Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

treewide: allow multiple validators #783

Merged
merged 1 commit into from
Aug 14, 2024
Merged

treewide: allow multiple validators #783

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions cli/cmd/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,18 @@ package cmd
import (
"context"
_ "embed"
"fmt"
"log/slog"
"os"
"path/filepath"
"time"

"github.com/edgelesssys/contrast/cli/telemetry"
"github.com/edgelesssys/contrast/internal/atls"
"github.com/edgelesssys/contrast/internal/attestation/snp"
"github.com/edgelesssys/contrast/internal/fsstore"
"github.com/edgelesssys/contrast/internal/logger"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -72,3 +79,27 @@ func withTelemetry(runFunc func(*cobra.Command, []string) error) func(*cobra.Com
return cmdErr
}
}

// validatorsFromManifest returns a list of validators corresponding to the reference values in the given manifest.
func validatorsFromManifest(m *manifest.Manifest, log *slog.Logger, hostData []byte) ([]atls.Validator, error) {
kdsDir, err := cachedir("kds")
if err != nil {
return nil, fmt.Errorf("getting cache dir: %w", err)
}
log.Debug("Using KDS cache dir", "dir", kdsDir)
kdsCache := fsstore.New(kdsDir, log.WithGroup("kds-cache"))
kdsGetter := snp.NewCachedHTTPSGetter(kdsCache, snp.NeverGCTicker, log.WithGroup("kds-getter"))

opts, err := m.SNPValidateOpts()
if err != nil {
return nil, fmt.Errorf("getting SNP validate options: %w", err)
}

var validators []atls.Validator
for _, opt := range opts {
validators = append(validators, snp.NewValidator(opt, []manifest.HexString{manifest.NewHexString(hostData)}, kdsGetter,
logger.NewWithAttrs(logger.NewNamed(log, "validator"), map[string]string{"tee-type": "snp"}),
))
}
return validators, nil
}
19 changes: 3 additions & 16 deletions cli/cmd/recover.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,7 @@ import (
"path/filepath"

"github.com/edgelesssys/contrast/internal/atls"
"github.com/edgelesssys/contrast/internal/attestation/snp"
"github.com/edgelesssys/contrast/internal/fsstore"
"github.com/edgelesssys/contrast/internal/grpc/dialer"
"github.com/edgelesssys/contrast/internal/logger"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/spf13/cobra"
Expand Down Expand Up @@ -76,22 +73,12 @@ func runRecover(cmd *cobra.Command, _ []string) error {
return fmt.Errorf("decrypting seed: %w", err)
}

kdsDir, err := cachedir("kds")
validators, err := validatorsFromManifest(&m, log, flags.policy)
if err != nil {
return fmt.Errorf("getting cache dir: %w", err)
return fmt.Errorf("getting validators: %w", err)
}
log.Debug("Using KDS cache dir", "dir", kdsDir)

validateOptsGen, err := newCoordinatorValidateOptsGen(m, flags.policy)
if err != nil {
return fmt.Errorf("generating validate opts: %w", err)
}
kdsCache := fsstore.New(kdsDir, log.WithGroup("kds-cache"))
kdsGetter := snp.NewCachedHTTPSGetter(kdsCache, snp.NeverGCTicker, log.WithGroup("kds-getter"))
validator := snp.NewValidator(validateOptsGen, kdsGetter,
logger.NewWithAttrs(logger.NewNamed(log, "validator"), map[string]string{"tee-type": "snp"}),
)
dialer := dialer.NewWithKey(atls.NoIssuer, validator, &net.Dialer{}, workloadOwnerKey)
dialer := dialer.NewWithKey(atls.NoIssuer, validators, &net.Dialer{}, workloadOwnerKey)

log.Debug("Dialing coordinator", "endpoint", flags.coordinator)
conn, err := dialer.Dial(cmd.Context(), flags.coordinator)
Expand Down
20 changes: 3 additions & 17 deletions cli/cmd/set.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,8 @@ import (
"time"

