mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-09-23 09:46:05 +00:00
7c5556864b
Currently only available on Azure CVMs. * Get the public attestation key from the TPM. * Get the snp report from the TPM. * Get the VCEK and ASK certificate from the metadata api. * Verify VCEK using hardcoded root key (ARK) * Verify SNP report using VCEK * Verify HCLAkPub using SNP report by comparing AK with runtimeData * Extend unittest Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> Co-authored-by: Daniel Weiße <dw@edgeless.systems>
44 lines
899 B
Go
44 lines
899 B
Go
package azure
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
)
|
|
|
|
// Modified version of bootstrapper/cloudprovider/azure/imds.go
|
|
|
|
const (
|
|
imdsVcekURL = "http://169.254.169.254/metadata/THIM/amd/certification"
|
|
)
|
|
|
|
type imdsClient struct {
|
|
client *http.Client
|
|
}
|
|
|
|
// Retrieve retrieves instance metadata from the azure imds API.
|
|
func (c imdsClient) getVcek(ctx context.Context) (vcekResponse, error) {
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, imdsVcekURL, http.NoBody)
|
|
if err != nil {
|
|
return vcekResponse{}, err
|
|
}
|
|
req.Header.Add("Metadata", "True")
|
|
resp, err := c.client.Do(req)
|
|
if err != nil {
|
|
return vcekResponse{}, err
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
var res vcekResponse
|
|
if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
|
|
return vcekResponse{}, err
|
|
}
|
|
|
|
return res, nil
|
|
}
|
|
|
|
type vcekResponse struct {
|
|
VcekCert string
|
|
CertificateChain string
|
|
}
|