mirror of
https://github.com/ultravioletrs/cocos.git
synced 2026-08-07 07:14:50 +00:00
Sammy Kerata Oina
13f7e97d82
CI / checkproto (push) Has been cancelled
CI / lint (push) Has been cancelled
CI / test (agent) (push) Has been cancelled
CI / test (cli) (push) Has been cancelled
CI / test (cmd) (push) Has been cancelled
CI / test (internal) (push) Has been cancelled
CI / test (manager, true) (push) Has been cancelled
CI / test (pkg) (push) Has been cancelled
CI / upload-coverage (push) Has been cancelled
* feat: add FetchKbsToken RPC support, update protobuf generation, and include additional binaries in CI workflow. Signed-off-by: Sammy Oina <sammyoina@gmail.com> * chore: update protoc version and add GetKbsToken mock method with updated kbsHTTPGet signature Signed-off-by: Sammy Oina <sammyoina@gmail.com> * test: inject mock attestation client into agentService for resource and KBS tests Signed-off-by: Sammy Oina <sammyoina@gmail.com> * test: update key derivation in tests to use Concat KDF instead of HKDF Signed-off-by: Sammy Oina <sammyoina@gmail.com> --------- Signed-off-by: Sammy Oina <sammyoina@gmail.com>
131 lines
2.2 KiB
Go
131 lines
2.2 KiB
Go
// Copyright (c) Ultraviolet
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package attestation
|
|
|
|
import (
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
|
|
"github.com/google/go-sev-guest/client"
|
|
tdxcliet "github.com/google/go-tdx-guest/client"
|
|
"github.com/google/go-tpm/legacy/tpm2"
|
|
"github.com/veraison/corim/corim"
|
|
)
|
|
|
|
type PlatformType int
|
|
|
|
const (
|
|
SNP PlatformType = iota
|
|
VTPM
|
|
SNPvTPM
|
|
Azure
|
|
TDX
|
|
NoCC
|
|
)
|
|
|
|
const (
|
|
azureMetadataUrl = "http://169.254.169.254/metadata/instance"
|
|
azureApiVersion = "2021-02-01"
|
|
)
|
|
|
|
var AttestationPolicyPath string
|
|
|
|
type ccCheck struct {
|
|
checkFunc func() bool
|
|
platform PlatformType
|
|
}
|
|
|
|
type Provider interface {
|
|
Attestation(teeNonce []byte, vTpmNonce []byte) ([]byte, error)
|
|
TeeAttestation(teeNonce []byte) ([]byte, error)
|
|
VTpmAttestation(vTpmNonce []byte) ([]byte, error)
|
|
AzureAttestationToken(tokenNonce []byte) ([]byte, error)
|
|
KbsToken() ([]byte, error)
|
|
}
|
|
|
|
type Verifier interface {
|
|
VerifyWithCoRIM(report []byte, manifest *corim.UnsignedCorim) error
|
|
}
|
|
|
|
// CCPlatform returns the type of the confidential computing platform.
|
|
func CCPlatform() PlatformType {
|
|
checks := []ccCheck{
|
|
{SevSnpGuestvTPMExists, SNPvTPM},
|
|
{SevSnpGuestDeviceExists, SNP},
|
|
{isAzureVM, Azure},
|
|
{TDXGuestDeviceExists, TDX},
|
|
}
|
|
|
|
for _, c := range checks {
|
|
if c.checkFunc() {
|
|
return c.platform
|
|
}
|
|
}
|
|
return NoCC
|
|
}
|
|
|
|
func SevSnpGuestDeviceExists() bool {
|
|
d, err := client.OpenDevice()
|
|
if err != nil {
|
|
return false
|
|
}
|
|
d.Close()
|
|
|
|
return true
|
|
}
|
|
|
|
func SevSnpGuestvTPMExists() bool {
|
|
return vTPMExists() && SevSnpGuestDeviceExists()
|
|
}
|
|
|
|
func vTPMExists() bool {
|
|
d, err := tpm2.OpenTPM()
|
|
if err != nil {
|
|
return false
|
|
}
|
|
d.Close()
|
|
|
|
return true
|
|
}
|
|
|
|
func isAzureVM() bool {
|
|
if !vTPMExists() {
|
|
return false
|
|
}
|
|
|
|
client := &http.Client{}
|
|
url := fmt.Sprintf("%s?api-version=%s", azureMetadataUrl, azureApiVersion)
|
|
|
|
req, _ := http.NewRequest("GET", url, nil)
|
|
req.Header.Add("Metadata", "true")
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode == http.StatusOK {
|
|
body, err := io.ReadAll(resp.Body)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
return len(body) > 0
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
func TDXGuestDeviceExists() bool {
|
|
d, err := tdxcliet.OpenDevice()
|
|
if err != nil {
|
|
return false
|
|
}
|
|
d.Close()
|
|
|
|
return true
|
|
}
|