Skip to content

Commit d5408a5

Browse files
bluelebluele
authored
Merge pull request #22 from datachainlab/audit-202503
Audit 202503 Signed-off-by: Jun Kimura <jun.kimura@datachain.jp>
2 parents a0f3800 + 309d1e4 commit d5408a5

File tree

26 files changed

+6016
-149
lines changed

26 files changed

+6016
-149
lines changed

‎crates/collaterals/src/certs.rs‎

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@ use crate::{
44
};
55
use anyhow::bail;
66
use dcap_types::cert::{
7-
SgxExtensions, SGX_PCK_CERT_CN, SGX_PCK_PLATFORM_CA_CN, SGX_PCK_PROCESSOR_CA_CN,
7+
SgxExtensions, INTEL_SGX_COUNTRY_NAME, INTEL_SGX_LOCALITY_NAME, INTEL_SGX_ORGANIZATION_NAME,
8+
INTEL_SGX_PCK_CERT_COMMON_NAME, INTEL_SGX_PCK_PLATFORM_CA_COMMON_NAME,
9+
INTEL_SGX_PCK_PROCESSOR_CA_COMMON_NAME, INTEL_SGX_STATE_OR_PROVINCE_NAME,
810
};
911
use openssl::{
1012
asn1::{Asn1Integer, Asn1Object, Asn1OctetString, Asn1Time},
@@ -202,20 +204,20 @@ pub enum PckCa {
202204
impl PckCa {
203205
/// Create a PckCa from the CN of the certificate
204206
pub fn from_cn(cn: &str) -> Result<Self, anyhow::Error> {
205-
if cn == SGX_PCK_PROCESSOR_CA_CN {
207+
if cn == INTEL_SGX_PCK_PROCESSOR_CA_COMMON_NAME {
206208
Ok(PckCa::Processor)
207-
} else if cn == SGX_PCK_PLATFORM_CA_CN {
209+
} else if cn == INTEL_SGX_PCK_PLATFORM_CA_COMMON_NAME {
208210
Ok(PckCa::Platform)
209211
} else {
210-
bail!("Invalid PCK CA CN: {}", cn)
212+
bail!("Invalid PCK CA CN: {}", cn);
211213
}
212214
}
213215

214216
/// Get the CN of the PckCa
215217
pub fn cn(&self) -> &'static str {
216218
match self {
217-
PckCa::Processor => SGX_PCK_PROCESSOR_CA_CN,
218-
PckCa::Platform => SGX_PCK_PLATFORM_CA_CN,
219+
PckCa::Processor => INTEL_SGX_PCK_PROCESSOR_CA_COMMON_NAME,
220+
PckCa::Platform => INTEL_SGX_PCK_PLATFORM_CA_COMMON_NAME,
219221
}
220222
}
221223

@@ -255,11 +257,11 @@ pub fn gen_pck_cert_ca(
255257
builder.append_extension(
256258
KeyUsage::new()
257259
.critical()
258-
.digital_signature()
259-
.non_repudiation()
260+
.key_cert_sign()
261+
.crl_sign()
260262
.build()?,
261263
)?;
262-
builder.append_extension(BasicConstraints::new().critical().build()?)?;
264+
builder.append_extension(BasicConstraints::new().critical().ca().pathlen(0).build()?)?;
263265

264266
let ctx = builder.x509v3_context(Some(root_cert), None);
265267
builder.append_extension(
@@ -298,7 +300,7 @@ pub fn gen_pck_cert(
298300
Asn1Integer::from_bn(BigNum::from_slice(calc_skid(pck_cert_pkey).as_slice())?.as_ref())?
299301
.as_ref(),
300302
)?;
301-
builder.set_subject_name(build_x509_name(SGX_PCK_CERT_CN)?.as_ref())?;
303+
builder.set_subject_name(build_x509_name(INTEL_SGX_PCK_CERT_COMMON_NAME)?.as_ref())?;
302304
builder.set_pubkey(pck_cert_pkey)?;
303305

304306
builder.set_not_before(&validity.not_before())?;
@@ -460,13 +462,29 @@ impl Validity {
460462
}
461463
}
462464

