Skip to content

Commit

Permalink
Aligh Interface to handle multiple TAID and RefValID
Browse files Browse the repository at this point in the history 
Signed-off-by: Yogesh Deshpande <[email protected]>
  • Loading branch information
@yogeshbdeshpande
yogeshbdeshpande committed Dec 10, 2023
1 parent 1c05045 commit 4279f78
Show file tree
Hide file tree
Showing 10 changed files with 61 additions and 61 deletions.
42 changes: 21 additions & 21 deletions proto/evidence.pb.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions proto/evidence.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ option go_package = "github.com/veraison/services/proto";

message EvidenceContext {
string tenant_id = 1 [json_name = "tenant-id"];
repeated string trust_anchor_id = 2 [json_name = "trust-anchor-id"];
repeated string reference_id = 3 [json_name = "reference-id"];
repeated string trust_anchor_ids = 2 [json_name = "trust-anchor-ids"];
repeated string reference_ids = 3 [json_name = "reference-ids"];
google.protobuf.Struct evidence = 5;
}
4 changes: 2 additions & 2 deletions scheme/cca-ssd-platform/test/extracted.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
"cca-realm-public-key-hash-algo-id": "sha-512"
}
},
"reference-id": ["CCA_SSD_PLATFORM://1/BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg=/AQcGBQQDAgEADw4NDAsKCQgXFhUUExIREB8eHRwbGhkY"],
"trust-anchor-id": ["CCA_SSD_PLATFORM://1/BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg=/"],
"reference-ids": ["CCA_SSD_PLATFORM://1/BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg=/AQcGBQQDAgEADw4NDAsKCQgXFhUUExIREB8eHRwbGhkY"],
"trust-anchor-ids": ["CCA_SSD_PLATFORM://1/BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg=/"],
"tenant-id": "1"
}
4 changes: 2 additions & 2 deletions scheme/parsec-cca/test/evidence/extracted.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"nonce": "AAECAwQFBgc="
}
},
"reference-id": ["PARSEC_CCA://0/f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAUFgAAAAAAAA="],
"trust-anchor-id": ["PARSEC_CCA://1/f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAUFgAAAAAAAA=/AQcGBQQDAgEADw4NDAsKCQgXFhUUExIREB8eHRwbGhkY"],
"reference-ids": ["PARSEC_CCA://0/f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAUFgAAAAAAAA="],
"trust-anchor-ids": ["PARSEC_CCA://1/f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAUFgAAAAAAAA=/AQcGBQQDAgEADw4NDAsKCQgXFhUUExIREB8eHRwbGhkY"],
"tenant-id": "1"
}
4 changes: 2 additions & 2 deletions scheme/parsec-tpm/test/evidence/extracted.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"tpmVer": "2.0"
}
},
"reference-id": ["PARSEC_TPM://1/YWNtZS1pbXBsZW1lbnRhdGlvbi1pZC0wMDAwMDAwMDE="],
"trust-anchor-id": ["PARSEC_TPM://1/AagIEsUMYDNxd1p5UuAACkxJGfJf9rcUZ/oyRFHDcAxn"],
"reference-ids": ["PARSEC_TPM://1/YWNtZS1pbXBsZW1lbnRhdGlvbi1pZC0wMDAwMDAwMDE="],
"trust-anchor-ids": ["PARSEC_TPM://1/AagIEsUMYDNxd1p5UuAACkxJGfJf9rcUZ/oyRFHDcAxn"],
"tenant-id": "1"
}
4 changes: 2 additions & 2 deletions scheme/parsec-tpm/test/evidence/matched_extracted.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"tpmVer": "2.0"
}
},
"reference-id": ["PARSEC_TPM://1/YWNtZS1pbXBsZW1lbnRhdGlvbi1pZC0wMDAwMDAwMDE="],
"trust-anchor-id": ["PARSEC_TPM://1/AagIEsUMYDNxd1p5UuAACkxJGfJf9rcUZ/oyRFHDcAxn"],
"reference-ids": ["PARSEC_TPM://1/YWNtZS1pbXBsZW1lbnRhdGlvbi1pZC0wMDAwMDAwMDE="],
"trust-anchor-ids": ["PARSEC_TPM://1/AagIEsUMYDNxd1p5UuAACkxJGfJf9rcUZ/oyRFHDcAxn"],
"tenant-id": "1"
}
4 changes: 2 additions & 2 deletions scheme/psa-iot/test/extracted.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
}
]
},
"reference-id": ["PSA_IOT://1/BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg=/AQcGBQQDAgEADw4NDAsKCQgXFhUUExIREB8eHRwbGhkY"],
"trust-anchor-id": ["PSA_IOT://1/BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg=/"],
"reference-ids": ["PSA_IOT://1/BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg=/AQcGBQQDAgEADw4NDAsKCQgXFhUUExIREB8eHRwbGhkY"],
"trust-anchor-ids": ["PSA_IOT://1/BwYFBAMCAQAPDg0MCwoJCBcWFRQTEhEQHx4dHBsaGRg=/"],
"tenant-id": "1"
}
10 changes: 5 additions & 5 deletions scheme/tpm-enacttrust/evidence_handler_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ func Test_DecodeAttestationData_ok(t *testing.T) {
assert.Equal(t, uint64(0x7), decoded.AttestationData.FirmwareVersion)
}

func Test_GetTrustAnchorID_ok(t *testing.T) {
func Test_GetTrustAnchorIds_ok(t *testing.T) {
data, err := os.ReadFile("test/tokens/basic.token")
require.NoError(t, err)

