mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-12-04 18:33:48 -05:00
cli: new flag for Azure JSON output of constellation verify (#2391)
This commit is contained in:
Adrian Stobbe
GitHub
parent
cc4ec80e48
commit
fdd47b7a00
6 changed files with 483 additions and 173 deletions
179
internal/verify/verify.go
Normal file
179
internal/verify/verify.go
Normal file
|
|
@ -0,0 +1,179 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
/*
|
||||
Package verify provides the types for the verify report in JSON format.
|
||||
|
||||
The package provides an interface for constellation verify and
|
||||
the attestationconfigapi upload tool through JSON serialization.
|
||||
*/
|
||||
package verify
|
||||
|
||||
import (
|
||||
"crypto/x509"
|
||||
"fmt"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
)
|
||||
|
||||
// Report contains the entire data reported by constellation verify.
|
||||
type Report struct {
|
||||
SNPReport SNPReport `json:"snp_report"`
|
||||
VCEK []Certificate `json:"vcek"`
|
||||
CertChain []Certificate `json:"cert_chain"`
|
||||
MAAToken MaaTokenClaims `json:"maa_token"`
|
||||
}
|
||||
|
||||
// Certificate contains the certificate data and additional information.
|
||||
type Certificate struct {
|
||||
*x509.Certificate `json:"certificate"`
|
||||
CertTypeName string `json:"cert_type_name"`
|
||||
StructVersion uint8 `json:"struct_version"`
|
||||
ProductName string `json:"product_name"`
|
||||
HardwareID []byte `json:"hardware_id"`
|
||||
TCBVersion TCBVersion `json:"tcb_version"`
|
||||
}
|
||||
|
||||
// TCBVersion contains the TCB version data.
|
||||
type TCBVersion struct {
|
||||
Bootloader uint8 `json:"bootloader"`
|
||||
TEE uint8 `json:"tee"`
|
||||
SNP uint8 `json:"snp"`
|
||||
Microcode uint8 `json:"microcode"`
|
||||
Spl4 uint8 `json:"spl4"`
|
||||
Spl5 uint8 `json:"spl5"`
|
||||
Spl6 uint8 `json:"spl6"`
|
||||
Spl7 uint8 `json:"spl7"`
|
||||
}
|
||||
|
||||
// PlatformInfo contains the platform information.
|
||||
type PlatformInfo struct {
|
||||
SMT bool `json:"smt"`
|
||||
TSME bool `json:"tsme"`
|
||||
}
|
||||
|
||||
// SignerInfo contains the signer information.
|
||||
type SignerInfo struct {
|
||||
AuthorKey bool `json:"author_key_en"`
|
||||
MaskChipKey bool `json:"mask_chip_key"`
|
||||
SigningKey fmt.Stringer `json:"signing_key"`
|
||||
}
|
||||
|
||||
// SNPReport contains the SNP report data.
|
||||
type SNPReport struct {
|
||||
Version uint32 `json:"version"`
|
||||
GuestSvn uint32 `json:"guest_svn"`
|
||||
PolicyABIMinor uint8 `json:"policy_abi_minor"`
|
||||
PolicyABIMajor uint8 `json:"policy_abi_major"`
|
||||
PolicySMT bool `json:"policy_symmetric_multi_threading"`
|
||||
PolicyMigrationAgent bool `json:"policy_migration_agent"`
|
||||
PolicyDebug bool `json:"policy_debug"`
|
||||
PolicySingleSocket bool `json:"policy_single_socket"`
|
||||
FamilyID []byte `json:"family_id"`
|
||||
ImageID []byte `json:"image_id"`
|
||||
Vmpl uint32 `json:"vmpl"`
|
||||
SignatureAlgo uint32 `json:"signature_algo"`
|
||||
CurrentTCB TCBVersion `json:"current_tcb"`
|
||||
PlatformInfo PlatformInfo `json:"platform_info"`
|
||||
SignerInfo SignerInfo `json:"signer_info"`
|
||||
ReportData []byte `json:"report_data"`
|
||||
Measurement []byte `json:"measurement"`
|
||||
HostData []byte `json:"host_data"`
|
||||
IDKeyDigest []byte `json:"id_key_digest"`
|
||||
AuthorKeyDigest []byte `json:"author_key_digest"`
|
||||
ReportID []byte `json:"report_id"`
|
||||
ReportIDMa []byte `json:"report_id_ma"`
|
||||
ReportedTCB TCBVersion `json:"reported_tcb"`
|
||||
ChipID []byte `json:"chip_id"`
|
||||
CommittedTCB TCBVersion `json:"committed_tcb"`
|
||||
CurrentBuild uint32 `json:"current_build"`
|
||||
CurrentMinor uint32 `json:"current_minor"`
|
||||
CurrentMajor uint32 `json:"current_major"`
|
||||
CommittedBuild uint32 `json:"committed_build"`
|
||||
CommittedMinor uint32 `json:"committed_minor"`
|
||||
CommittedMajor uint32 `json:"committed_major"`
|
||||
LaunchTCB TCBVersion `json:"launch_tcb"`
|
||||
Signature []byte `json:"signature"`
|
||||
}
|
||||
|
||||
// MaaTokenClaims contains the MAA token claims.
