Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pr2 #189

Closed
wants to merge 3 commits into from
Closed

Pr2 #189

Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 38 additions & 2 deletions attestationreport/attestationreport.go
Original file line number Diff line number Diff line change
Expand Up @@ -671,11 +671,19 @@ func Verify(arRaw, nonce, casPem []byte, policies []byte, polEng PolicyEngineSel
result.Success = false
}

// Check that every AppManifest has a corresponding AppDescription
// Extract app description names
appDescriptions := make([]string, 0)
for _, a := range metadata.DeviceDescription.AppDescriptions {
appDescriptions = append(appDescriptions, a.AppManifest)
}
// Extract app manifest names
appManifestNames := make([]string, 0)
for _, a := range metadata.AppManifests {
appManifestNames = append(appManifestNames, a.Name)
}

// Check that every AppManifest has a corresponding AppDescription
log.Tracef("Iterating app manifests length %v", len(metadata.AppManifests))
for _, a := range metadata.AppManifests {
r := Result{
Success: true,
Expand All @@ -691,6 +699,27 @@ func Verify(arRaw, nonce, casPem []byte, policies []byte, polEng PolicyEngineSel
result.DevDescResult.CorrectApps = append(result.DevDescResult.CorrectApps, r)
}

// Check that every App Description has a corresponding App Manifest
log.Tracef("Iterating app descriptions length %v", len(metadata.DeviceDescription.AppDescriptions))
for _, desc := range metadata.DeviceDescription.AppDescriptions {
found := false
for _, manifest := range metadata.AppManifests {
if desc.AppManifest == manifest.Name {
found = true
}
}
if !found {
log.Tracef("No app manifest for app description: %v", desc.AppManifest)
r := Result{
Success: false,
Got: desc.AppManifest,
ExpectedOneOf: appManifestNames,
}
result.DevDescResult.CorrectApps = append(result.DevDescResult.CorrectApps, r)
result.Success = false
}
}

// Check that the Rtm Manifest is compatible with the OS Manifest
if contains(metadata.RtmManifest.Name, metadata.OsManifest.Rtms) {
result.DevDescResult.RtmOsCompatibility.Success = true
Expand Down Expand Up @@ -745,9 +774,16 @@ func Verify(arRaw, nonce, casPem []byte, policies []byte, polEng PolicyEngineSel

// Add additional information
result.Prover = metadata.DeviceDescription.Name
if result.Prover == "" {
result.Prover = "Unknown"
}
result.Created = time.Now().Format(time.RFC3339)

log.Tracef("Verification Result: %v", result.Success)
if result.Success {
log.Infof("SUCCESS: Verification for Prover %v (%v)", result.Prover, result.Created)
} else {
log.Infof("FAILED: Verification for Prover %v (%v)", result.Prover, result.Created)
}

return result
}
Expand Down
9 changes: 2 additions & 7 deletions example-setup/setup-full-ids
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,10 @@
set -euo pipefail

trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
source "${dir}/utils.sh"
export PATH=${PATH}:${HOME}/go/bin

function abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

if [[ "$#" -ne 3 ]]; then
echo "Usage: ./setup-full-ids <cmc-folder> <data-folder> <cbor|json>"
exit 1
Expand Down
9 changes: 2 additions & 7 deletions example-setup/setup-full-simple
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,10 @@
set -euo pipefail

trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
source "${dir}/utils.sh"
export PATH=${PATH}:${HOME}/go/bin

abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

if [[ "$#" -ne 3 ]]; then
echo "Usage: ./setup-full-simple <cmc-folder> <data-folder> <cbor|json>"
exit
Expand Down
21 changes: 9 additions & 12 deletions example-setup/sgx-setup-sample
Original file line number Diff line number Diff line change
Expand Up @@ -3,31 +3,28 @@
set -euo pipefail

trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
source "${dir}/utils.sh"
export PATH=${PATH}:${HOME}/go/bin

abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

if [[ "$#" -ne 3 ]]; then
echo "Usage: ./setup-full-simple <cmc-folder> <data-folder> <cbor|json>"
if [[ "$#" -ne 5 ]]; then
echo "Usage: ./setup-full-simple <cmc-folder> <data-folder> <cbor|json> <mrenclave> <mrsigner>"
exit
fi


cmc="$(abs_path "${1}")"
data="$(abs_path "${2}")"
ser="${3}"
mrenclave="${4}"
mrsigner="${5}"

if [[ ! -d "$cmc" ]]; then
echo "cmc directory does not exist. Did you clone the repository? Abort.."
exit 1
fi

if [[ ! -d "${data}" ]]; then
if [[ ! -d "${data}" ]]; then
mkdir -p "${data}"
fi