"github.com/edgelesssys/contrast/internal/atls"
"github.com/edgelesssys/contrast/internal/attestation/snp"
"github.com/edgelesssys/contrast/internal/fsstore"
"github.com/edgelesssys/contrast/internal/grpc/dialer"
grpcRetry "github.com/edgelesssys/contrast/internal/grpc/retry"
"github.com/edgelesssys/contrast/internal/logger"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/retry"
"github.com/edgelesssys/contrast/internal/spinner"
Expand Down Expand Up @@ -101,22 +98,11 @@ func runSet(cmd *cobra.Command, args []string) error {
return fmt.Errorf("checking policies match manifest: %w", err)
}

kdsDir, err := cachedir("kds")
validators, err := validatorsFromManifest(&m, log, flags.policy)
if err != nil {
return fmt.Errorf("getting cache dir: %w", err)
return fmt.Errorf("getting validators: %w", err)
}
log.Debug("Using KDS cache dir", "dir", kdsDir)

validateOptsGen, err := newCoordinatorValidateOptsGen(m, flags.policy)
if err != nil {
return fmt.Errorf("generating validate opts: %w", err)
}
kdsCache := fsstore.New(kdsDir, log.WithGroup("kds-cache"))
kdsGetter := snp.NewCachedHTTPSGetter(kdsCache, snp.NeverGCTicker, log.WithGroup("kds-getter"))
validator := snp.NewValidator(validateOptsGen, kdsGetter,
logger.NewWithAttrs(logger.NewNamed(log, "validator"), map[string]string{"tee-type": "snp"}),
)
dialer := dialer.NewWithKey(atls.NoIssuer, validator, &net.Dialer{}, workloadOwnerKey)
dialer := dialer.NewWithKey(atls.NoIssuer, validators, &net.Dialer{}, workloadOwnerKey)

conn, err := dialer.Dial(cmd.Context(), flags.coordinator)
if err != nil {
Expand Down
31 changes: 3 additions & 28 deletions cli/cmd/verify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,7 @@ import (
"path/filepath"

"github.com/edgelesssys/contrast/internal/atls"
"github.com/edgelesssys/contrast/internal/attestation/snp"
"github.com/edgelesssys/contrast/internal/fsstore"
"github.com/edgelesssys/contrast/internal/grpc/dialer"
"github.com/edgelesssys/contrast/internal/logger"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/spf13/cobra"
Expand Down Expand Up @@ -71,22 +68,11 @@ func runVerify(cmd *cobra.Command, _ []string) error {
return fmt.Errorf("validating manifest: %w", err)
}

kdsDir, err := cachedir("kds")
validators, err := validatorsFromManifest(&m, log, flags.policy)
if err != nil {
return fmt.Errorf("getting cache dir: %w", err)
return fmt.Errorf("getting validators: %w", err)
}
log.Debug("Using KDS cache dir", "dir", kdsDir)

validateOptsGen, err := newCoordinatorValidateOptsGen(m, flags.policy)
if err != nil {
return fmt.Errorf("generating validate opts: %w", err)
}
kdsCache := fsstore.New(kdsDir, log.WithGroup("kds-cache"))
kdsGetter := snp.NewCachedHTTPSGetter(kdsCache, snp.NeverGCTicker, log.WithGroup("kds-getter"))
validator := snp.NewValidator(validateOptsGen, kdsGetter,
logger.NewWithAttrs(logger.NewNamed(log, "validator"), map[string]string{"tee-type": "snp"}),
)
dialer := dialer.New(atls.NoIssuer, validator, &net.Dialer{})
dialer := dialer.New(atls.NoIssuer, validators, &net.Dialer{})

log.Debug("Dialing coordinator", "endpoint", flags.coordinator)
conn, err := dialer.Dial(cmd.Context(), flags.coordinator)
Expand Down Expand Up @@ -174,17 +160,6 @@ func parseVerifyFlags(cmd *cobra.Command) (*verifyFlags, error) {
}, nil
}

func newCoordinatorValidateOptsGen(mnfst manifest.Manifest, hostData []byte) (*snp.StaticValidateOptsGenerator, error) {
validateOpts, err := mnfst.AKSValidateOpts()
if err != nil {
return nil, err
}
validateOpts.HostData = hostData
return &snp.StaticValidateOptsGenerator{
Opts: validateOpts,
}, nil
}

func writeFilelist(dir string, filelist map[string][]byte) error {
if dir != "" {
if err := os.MkdirAll(dir, 0o755); err != nil {
Expand Down
18 changes: 0 additions & 18 deletions coordinator/internal/authority/authority.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,6 @@ import (
"github.com/edgelesssys/contrast/internal/ca"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/google/go-sev-guest/proto/sevsnp"
"github.com/google/go-sev-guest/validate"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promauto"
)
Expand Down Expand Up @@ -171,19 +169,3 @@ type State struct {
latest *history.LatestTransition
generation int
}