|
||||
type MaaTokenClaims struct {
|
||||
jwt.RegisteredClaims
|
||||
Secureboot bool `json:"secureboot,omitempty"`
|
||||
XMsAttestationType string `json:"x-ms-attestation-type,omitempty"`
|
||||
XMsAzurevmAttestationProtocolVer string `json:"x-ms-azurevm-attestation-protocol-ver,omitempty"`
|
||||
XMsAzurevmAttestedPcrs []int `json:"x-ms-azurevm-attested-pcrs,omitempty"`
|
||||
XMsAzurevmBootdebugEnabled bool `json:"x-ms-azurevm-bootdebug-enabled,omitempty"`
|
||||
XMsAzurevmDbvalidated bool `json:"x-ms-azurevm-dbvalidated,omitempty"`
|
||||
XMsAzurevmDbxvalidated bool `json:"x-ms-azurevm-dbxvalidated,omitempty"`
|
||||
XMsAzurevmDebuggersdisabled bool `json:"x-ms-azurevm-debuggersdisabled,omitempty"`
|
||||
XMsAzurevmDefaultSecurebootkeysvalidated bool `json:"x-ms-azurevm-default-securebootkeysvalidated,omitempty"`
|
||||
XMsAzurevmElamEnabled bool `json:"x-ms-azurevm-elam-enabled,omitempty"`
|
||||
XMsAzurevmFlightsigningEnabled bool `json:"x-ms-azurevm-flightsigning-enabled,omitempty"`
|
||||
XMsAzurevmHvciPolicy int `json:"x-ms-azurevm-hvci-policy,omitempty"`
|
||||
XMsAzurevmHypervisordebugEnabled bool `json:"x-ms-azurevm-hypervisordebug-enabled,omitempty"`
|
||||
XMsAzurevmIsWindows bool `json:"x-ms-azurevm-is-windows,omitempty"`
|
||||
XMsAzurevmKerneldebugEnabled bool `json:"x-ms-azurevm-kerneldebug-enabled,omitempty"`
|
||||
XMsAzurevmOsbuild string `json:"x-ms-azurevm-osbuild,omitempty"`
|
||||
XMsAzurevmOsdistro string `json:"x-ms-azurevm-osdistro,omitempty"`
|
||||
XMsAzurevmOstype string `json:"x-ms-azurevm-ostype,omitempty"`
|
||||
XMsAzurevmOsversionMajor int `json:"x-ms-azurevm-osversion-major,omitempty"`
|
||||
XMsAzurevmOsversionMinor int `json:"x-ms-azurevm-osversion-minor,omitempty"`
|
||||
XMsAzurevmSigningdisabled bool `json:"x-ms-azurevm-signingdisabled,omitempty"`
|
||||
XMsAzurevmTestsigningEnabled bool `json:"x-ms-azurevm-testsigning-enabled,omitempty"`
|
||||
XMsAzurevmVmid string `json:"x-ms-azurevm-vmid,omitempty"`
|
||||
XMsIsolationTee struct {
|
||||
XMsAttestationType string `json:"x-ms-attestation-type,omitempty"`
|
||||
XMsComplianceStatus string `json:"x-ms-compliance-status,omitempty"`
|
||||
XMsRuntime struct {
|
||||
Keys []struct {
|
||||
E string `json:"e,omitempty"`
|
||||
KeyOps []string `json:"key_ops,omitempty"`
|
||||
Kid string `json:"kid,omitempty"`
|
||||
Kty string `json:"kty,omitempty"`
|
||||
N string `json:"n,omitempty"`
|
||||