463-
fn build_x509_name(cn: &str) -> Result<X509Name, ErrorStack> {
465+
pub fn build_x509_name(cn: &str) -> Result<X509Name, ErrorStack> {
466+
let mut builder = X509Name::builder()?;
467+
builder.append_entry_by_text("CN", cn)?;
468+
builder.append_entry_by_text("O", INTEL_SGX_ORGANIZATION_NAME)?;
469+
builder.append_entry_by_text("L", INTEL_SGX_LOCALITY_NAME)?;
470+
builder.append_entry_by_text("ST", INTEL_SGX_STATE_OR_PROVINCE_NAME)?;
471+
builder.append_entry_by_text("C", INTEL_SGX_COUNTRY_NAME)?;
472+
Ok(builder.build())
473+
}
474+
475+
pub fn build_x509_name_with_values(
476+
cn: &str,
477+
o: &str,
478+
l: &str,
479+
st: &str,
480+
c: &str,
481+
) -> Result<X509Name, ErrorStack> {
464482
let mut builder = X509Name::builder()?;
465483
builder.append_entry_by_text("CN", cn)?;
466-
builder.append_entry_by_text("O", "Intel Corporation")?;
467-
builder.append_entry_by_text("L", "Santa Clara")?;
468-
builder.append_entry_by_text("ST", "CA")?;
469-
builder.append_entry_by_text("C", "US")?;
484+
builder.append_entry_by_text("O", o)?;
485+
builder.append_entry_by_text("L", l)?;
486+
builder.append_entry_by_text("ST", st)?;
487+
builder.append_entry_by_text("C", c)?;
470488
Ok(builder.build())
471489
}
472490

@@ -477,7 +495,7 @@ fn calc_skid(pubkey: &PKeyRef<Private>) -> Vec<u8> {
477495
}
478496

479497
#[allow(deprecated)]
480-
fn gen_skid(pubkey: &PKeyRef<Private>) -> X509Extension {
498+
pub fn gen_skid(pubkey: &PKeyRef<Private>) -> X509Extension {
481499
let skid = calc_skid(pubkey);
482500
X509Extension::new(
483501
None,

‎crates/collaterals/src/tcb_info.rs‎

Lines changed: 175 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
use dcap_types::tcb_info::{
22
TcbComponent, TcbInfoV3, TcbInfoV3Inner, TcbInfoV3TcbLevel, TcbInfoV3TcbLevelItem, TdxModule,
3-
TdxModuleIdentities,
3+
TdxModuleIdentities, TdxModuleIdentitiesTcbLevel, TdxModuleIdentitiesTcbLevelItem,
44
};
55
use openssl::pkey::{PKeyRef, Private};
66

