Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improvements #178

Merged
merged 4 commits into from
Mar 12, 2024
Merged

Improvements #178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
38894c1
tpmdriver: more meaningful trace output
smo4201 Mar 7, 2024
95f6c8f
example-setup: updated metadata
smo4201 Mar 7, 2024
514f1b0
example-setup: updated testtool configs
smo4201 Mar 7, 2024
66fb459
example-setup: updated scripts
smo4201 Mar 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions example-setup/metadata-raw/device.description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,19 @@
{
"type" : "Device Description",
"name" : "test-device.test.de",
"name" : "nuc-02.aisec.fraunhofer.de",
"version" : "2023-04-10T20:00:00Z",
"description" : "PoC Demonstrator Device Description",
"description" : "Intel NUC TPM Demonstrator",
"location" : "Munich, Germany",
"rtmManifest" : "de.test.rtm",
"osManifest" : "de.test.os",
"appDescriptions": [
{
"type": "App Description",
"name": "de.test.app.description",
"version": "2024-02-22T15:36:34Z",
"appManifest": "de.test.app",
"externalConnections": []
}

]
}
115 changes: 25 additions & 90 deletions example-setup/setup-full-ids
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,52 +1,53 @@
#!/bin/bash

set -e
set -euo pipefail

trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
export PATH=${PATH}:${HOME}/go/bin

function abs_path() {
if [ -d "$(dirname "$1")" ]
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

if [ "$#" -ne 3 ]; then
echo "Usage: ./setup-full-simple <cmc-folder> <data-folder> <cbor|json>"
if [[ "$#" -ne 3 ]]; then
echo "Usage: ./setup-full-ids <cmc-folder> <data-folder> <cbor|json>"
exit 1
fi

CMC="$(abs_path $1)"
DATA="$(abs_path $2)"
SER="$3"
cmc=$(set -e; abs_path "$1")
data=$(set -e; abs_path "$2")
ser="$3"

if [ ! -d "$CMC" ]; then
if [[ ! -d "${cmc}" ]]; then
echo "CMC directory does not exist. Did you clone the repository? Abort.."
exit 1
fi

if [ -d "$DATA" ]; then
if [[ -d "${data}" ]]; then
echo "Data directory does already exist. Please choose a new directory. Abort.."
exit 1
fi

echo "Using CMC: $CMC"
echo "Using $DATA as directory for local data"

export PATH=$PATH:$HOME/go/bin
echo "Using CMC: ${cmc}"
echo "Using ${data} as directory for local data"

# Create a folder for the cmc configuration and metadata
mkdir -p $DATA
mkdir -p "${data}"

sudo apt install moreutils golang-cfssl build-essential sqlite3

# Install tools
sudo apt install -y build-essential zlib1g-dev libssl-dev jq
git clone https://github.com/Fraunhofer-AISEC/tpm-pcr-tools.git $DATA/tpm-pcr-tools
cd $DATA/tpm-pcr-tools
git clone https://github.com/Fraunhofer-AISEC/tpm-pcr-tools.git "${data}/tpm-pcr-tools"
cd "${data}/tpm-pcr-tools"
make
sudo make install

# Build CMC
cd $CMC
cd "${cmc}"
echo "Building CMC.."
go build ./...

Expand All @@ -55,78 +56,12 @@ echo "Installing CMC"
go install ./...

# Copy metadata templates
cp -r $CMC/example-setup/* $DATA
cp -r "${cmc}/example-setup/"* "${data}"

# Generate a PKI suitable for your needs. You can use the IDS PKI example-setup for testing:
$DATA/setup-pki-ids -i $DATA/pki-input-ids -o $DATA/pki

# Parse the values of the RTM PCRs from the kernel's binary bios measurements as reference values
referenceValues=$(sudo parse-srtm-pcrs -p 0,1,2,3,4,5,6,7 -f json)

# Delete existing reference values in the RTM Manifest
jq 'del(.referenceValues[])' $DATA/metadata-raw/rtm.manifest.json | sponge $DATA/metadata-raw/rtm.manifest.json

# Add new reference values
jq --argjson ver "$referenceValues" '.referenceValues += $ver' $DATA/metadata-raw/rtm.manifest.json | sponge $DATA/metadata-raw/rtm.manifest.json

# Do this for the OS manifest as well
referenceValues=$(sudo parse-srtm-pcrs -p 8,9 -f json)
jq 'del(.referenceValues[])' $DATA/metadata-raw/os.manifest.json | sponge $DATA/metadata-raw/os.manifest.json
jq --argjson ver "$referenceValues" '.referenceValues += $ver' $DATA/metadata-raw/os.manifest.json | sponge $DATA/metadata-raw/os.manifest.json

# Sign the metadata*
IN=$DATA/metadata-raw
TMP=$DATA/metadata-tmp
OUT=$DATA/metadata-signed

KEY_DEV_A=$DATA/pki/developer_A-key.pem
CHAIN_DEV_A=$DATA/pki/developer_A.pem,$DATA/pki/user_sub_ca.pem,$DATA/pki/ca.pem