Expand Down Expand Up @@ -80,7 +77,7 @@ decoded=$(printf '%b' "$(echo "$cert_chain" | sed 's/SGX-PCK-Certificate-Issuer-
root_ca=$(echo -e "$decoded" | sed -n '/-----END CERTIFICATE-----/,$p' | sed '1d')
ca_fingerprint=$(openssl x509 -in <(echo "$root_ca") -noout -sha256 -fingerprint | awk -F= '{print $2}' | tr -d ': ' | tr '[:upper:]' '[:lower:]')

# GET TCB Info
# GET TCB Info
tcb_info="$(curl -s -X GET "https://api.trustedservices.intel.com/sgx/certification/v4/tcb?fmspc=$fmspc" | jq -c .)"
echo "$tcb_info" > "${data}/metadata-raw/tcb_info.json"

Expand All @@ -98,7 +95,7 @@ jq --argjson tcb_info "$tcb_info" --argjson qe_identity "$qe_identity" --argjson
"sgx": {
"version": 3,
"collateral": {
"teeType": 0,
"teeType": 0,
"tcbInfo": $tcb_info,
"tcbInfoSize": $tcb_info_size,
"qeIdentity": $qe_identity,
Expand Down
21 changes: 2 additions & 19 deletions example-setup/update-app-manifest
Original file line number Diff line number Diff line change
Expand Up @@ -3,24 +3,10 @@
set -euo pipefail

trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
source "${dir}/utils.sh"
export PATH=${PATH}:${HOME}/go/bin

abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

extendarr() {
local key=$1
shift
local param=$1

# Add new value
json="$(echo "${json}" | jq ".${key} += [${param}]")"
}

if [[ "$#" -ne 2 ]]; then
echo "Usage: ./update-app-manifest <data-folder> <cbor|json>"
exit 1
Expand All @@ -39,9 +25,6 @@ fi

echo "Using ${data} as directory for local data"

# Load manifest
json=$(cat "${data}/metadata-raw/app.manifest.json")

# Calculate the IMA app reference values
referenceValues=$(sudo calculate-ima-pcr -t 10 -i ima-ng -p /usr/bin)

Expand Down
16 changes: 0 additions & 16 deletions example-setup/update-app-manifest-live
Original file line number Diff line number Diff line change
Expand Up @@ -5,22 +5,6 @@ set -euo pipefail
trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
export PATH=${PATH}:${HOME}/go/bin

abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

extendarr() {
local key=$1
shift
local param=$1

# Add new value
json="$(echo "${json}" | jq ".${key} += [${param}]")"
}

if [[ "$#" -ne 2 ]]; then
echo "Usage: ./update-app-manifest-live <data-folder> <cbor|json>"
exit 1
Expand Down
9 changes: 2 additions & 7 deletions example-setup/update-full-ids
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,10 @@
set -euo pipefail

trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
source "${dir}/utils.sh"
export PATH=${PATH}:${HOME}/go/bin

function abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

if [[ "$#" -ne 2 ]]; then
echo "Usage: ./update-full-ids <data-folder> <cbor|json>"
exit 1
Expand Down
10 changes: 2 additions & 8 deletions example-setup/update-full-simple
Original file line number Diff line number Diff line change
Expand Up @@ -3,16 +3,10 @@
set -euo pipefail

trap '[ $? -eq 0 ] && exit 0; printf "%s failed\n" "$0"' EXIT
dir="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)"
source "${dir}/utils.sh"
export PATH=${PATH}:${HOME}/go/bin

abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}


if [[ "$#" -ne 2 ]]; then
echo "Usage: ./update-full-simple <data-folder> <cbor|json>"
exit 1
Expand Down
17 changes: 17 additions & 0 deletions example-setup/utils.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
#!/bin/bash

abs_path() {
if [[ -d "$(dirname "$1")" ]]
then
echo "$(cd "$(dirname "$1")" && pwd)/$(basename "$1")" || true
fi
}

extendarr() {
local key=$1
shift
local param=$1

# Add new value
json="$(echo "${json}" | jq ".${key} += [${param}]")"
}
Loading