} `json:"keys,omitempty"`
|
||||
VMConfiguration struct {
|
||||
ConsoleEnabled bool `json:"console-enabled,omitempty"`
|
||||
CurrentTime int `json:"current-time,omitempty"`
|
||||
SecureBoot bool `json:"secure-boot,omitempty"`
|
||||
TpmEnabled bool `json:"tpm-enabled,omitempty"`
|
||||
VMUniqueID string `json:"vmUniqueId,omitempty"`
|
||||
} `json:"vm-configuration,omitempty"`
|
||||
} `json:"x-ms-runtime,omitempty"`
|
||||
XMsSevsnpvmAuthorkeydigest string `json:"x-ms-sevsnpvm-authorkeydigest,omitempty"`
|
||||
XMsSevsnpvmBootloaderSvn int `json:"x-ms-sevsnpvm-bootloader-svn,omitempty"`
|
||||
XMsSevsnpvmFamilyID string `json:"x-ms-sevsnpvm-familyId,omitempty"`
|
||||
XMsSevsnpvmGuestsvn int `json:"x-ms-sevsnpvm-guestsvn,omitempty"`
|
||||
XMsSevsnpvmHostdata string `json:"x-ms-sevsnpvm-hostdata,omitempty"`
|
||||
XMsSevsnpvmIdkeydigest string `json:"x-ms-sevsnpvm-idkeydigest,omitempty"`
|
||||
XMsSevsnpvmImageID string `json:"x-ms-sevsnpvm-imageId,omitempty"`
|
||||
XMsSevsnpvmIsDebuggable bool `json:"x-ms-sevsnpvm-is-debuggable,omitempty"`
|
||||
XMsSevsnpvmLaunchmeasurement string `json:"x-ms-sevsnpvm-launchmeasurement,omitempty"`
|
||||
XMsSevsnpvmMicrocodeSvn int `json:"x-ms-sevsnpvm-microcode-svn,omitempty"`
|
||||
XMsSevsnpvmMigrationAllowed bool `json:"x-ms-sevsnpvm-migration-allowed,omitempty"`
|
||||
XMsSevsnpvmReportdata string `json:"x-ms-sevsnpvm-reportdata,omitempty"`
|
||||
XMsSevsnpvmReportid string `json:"x-ms-sevsnpvm-reportid,omitempty"`
|
||||
XMsSevsnpvmSmtAllowed bool `json:"x-ms-sevsnpvm-smt-allowed,omitempty"`
|
||||
XMsSevsnpvmSnpfwSvn int `json:"x-ms-sevsnpvm-snpfw-svn,omitempty"`
|
||||
XMsSevsnpvmTeeSvn int `json:"x-ms-sevsnpvm-tee-svn,omitempty"`
|
||||
XMsSevsnpvmVmpl int `json:"x-ms-sevsnpvm-vmpl,omitempty"`
|
||||
} `json:"x-ms-isolation-tee,omitempty"`
|
||||
XMsPolicyHash string `json:"x-ms-policy-hash,omitempty"`
|
||||
XMsRuntime struct {
|
||||
ClientPayload struct {
|
||||
Nonce string `json:"nonce,omitempty"`
|
||||
} `json:"client-payload,omitempty"`
|
||||
Keys []struct {
|
||||
E string `json:"e,omitempty"`
|
||||
KeyOps []string `json:"key_ops,omitempty"`
|
||||
Kid string `json:"kid,omitempty"`
|
||||
Kty string `json:"kty,omitempty"`
|
||||
N string `json:"n,omitempty"`
|
||||
} `json:"keys,omitempty"`
|
||||
} `json:"x-ms-runtime,omitempty"`
|
||||
XMsVer string `json:"x-ms-ver,omitempty"`
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue