verifier: Use the VirTEE CA Chain

This introduces changes into the code to utilize the cert chain provided by the VirTEE sev crate, pushing resposibility for upkeep and maintainership back to the library itself. This also reduces duplication of code and expands functionality for future changes. Signed-off-by: Larry Dewey <larry.dewey@amd.com>
confidential-containers · Jul 26, 2024 · 1127fb7 · 1127fb7
1 parent 1e8a88a
commit 1127fb7
Show file tree

Hide file tree

Showing 9 changed files with 101 additions and 76 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -34,7 +34,11 @@ kbs-types = "0.6.0"
 jsonwebtoken = { version = "9", default-features = false }
 log = "0.4.17"
 prost = "0.11.0"
-regorus = { version = "0.1.5", default-features = false, features = ["regex", "base64", "time"] }
+regorus = { version = "0.1.5", default-features = false, features = [
+    "regex",
+    "base64",
+    "time",
+] }
 rstest = "0.18.1"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.89"
@@ -44,7 +48,10 @@ sha2 = "0.10"
 shadow-rs = "0.19.0"
 strum = { version = "0.25", features = ["derive"] }
 thiserror = "1.0"
-tokio = { version = "1.23.0", features = ["full"] }
+tokio = { version = "1.23.0", features = ["full"], default-features = false }
 tempfile = "3.4.0"
 tonic = "0.8.1"
-tonic-build = "0.8.0"
+tonic-build = "0.8.0"
+
+[patch.crates-io]
+sev = { version = "3.1.1", path = "/home/larry/git/larrydewey/virtee-sev" }
diff --git a/attestation-service/Makefile b/attestation-service/Makefile
@@ -23,7 +23,6 @@ grpc-as:
 
 restful-as:
 	cargo build --bin restful-as $(release) --features restful-bin
-
 install:
 	for bin_name in $(BIN_NAMES); do \
 		install -D -m0755 $(TARGET_DIR)/$$bin_name $(DESTDIR); \

diff --git a/attestation-service/verifier/Cargo.toml b/attestation-service/verifier/Cargo.toml
@@ -4,31 +4,44 @@ version = "0.1.0"
 edition = "2021"
 
 [features]
-default = [ "all-verifier" ]
-all-verifier = [ "tdx-verifier", "sgx-verifier", "snp-verifier", "az-snp-vtpm-verifier", "az-tdx-vtpm-verifier", "csv-verifier", "cca-verifier", "se-verifier" ]
-tdx-verifier = [ "eventlog-rs", "scroll", "intel-tee-quote-verification-rs" ]
-sgx-verifier = [ "scroll", "intel-tee-quote-verification-rs" ]
-az-snp-vtpm-verifier = [ "az-snp-vtpm", "sev", "snp-verifier" ]
-az-tdx-vtpm-verifier = [ "az-tdx-vtpm", "openssl", "tdx-verifier" ]
-snp-verifier = [ "asn1-rs", "openssl", "sev", "x509-parser" ]
-csv-verifier = [ "openssl", "csv-rs", "codicon" ]
-cca-verifier = [ "ear", "jsonwebtoken", "veraison-apiclient" ]
-se-verifier = [ "openssl", "pv", "serde_with", "tokio/sync" ]
+default = ["all-verifier"]
+all-verifier = [
+    "tdx-verifier",
+    "sgx-verifier",
+    "snp-verifier",
+    "az-snp-vtpm-verifier",
+    "az-tdx-vtpm-verifier",
+    "csv-verifier",
+    "cca-verifier",
+    "se-verifier",
+]
+tdx-verifier = ["eventlog-rs", "scroll", "intel-tee-quote-verification-rs"]
+sgx-verifier = ["scroll", "intel-tee-quote-verification-rs"]
+az-snp-vtpm-verifier = ["az-snp-vtpm", "sev", "snp-verifier"]
+az-tdx-vtpm-verifier = ["az-tdx-vtpm", "openssl", "tdx-verifier"]
+snp-verifier = ["asn1-rs", "openssl", "sev", "x509-parser"]
+csv-verifier = ["openssl", "csv-rs", "codicon"]
+cca-verifier = ["ear", "jsonwebtoken", "veraison-apiclient"]
+se-verifier = ["openssl", "pv", "serde_with", "tokio/sync"]
 