KEY_DEV_B=$DATA/pki/developer_B-key.pem
CHAIN_DEV_B=$DATA/pki/developer_B.pem,$DATA/pki/user_sub_ca.pem,$DATA/pki/ca.pem

KEY_EVA_A=$DATA/pki/evaluator_A-key.pem
CHAIN_EVA_A=$DATA/pki/evaluator_A.pem,$DATA/pki/user_sub_ca.pem,$DATA/pki/ca.pem

KEY_EVA_B=$DATA/pki/evaluator_B-key.pem
CHAIN_EVA_B=$DATA/pki/evaluator_B.pem,$DATA/pki/user_sub_ca.pem,$DATA/pki/ca.pem

KEY_CERT_A=$DATA/pki/certifier_A-key.pem
CHAIN_CERT_A=$DATA/pki/certifier_A.pem,$DATA/pki/user_sub_ca.pem,$DATA/pki/ca.pem

KEY_CERT_B=$DATA/pki/certifier_B-key.pem
CHAIN_CERT_B=$DATA/pki/certifier_B.pem,$DATA/pki/user_sub_ca.pem,$DATA/pki/ca.pem

KEY_OP_A=$DATA/pki/operator_A-key.pem
CHAIN_OP_A=$DATA/pki/operator_A.pem,$DATA/pki/user_sub_ca.pem,$DATA/pki/ca.pem

rm -rf $TMP
rm -rf $OUT

mkdir -p $TMP
mkdir -p $OUT

if [ "${SER,,}" = "json" ]; then
echo "using json serialization"
cp $IN/rtm.manifest.json $TMP/rtm.manifest.json
cp $IN/os.manifest.json $TMP/os.manifest.json
cp $IN/device.description.json $TMP/device.description.json
cp $IN/device.config.json $TMP/device.config.json
cp $IN/company.description.json $TMP/company.description.json
elif [ "${SER,,}" = "cbor" ]; then
echo "using cbor serialiation"
cmc-converter -in $IN/rtm.manifest.json -out $TMP/rtm.manifest.cbor -outform cbor
cmc-converter -in $IN/os.manifest.json -out $TMP/os.manifest.cbor -outform cbor
cmc-converter -in $IN/device.description.json -out $TMP/device.description.cbor -outform cbor
cmc-converter -in $IN/device.config.json -out $TMP/device.config.cbor -outform cbor
cmc-converter -in $IN/company.description.json -out $TMP/company.description.cbor -outform cbor
else
echo "serialization format ${SER} is not supported"
exit 1
fi
"${data}/setup-pki-ids" -i "${data}/pki-input-ids" -o "${data}/pki"

# Update and sign metadata
"${data}/update-full-ids" "${data}" "${ser}"


cmc-signing-tool -in $TMP/rtm.manifest."${SER}" -out $OUT/rtm.manifest."${SER}" -keys $KEY_DEV_A,$KEY_EVA_A,$KEY_CERT_A -x5cs $CHAIN_DEV_A:$CHAIN_EVA_A:$CHAIN_CERT_A
cmc-signing-tool -in $TMP/os.manifest."${SER}" -out $OUT/os.manifest."${SER}" -keys $KEY_DEV_B,$KEY_EVA_A,$KEY_CERT_A -x5cs $CHAIN_DEV_B:$CHAIN_EVA_A:$CHAIN_CERT_A
cmc-signing-tool -in $TMP/company.description."${SER}" -out $OUT/company.description."${SER}" -keys $KEY_OP_A,$KEY_EVA_B,$KEY_CERT_B -x5cs $CHAIN_OP_A:$CHAIN_EVA_B:$CHAIN_CERT_B
cmc-signing-tool -in $TMP/device.description."${SER}" -out $OUT/device.description."${SER}" -keys $KEY_OP_A -x5cs $CHAIN_OP_A
cmc-signing-tool -in $TMP/device.config."${SER}" -out $OUT/device.config."${SER}" -keys $KEY_OP_A -x5cs $CHAIN_OP_A
91 changes: 23 additions & 68 deletions example-setup/setup-full-simple
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,52 +1,53 @@
#!/bin/bash

set -e
set -euo pipefail

function abs_path() {
if [ -d "$(dirname "$1")" ]
trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
export PATH=${PATH}:${HOME}/go/bin

abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

if [ "$#" -ne 3 ]; then
if [[ "$#" -ne 3 ]]; then
echo "Usage: ./setup-full-simple <cmc-folder> <data-folder> <cbor|json>"
exit
fi