// SNPValidateOpts returns SNP validation options from reference values.
//
// It also ensures that the policy hash in the report's HOSTDATA is allowed by the current
// manifest.
// TODO(msanft): make the manifest authoritative and allow other types of reference values.
func (s *State) SNPValidateOpts(report *sevsnp.Report) (*validate.Options, error) {
mnfst := s.Manifest

hostData := manifest.NewHexString(report.HostData)
if _, ok := mnfst.Policies[hostData]; !ok {
return nil, fmt.Errorf("hostdata %s not found in manifest", hostData)
}

return mnfst.AKSValidateOpts()
}
14 changes: 2 additions & 12 deletions coordinator/internal/authority/authority_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ import (
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/platforms"
"github.com/edgelesssys/contrast/internal/userapi"
"github.com/google/go-sev-guest/proto/sevsnp"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/testutil"
"github.com/spf13/afero"
Expand All @@ -37,8 +36,6 @@ func TestSNPValidateOpts(t *testing.T) {
require := require.New(t)
a, _ := newAuthority(t)
_, mnfstBytes, policies := newManifest(t)
policyHash := sha256.Sum256(policies[0])
report := &sevsnp.Report{HostData: policyHash[:]}

req := &userapi.SetManifestRequest{
Manifest: mnfstBytes,
Expand All @@ -47,16 +44,9 @@ func TestSNPValidateOpts(t *testing.T) {
_, err := a.SetManifest(context.Background(), req)
require.NoError(err)

opts, err := a.state.Load().SNPValidateOpts(report)
gens, err := a.state.Load().Manifest.SNPValidateOpts()
require.NoError(err)
require.NotNil(opts)

// Change to unknown policy hash in HostData.
report.HostData[0]++

opts, err = a.state.Load().SNPValidateOpts(report)
require.Error(err)
require.Nil(opts)
require.NotNil(gens)
}

// TODO(burgerdev): test ValidateCallback and GetCertBundle
Expand Down
22 changes: 18 additions & 4 deletions coordinator/internal/authority/credentials.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ import (
"github.com/edgelesssys/contrast/internal/atls"
"github.com/edgelesssys/contrast/internal/attestation/snp"
"github.com/edgelesssys/contrast/internal/logger"
"github.com/edgelesssys/contrast/internal/manifest"
"github.com/edgelesssys/contrast/internal/memstore"
"github.com/google/go-sev-guest/proto/sevsnp"
"github.com/prometheus/client_golang/prometheus"
Expand Down Expand Up @@ -72,11 +73,24 @@ func (c *Credentials) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.A

authInfo := AuthInfo{State: state}

validator := snp.NewValidatorWithCallbacks(state, c.kdsGetter,
logger.NewWithAttrs(logger.NewNamed(c.logger, "validator"), map[string]string{"tee-type": "snp"}),
c.attestationFailuresCounter, &authInfo)
opts, err := state.Manifest.SNPValidateOpts()
if err != nil {
return nil, nil, fmt.Errorf("generating SNP validation options: %w", err)
}

serverCfg, err := atls.CreateAttestationServerTLSConfig(c.issuer, []atls.Validator{validator})
var allowedHostDataEntries []manifest.HexString
for entry := range state.Manifest.Policies {
allowedHostDataEntries = append(allowedHostDataEntries, entry)
}

var validators []atls.Validator
for _, opt := range opts {
validator := snp.NewValidatorWithCallbacks(opt, allowedHostDataEntries, c.kdsGetter,
logger.NewWithAttrs(logger.NewNamed(c.logger, "validator"), map[string]string{"tee-type": "snp"}),
c.attestationFailuresCounter, &authInfo)
validators = append(validators, validator)
}
serverCfg, err := atls.CreateAttestationServerTLSConfig(c.issuer, validators)
if err != nil {
return nil, nil, err
}
Expand Down
4 changes: 3 additions & 1 deletion initializer/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,9 @@ func run() (retErr error) {
}

requestCert := func() (*meshapi.NewMeshCertResponse, error) {
dial := dialer.NewWithKey(issuer, atls.NoValidator, &net.Dialer{}, privKey)
// Supply an empty list of validators, as the coordinator does not need to be
// validated by the initializer.
dial := dialer.NewWithKey(issuer, atls.NoValidators, &net.Dialer{}, privKey)
conn, err := dial.Dial(ctx, net.JoinHostPort(coordinatorHostname, meshapi.Port))
if err != nil {
return nil, fmt.Errorf("dialing: %w", err)
Expand Down
4 changes: 2 additions & 2 deletions internal/atls/atls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@ import (
const attestationTimeout = 30 * time.Second

var (
// NoValidator skips validation of the server's attestation document.
NoValidator Validator
// NoValidators skips validation of the server's attestation document.
NoValidators = []Validator{}
// NoIssuer skips embedding the client's attestation document.
NoIssuer Issuer

Expand Down
Loading