format.Type = imageType
|
||||
domainXMLConfig.Devices.Disks[1].Driver.Type = imageType
|
||||
|
||||
conn, err := libvirt.NewConnect("qemu:///system")
|
||||
if err != nil {
|
||||
log.With(zap.Error(err)).Fatalf("Failed to connect to libvirt")
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
lInstance := libvirtInstance{
|
||||
conn: conn,
|
||||
log: log,
|
||||
imagePath: imageLocation,
|
||||
}
|
||||
|
||||
if err := lInstance.obtainMeasurements(); err != nil {
|
||||
log.With(zap.Error(err)).Fatalf("Failed to obtain PCR measurements")
|
||||
}
|
||||
log.Infof("instaces terminated successfully")
|
||||
}
|
||||
81
hack/image-measurement/server/server.go
Normal file
81
hack/image-measurement/server/server.go
Normal file
@ -0,0 +1,81 @@
|
||||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package server
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net"
|
||||
"net/http"
|
||||
|
||||
"github.com/edgelesssys/constellation/internal/logger"
|
||||
"go.uber.org/zap"
|
||||
)
|
||||
|
||||
type Server struct {
|
||||
log *logger.Logger
|
||||
server http.Server
|
||||
done chan<- struct{}
|
||||
}
|
||||
|
||||
func New(log *logger.Logger, done chan<- struct{}) *Server {
|
||||
return &Server{
|
||||
log: log,
|
||||
done: done,
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Server) ListenAndServe(port string) error {
|
||||
mux := http.NewServeMux()
|
||||
mux.Handle("/pcrs", http.HandlerFunc(s.logPCRs))
|
||||
|
||||
s.server = http.Server{
|
||||
Handler: mux,
|
||||
}
|
||||
|
||||
lis, err := net.Listen("tcp", net.JoinHostPort("", port))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
s.log.Infof("Starting QEMU metadata API on %s", lis.Addr())
|
||||
return s.server.Serve(lis)
|
||||
}
|
||||
|
||||
func (s *Server) Shutdown() error {
|
||||
return s.server.Shutdown(context.Background())
|
||||
}
|
||||
|
||||
// logPCRs allows QEMU instances to export their TPM state during boot.
|
||||
func (s *Server) logPCRs(w http.ResponseWriter, r *http.Request) {
|
||||
log := s.log.With(zap.String("peer", r.RemoteAddr))
|
||||
if r.Method != http.MethodPost {
|
||||
log.With(zap.String("method", r.Method)).Errorf("Invalid method for /log")
|
||||
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
|
||||
log.Infof("Serving POST request for /pcrs")
|
||||
|
||||
if r.Body == nil {
|
||||
log.Errorf("Request body is empty")
|
||||
http.Error(w, "Request body is empty", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
// unmarshal the request body into a map of PCRs
|
||||
var pcrs map[uint32][]byte
|
||||
if err := json.NewDecoder(r.Body).Decode(&pcrs); err != nil {
|
||||
log.With(zap.Error(err)).Errorf("Failed to read request body")
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
log.Infof("PCR 4 %x", pcrs[4])
|
||||
log.Infof("PCR 8 %x", pcrs[8])
|
||||
log.Infof("PCR 9 %x", pcrs[9])
|
||||
s.done <- struct{}{}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user