CMC="$(abs_path $1)"
DATA="$(abs_path $2)"
SER="$3"
cmc=$(set -e; abs_path "$1")
data=$(set -e; abs_path "$2")
ser="${3}"

if [ ! -d "$CMC" ]; then
if [[ ! -d "${cmc}" ]]; then
echo "CMC directory does not exist. Did you clone the repository? Abort.."
exit 1
fi

if [ -d "$DATA" ]; then
if [[ -d "${data}" ]]; then
echo "Data directory does already exist. Please choose a new directory. Abort.."
exit 1
fi

echo "Using CMC: $CMC"
echo "Using $DATA as directory for local data"

export PATH=$PATH:$HOME/go/bin
echo "Using CMC: ${cmc}"
echo "Using ${data} as directory for local data"

# Create a folder for the cmc configuration and metadata
mkdir -p $DATA
mkdir -p "${data}"

# Install dependencies
sudo apt install -y moreutils golang-cfssl build-essential zlib1g-dev libssl-dev jq

# Intall tpm-pcr-tools
git clone https://github.com/Fraunhofer-AISEC/tpm-pcr-tools.git $DATA/tpm-pcr-tools
cd $DATA/tpm-pcr-tools
git clone https://github.com/Fraunhofer-AISEC/tpm-pcr-tools.git "${data}/tpm-pcr-tools"
cd "${data}/tpm-pcr-tools"
make
sudo make install

# Build CMC
cd $CMC
cd "${cmc}"
echo "Building CMC.."
go build ./...

Expand All @@ -55,56 +56,10 @@ echo "Installing CMC"
go install ./...

# Copy metadata templates
cp -r $CMC/example-setup/* $DATA
cp -r "${cmc}/example-setup/"* "${data}"

# Generate a PKI suitable for your needs. You can use the simple PKI example-setup for testing:
$DATA/setup-pki-simple -i $DATA -o $DATA/pki

# Parse the values of the RTM PCRs from the kernel's binary bios measurements as reference values
referenceValues=$(sudo parse-srtm-pcrs -p 0,1,2,3,4,5,6,7 -f json)

# Delete existing reference values in the RTM Manifest
jq 'del(.referenceValues[])' $DATA/metadata-raw/rtm.manifest.json | sponge $DATA/metadata-raw/rtm.manifest.json

# Add new reference values
jq --argjson ver "$referenceValues" '.referenceValues += $ver' $DATA/metadata-raw/rtm.manifest.json | sponge $DATA/metadata-raw/rtm.manifest.json

# Do this for the OS manifest as well
referenceValues=$(sudo parse-srtm-pcrs -p 8,9 -f json)
jq 'del(.referenceValues[])' $DATA/metadata-raw/os.manifest.json | sponge $DATA/metadata-raw/os.manifest.json
jq --argjson ver "$referenceValues" '.referenceValues += $ver' $DATA/metadata-raw/os.manifest.json | sponge $DATA/metadata-raw/os.manifest.json

# Sign the metadata*
IN=$DATA/metadata-raw
TMP=$DATA/metadata-tmp
OUT=$DATA/metadata-signed
KEY=$DATA/pki/signing-cert-key.pem
CHAIN=$DATA/pki/signing-cert.pem,$DATA/pki/ca.pem

rm -rf $TMP
rm -rf $OUT

mkdir -p $TMP
mkdir -p $OUT

if [ "${SER,,}" = "json" ]; then
echo "using json serialization"
cp $IN/rtm.manifest.json $TMP/rtm.manifest.json
cp $IN/os.manifest.json $TMP/os.manifest.json
cp $IN/device.description.json $TMP/device.description.json
cp $IN/device.config.json $TMP/device.config.json
elif [ "${SER,,}" = "cbor" ]; then
echo "using cbor serialiation"
cmc-converter -in $IN/rtm.manifest.json -out $TMP/rtm.manifest.cbor -outform cbor
cmc-converter -in $IN/os.manifest.json -out $TMP/os.manifest.cbor -outform cbor
cmc-converter -in $IN/device.description.json -out $TMP/device.description.cbor -outform cbor
cmc-converter -in $IN/device.config.json -out $TMP/device.config.cbor -outform cbor
else
echo "serialization format ${SER} is not supported"
exit 1
fi
"${data}/setup-pki-simple" -i "${data}" -o "${data}/pki"

cmc-signing-tool -in $TMP/rtm.manifest."${SER}" -out $OUT/rtm.manifest."${SER}" -keys $KEY -x5cs $CHAIN
cmc-signing-tool -in $TMP/os.manifest."${SER}" -out $OUT/os.manifest."${SER}" -keys $KEY -x5cs $CHAIN
cmc-signing-tool -in $TMP/device.description."${SER}" -out $OUT/device.description."${SER}" -keys $KEY -x5cs $CHAIN
cmc-signing-tool -in $TMP/device.config."${SER}" -out $OUT/device.config."${SER}" -keys $KEY -x5cs $CHAIN
# Update and sign metadata
"${data}/update-full-simple" "${data}" "${ser}"
Loading
Loading