 [dependencies]
 anyhow.workspace = true
 thiserror.workspace = true
 asn1-rs = { version = "0.5.1", optional = true }
 async-trait.workspace = true
-az-snp-vtpm = { version = "0.5.3", default-features = false, features = ["verifier"], optional = true }
-az-tdx-vtpm = { version = "0.5.3", default-features = false, features = ["verifier"], optional = true }
+az-snp-vtpm = { version = "=0.5.3", default-features = false, features = [
+    "verifier",
+], optional = true }
+az-tdx-vtpm = { version = "=0.5.3", default-features = false, features = [
+    "verifier",
+], optional = true }
 base64 = "0.21"
 bincode = "1.3.3"
 byteorder = "1"
 cfg-if = "1.0.0"
 codicon = { version = "3.0", optional = true }
 # TODO: change it to "0.1", once released.
-csv-rs = { git = "https://github.com/openanolis/csv-rs", rev = "b74aa8c", optional = true }
+csv-rs = { version = "=0.1.0", git = "https://github.com/openanolis/csv-rs", rev = "b74aa8c", optional = true }
 eventlog-rs = { version = "0.1.3", optional = true }
 hex.workspace = true
 jsonwebkey = "0.3.5"
@@ -37,12 +50,14 @@ kbs-types.workspace = true
 log.workspace = true
 openssl = { version = "0.10.55", optional = true }
 pv = { version = "0.10.0", package = "s390_pv", optional = true }
-scroll = { version = "0.11.0", default-features = false, features = ["derive"], optional = true }
+scroll = { version = "0.11.0", default-features = false, features = [
+    "derive",
+], optional = true }
 serde.workspace = true
 serde_json.workspace = true
 serde_with = { workspace = true, optional = true }
 sev = { version = "3.1.1", features = ["openssl", "snp"], optional = true }
-tokio = { workspace = true, optional = true, default-features = false }
+tokio = { workspace = true, optional = true }
 intel-tee-quote-verification-rs = { git = "https://github.com/intel/SGXDataCenterAttestationPrimitives", tag = "DCAP_1.21", optional = true }
 strum.workspace = true
 veraison-apiclient = { git = "https://github.com/chendave/rust-apiclient", branch = "token", optional = true }

diff --git a/attestation-service/verifier/src/az_snp_vtpm/mod.rs b/attestation-service/verifier/src/az_snp_vtpm/mod.rs
@@ -4,9 +4,7 @@
 //
 
 use super::{TeeEvidenceParsedClaim, Verifier};
-use crate::snp::{
-    load_milan_cert_chain, parse_tee_evidence, verify_report_signature, VendorCertificates,
-};
+use crate::snp::{load_milan_cert_chain, parse_tee_evidence, verify_report_signature};
 use crate::{InitDataHash, ReportData};
 use anyhow::{bail, Context, Result};
 use async_trait::async_trait;
@@ -19,6 +17,7 @@ use log::{debug, warn};
 use openssl::pkey::PKey;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
+use sev::certs::snp::Chain;
 use sev::firmware::host::{CertTableEntry, CertType};
 use thiserror::Error;
 
@@ -32,7 +31,7 @@ struct Evidence {
 }
 
 pub struct AzSnpVtpm {
-    vendor_certs: VendorCertificates,
+    vendor_certs: Chain,
 }
 
