AAEL eventlog replay support for az-snp-vtpm

attestation-service/docs/tcb_claims.md

@@ -167,9 +167,10 @@ The following fields report the TD's current TCB level, as opposed to the level
 ## Azure SEV-SNP Confidential VM (az-snp-vtpm)
 
 - `["az-snp-vtpm"].*`: claims inherit the fields from the [SEV-SNP](#amd-sev-snp) layout.
-- `["az-tdx-vtpm"].tpm`: Object. TPM PCR values.
-  - `["az-tdx-vtpm"].tpm.pcr{01,..,n}`: String (hex). SHA256 PCR registers for the TEE's vTPM quote.
-  - `["az-tdx-vtpm"].tpm.init_data`: **Optional**. String (hex). The register used as initdata digest (PCR 8).
+- `["az-snp-vtpm"].tpm`: Object. TPM PCR values.
+  - `["az-snp-vtpm"].tpm.pcr{01,..,n}`: String (hex). SHA256 PCR registers for the TEE's vTPM quote.
+  - `["az-snp-vtpm"].tpm.init_data`: **Optional**. String (hex). The register used as initdata digest (PCR 8).
+- `["az-snp-vtpm"].uefi_event_logs`: **Optional**. Parsed per-event AAEL (Attestation Agent Eventlog) entries, present when the guest recorded runtime measurements (e.g. container image pulls). Replayed and matched against the PCR register each event actually targeted before being surfaced.
 
 Note: The TD Report and TD Quote are fetched during early boot in this TEE. Kernel, Initrd and rootfs are measured into the vTPM's registers.
 

deps/eventlog/src/lib.rs

@@ -81,6 +81,11 @@
     pub index: u32,
     pub algorithm: TcgAlgorithm,
     pub reference: Vec<u8>,
+    /// Value to seed the replay accumulator with, instead of an all-zero
+    /// buffer. Some measurement registers (e.g. a vTPM DRTM PCR) reset to a
+    /// non-zero value before any event extends them. Leave empty to fall
+    /// back to an all-zero seed of the algorithm's digest size.
+    pub initial_value: Vec<u8>,
 }
 
 impl EventDetails {
@@ -123,7 +128,8 @@
         let digest_map = collect_digests_by_index(&self.log);
 
         for item in data.iter() {
-            let calculated_ccel_ccmr = replay(&digest_map, item.index, item.algorithm)?;
+            let calculated_ccel_ccmr =
+                replay(&digest_map, item.index, item.algorithm, &item.initial_value)?;
             if calculated_ccel_ccmr != item.reference {
                 bail!(
                     "Eventlog does not pass measurement replay CC Event Log Measurement Register [index = {}]. Calculated value: {}, Given value: {}",
@@ -154,9 +160,24 @@
     digest_map: &HashMap<u32, Vec<ElDigest>>,
     index: u32,
     alg: TcgAlgorithm,
+    initial_value: &[u8],
 ) -> Result<Vec<u8>> {
     let digest_size = alg.get_digest_size(alg)?;
-    let mut materials = vec![0u8; digest_size];
+
+    if !initial_value.is_empty() && initial_value.len() != digest_size {
+        bail!(
+            "initial_value length {} does not match {:?} digest size {}",
+            initial_value.len(),
+            alg,
+            digest_size
+        );
+    }
+
+    let mut materials = if initial_value.is_empty() {
+        vec![0u8; digest_size]
+    } else {
+        initial_value.to_vec()
+    };
 
     if let Some(digests) = digest_map.get(&index) {
         for digest in digests.iter().filter(|d| d.alg == alg) {
@@ -455,21 +476,25 @@
                 index: 1,
                 algorithm: TcgAlgorithm::Sha384,
                 reference: hex::decode(rtmr0).unwrap(),
+                initial_value: vec![],
             },
             ReferenceMeasurement {
                 index: 2,
                 algorithm: TcgAlgorithm::Sha384,
                 reference: hex::decode(rtmr1).unwrap(),
+                initial_value: vec![],
             },
             ReferenceMeasurement {
                 index: 3,
                 algorithm: TcgAlgorithm::Sha384,
                 reference: hex::decode(rtmr2).unwrap(),
+                initial_value: vec![],
             },
             ReferenceMeasurement {
                 index: 4,
                 algorithm: TcgAlgorithm::Sha384,
                 reference: hex::decode(rtmr3).unwrap(),
+                initial_value: vec![],
             },
         ];
 
@@ -508,11 +533,13 @@
                 index: 1,
                 algorithm: TcgAlgorithm::Sha384,
                 reference: hex::decode(rtmr0).unwrap(),
+                initial_value: vec![],
             },
             ReferenceMeasurement {
                 index: 2,
                 algorithm: TcgAlgorithm::Sha384,
                 reference: hex::decode(rtmr1).unwrap(),
+                initial_value: vec![],
             },
         ];
 

deps/verifier/Cargo.toml

@@ -37,6 +37,7 @@ sgx-verifier = [
 ]
 az-snp-vtpm-verifier = [
     "az-snp-vtpm",
+    "eventlog",
     "serde_with",
     "sev",
     "snp-verifier",

deps/verifier/src/az_snp_vtpm/compat.rs

@@ -67,6 +67,9 @@ pub(super) struct EvidenceV2 {
     pub(super) hcl_report: Vec<u8>,
     #[serde_as(as = "Base64<UrlSafe>")]
     pub(super) vcek: Vec<u8>,
+    /// Base64 encoded runtime eventlog (AAEL in TCG2 encoding), populated by
+    /// the guest attester once it has recorded runtime measurement events.
+    pub(super) cc_eventlog: Option<String>,
 }
 
 /// Versioned evidence wrapper - tries V1 first, falls back to V0
@@ -143,4 +146,13 @@ impl Evidence {
             Evidence::V2(_) => 2,
         }
     }
+
+    /// Base64 encoded runtime eventlog (AAEL), if the attester recorded one.
+    /// Only present starting at evidence v2.
+    pub(super) fn cc_eventlog(&self) -> Option<&str> {
+        match self {
+            Evidence::V0(_) | Evidence::V1(_) => None,
+            Evidence::V2(v2) => v2.cc_eventlog.as_deref(),
+        }
+    }
 }