Expand Down Expand Up @@ -119,10 +119,10 @@ func Test_GetAttestation(t *testing.T) {
require.NoError(t, err)

evidenceContext := &proto.EvidenceContext{
TenantId: "0",
TrustAnchorId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
TenantId: "0",
TrustAnchorIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
}

refvalBytes, err := os.ReadFile("test/refval.json")
Expand Down
32 changes: 16 additions & 16 deletions vts/policymanager/policymanager_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,10 @@ func TestPolicyMgr_getPolicy_not_found(t *testing.T) {
appraisal := &appraisal.Appraisal{
Scheme: "TPM_ENACTTRUST",
EvidenceContext: &proto.EvidenceContext{
TenantId: "0",
TrustAnchorId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
TenantId: "0",
TrustAnchorIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
},
}

Expand Down Expand Up @@ -73,10 +73,10 @@ func TestPolicyMgr_getPolicy_OK(t *testing.T) {
appraisal := &appraisal.Appraisal{
Scheme: "TPM_ENACTTRUST",
EvidenceContext: &proto.EvidenceContext{
TenantId: "0",
TrustAnchorId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
TenantId: "0",
TrustAnchorIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
},
}

Expand Down Expand Up @@ -121,10 +121,10 @@ func TestPolicyMgr_Evaluate_OK(t *testing.T) {
Return([]string{`{"uuid": "7df7714e-aa04-4638-bcbf-434b1dd720f1", "active": true}`}, nil)

ec := &proto.EvidenceContext{
TenantId: "0",
TrustAnchorId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
TenantId: "0",
TrustAnchorIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
}
endorsements := []string{"h0KPxSKAPTEGXnvOPPA/5HUJZjHl4Hu9eg/eYMTPJcc="}
ar := ear.NewAttestationResult("test", "test", "test")
Expand Down Expand Up @@ -167,10 +167,10 @@ func TestPolicyMgr_Evaluate_NOK(t *testing.T) {
Return([]string{`{"uuid": "7df7714e-aa04-4638-bcbf-434b1dd720f1", "active": true}`}, nil)

ec := &proto.EvidenceContext{
TenantId: "0",
TrustAnchorId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceId: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
TenantId: "0",
TrustAnchorIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
ReferenceIds: []string{"TPM_ENACTTRUST://0/7df7714e-aa04-4638-bcbf-434b1dd720f1"},
Evidence: evStruct,
}
endorsements := []string{"h0KPxSKAPTEGXnvOPPA/5HUJZjHl4Hu9eg/eYMTPJcc="}
ar := ear.NewAttestationResult("test", "test", "test")
Expand Down
14 changes: 7 additions & 7 deletions vts/trustedservices/trustedservices_grpc.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -335,11 +335,11 @@ func (o *GRPC) GetAttestation(
return o.finalize(appraisal, err)
}

ta, err := o.getTrustAnchor(appraisal.EvidenceContext.TrustAnchorId)
ta, err := o.getTrustAnchor(appraisal.EvidenceContext.TrustAnchorIds)
if err != nil {
if errors.Is(err, kvstore.ErrKeyNotFound) {
err = handlermod.BadEvidence("no trust anchor for %s",
appraisal.EvidenceContext.TrustAnchorId)
appraisal.EvidenceContext.TrustAnchorIds)
appraisal.SetAllClaims(ear.CryptoValidationFailedClaim)
appraisal.AddPolicyClaim("problem", "no trust anchor for evidence")
}
Expand All @@ -360,14 +360,14 @@ func (o *GRPC) GetAttestation(
return o.finalize(appraisal, err)
}

appraisal.EvidenceContext.ReferenceId = extracted.ReferenceIDs
appraisal.EvidenceContext.ReferenceIds = extracted.ReferenceIDs

o.logger.Debugw("constructed evidence context",
"software-id", appraisal.EvidenceContext.ReferenceId,
"trust-anchor-id", appraisal.EvidenceContext.TrustAnchorId)
"software-id", appraisal.EvidenceContext.ReferenceIds,
"trust-anchor-id", appraisal.EvidenceContext.TrustAnchorIds)

var tendorsements []string
for _, reference := range appraisal.EvidenceContext.ReferenceId {
for _, reference := range appraisal.EvidenceContext.ReferenceIds {

endorsements, err := o.EnStore.Get(reference)
if err != nil && !errors.Is(err, kvstore.ErrKeyNotFound) {
Expand Down Expand Up @@ -416,7 +416,7 @@ func (c *GRPC) initEvidenceContext(
var err error

appraisal := appraisal.New(token.TenantId, token.Nonce, handler.GetAttestationScheme())
appraisal.EvidenceContext.TrustAnchorId, err = handler.GetTrustAnchorIDs(token)
appraisal.EvidenceContext.TrustAnchorIds, err = handler.GetTrustAnchorIDs(token)

if errors.Is(err, handlermod.BadEvidenceError{}) {
appraisal.SetAllClaims(ear.CryptoValidationFailedClaim)
Expand Down

0 comments on commit 4279f78

Please sign in to comment.