 #[derive(Error, Debug)]
@@ -54,12 +53,10 @@ pub enum CertError {
 }
 
 impl AzSnpVtpm {
-    pub fn new() -> Result<Self, CertError> {
-        let Result::Ok(vendor_certs) = load_milan_cert_chain() else {
-            return Err(CertError::LoadMilanCert);
-        };
-        let vendor_certs = vendor_certs.clone();
-        Ok(Self { vendor_certs })
+    pub fn new() -> Self {
+        Self {
+            vendor_certs: load_milan_cert_chain().clone(),
+        }
     }
 }
 
@@ -171,7 +168,7 @@ fn verify_report_data(
 fn verify_snp_report(
     snp_report: &AttestationReport,
     vcek: &Vcek,
-    vendor_certs: &VendorCertificates,
+    vendor_certs: &Chain,
 ) -> Result<(), CertError> {
     let vcek_data = vcek.0.to_der().context("Failed to get raw VCEK data")?;
     let cert_chain = [CertTableEntry::new(CertType::VCEK, vcek_data)];
@@ -199,7 +196,7 @@ mod tests {
         let hcl_report = HclReport::new(REPORT.to_vec()).unwrap();
         let snp_report = hcl_report.try_into().unwrap();
         let vcek = Vcek::from_pem(include_str!("../../test_data/az-snp-vtpm/vcek.pem")).unwrap();
-        let vendor_certs = load_milan_cert_chain().as_ref().unwrap();
+        let vendor_certs = load_milan_cert_chain();
         verify_snp_report(&snp_report, &vcek, vendor_certs).unwrap();
     }
 
@@ -211,7 +208,7 @@ mod tests {
         let hcl_report = HclReport::new(wrong_report.to_vec()).unwrap();
         let snp_report = hcl_report.try_into().unwrap();
         let vcek = Vcek::from_pem(include_str!("../../test_data/az-snp-vtpm/vcek.pem")).unwrap();
-        let vendor_certs = load_milan_cert_chain().as_ref().unwrap();
+        let vendor_certs = load_milan_cert_chain();
         assert_eq!(
             verify_snp_report(&snp_report, &vcek, vendor_certs)
                 .unwrap_err()

diff --git a/attestation-service/verifier/src/lib.rs b/attestation-service/verifier/src/lib.rs
@@ -37,7 +37,7 @@ pub fn to_verifier(tee: &Tee) -> Result<Box<dyn Verifier + Send + Sync>> {
         Tee::AzSnpVtpm => {
             cfg_if::cfg_if! {
                 if #[cfg(feature = "az-snp-vtpm-verifier")] {
-                    let verifier = az_snp_vtpm::AzSnpVtpm::new()?;
+                    let verifier = az_snp_vtpm::AzSnpVtpm::new();
                     Ok(Box::new(verifier) as Box<dyn Verifier + Send + Sync>)
                 } else {
                     bail!("feature `az-snp-vtpm-verifier` is not enabled for `verifier` crate.")
@@ -65,7 +65,7 @@ pub fn to_verifier(tee: &Tee) -> Result<Box<dyn Verifier + Send + Sync>> {
         Tee::Snp => {
             cfg_if::cfg_if! {
                 if #[cfg(feature = "snp-verifier")] {
-                    let verifier = snp::Snp::new()?;
+                    let verifier = snp::Snp::new();
                     Ok(Box::new(verifier) as Box<dyn Verifier + Send + Sync>)
                 } else {
                     bail!("feature `snp-verifier` is not enabled for `verifier` crate.")

diff --git a/attestation-service/verifier/src/sgx/claims.rs b/attestation-service/verifier/src/sgx/claims.rs
@@ -113,6 +113,7 @@ pub fn generate_parsed_claims(quote: sgx_quote3_t) -> Result<TeeEvidenceParsedCl
 }
 
 /// Kernel Commandline Event inside Eventlog
+#[allow(dead_code)]
 pub struct TdShimPlatformConfigInfo<'a> {
     pub descriptor: [u8; 16],
     pub info_length: u32,