@@ -264,3 +264,177 @@ pub fn gen_tcb_components(svns: &[u8; 16]) -> [TcbComponent; 16] {
264264
.try_into()
265265
.unwrap()
266266
}
267+
268+
pub struct TdxModuleBuilder {
269+
pub obj: TdxModule,
270+
}
271+
272+
impl TdxModuleBuilder {
273+
pub fn new() -> Self {
274+
Self {
275+
obj: TdxModule {
276+
mrsigner: hex::encode([0; 48]),
277+
attributes: hex::encode([0; 8]),
278+
attributes_mask: hex::encode([0; 8]),
279+
},
280+
}
281+
}
282+
283+
pub fn mrsigner(self, mrsigner: [u8; 48]) -> Self {
284+
Self {
285+
obj: TdxModule {
286+
mrsigner: hex::encode(mrsigner),
287+
..self.obj
288+
},
289+
}
290+
}
291+
292+
pub fn attributes(self, attributes: [u8; 8]) -> Self {
293+
Self {
294+
obj: TdxModule {
295+
attributes: hex::encode(attributes),
296+
..self.obj
297+
},
298+
}
299+
}
300+
301+
pub fn attributes_mask(self, attributes_mask: [u8; 8]) -> Self {
302+
Self {
303+
obj: TdxModule {
304+
attributes_mask: hex::encode(attributes_mask),
305+
..self.obj
306+
},
307+
}
308+
}
309+
310+
pub fn build(self) -> TdxModule {
311+
self.obj
312+
}
313+
}
314+
315+
pub struct TdxModuleIdentitiesBuilder {
316+
pub obj: TdxModuleIdentities,
317+
}
318+
319+
impl TdxModuleIdentitiesBuilder {
320+
pub fn new() -> Self {
321+
Self {
322+
obj: TdxModuleIdentities {
323+
id: "TDX_01".to_string(),
324+
mrsigner: hex::encode([0; 48]),
325+
attributes: hex::encode([0; 8]),
326+
attributes_mask: hex::encode([0; 8]),
327+
tcb_levels: vec![],
328+
},
329+
}
330+
}
331+
332+
pub fn id(self, id: u8) -> Self {
333+
Self {
334+
obj: TdxModuleIdentities {
335+
id: format!("TDX_{:02X}", id),
336+
..self.obj
337+
},
338+
}
339+
}
340+
341+
pub fn mrsigner(self, mrsigner: [u8; 48]) -> Self {
342+
Self {
343+
obj: TdxModuleIdentities {
344+
mrsigner: hex::encode(mrsigner),
345+
..self.obj
346+
},
347+
}
348+
}
349+
350+
pub fn attributes(self, attributes: [u8; 8]) -> Self {
351+
Self {
352+
obj: TdxModuleIdentities {
353+
attributes: hex::encode(attributes),
354+
..self.obj
355+
},
356+
}
357+
}
358+
359+
pub fn attributes_mask(self, attributes_mask: [u8; 8]) -> Self {
360+
Self {
361+
obj: TdxModuleIdentities {
362+
attributes_mask: hex::encode(attributes_mask),
363+
..self.obj
364+
},
365+
}
366+
}
367+
368+
pub fn tcb_levels(self, tcb_levels: Vec<TdxModuleIdentitiesTcbLevelItem>) -> Self {
369+
Self {
370+
obj: TdxModuleIdentities {
371+
tcb_levels,
372+
..self.obj
373+
},
374+
}
375+
}
376+
377+
pub fn build(self) -> TdxModuleIdentities {
378+
self.obj
379+
}
380+
}
381+
382+
pub struct TdxModuleIdentitiesTcbLevelItemBuilder {
383+
pub obj: TdxModuleIdentitiesTcbLevelItem,
384+
}
385+
386+
impl TdxModuleIdentitiesTcbLevelItemBuilder {
387+
pub fn new() -> Self {
388+
Self {
389+
obj: TdxModuleIdentitiesTcbLevelItem {
390+
tcb: TdxModuleIdentitiesTcbLevel::default(),
391+
tcb_date: chrono::Utc::now().to_rfc3339(),
392+
tcb_status: "UpToDate".to_string(),
393+
advisory_ids: None,
394+
},
395+
}
396+
}
397+
398+
pub fn tcb(self, tcb: TdxModuleIdentitiesTcbLevel) -> Self {
399+
Self {
400+
obj: TdxModuleIdentitiesTcbLevelItem { tcb, ..self.obj },
401+
}
402+
}
403+
404+
pub fn tcb_date(self, tcb_date: i64) -> Self {
405+
Self {
406+
obj: TdxModuleIdentitiesTcbLevelItem {
407+
tcb_date: chrono::DateTime::from_timestamp(tcb_date, 0)
408+
.unwrap()
409+
.to_rfc3339(),
410+
..self.obj
411+
},
412+
}
413+
}
414+
415+
pub fn tcb_status(self, tcb_status: &str) -> Self {
416+
Self {
417+
obj: TdxModuleIdentitiesTcbLevelItem {
418+
tcb_status: tcb_status.to_string(),
419+
..self.obj
420+
},
421+
}
422+
}
423+
424+
pub fn advisory_ids(self, advisory_ids: &[&str]) -> Self {
425+
Self {
426+
obj: TdxModuleIdentitiesTcbLevelItem {
427+
advisory_ids: if advisory_ids.is_empty() {
428+
None
429+
} else {
430+
Some(advisory_ids.iter().map(|s| s.to_string()).collect())
431+
},
432+
..self.obj
433+
},
434+
}
435+
}
436+
437+
pub fn build(self) -> TdxModuleIdentitiesTcbLevelItem {
438+
self.obj
439+
}
440+
}

‎crates/pcs/src/client.rs‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
use anyhow::{anyhow, bail, Error};
2-
use dcap_quote_verifier::cert::{get_x509_subject_cn, parse_certchain};
2+
use dcap_quote_verifier::cert::{
3+
is_sgx_pck_platform_ca_dn, is_sgx_pck_processor_ca_dn, parse_certchain,
4+
};
35
use dcap_quote_verifier::collateral::QvCollateral;
46
use dcap_quote_verifier::sgx_extensions::extract_sgx_extensions;
57
use dcap_types::quotes::CertData;
@@ -97,17 +99,14 @@ impl PCSClient {
9799
let qe_identity_json =
98100
http_get(format!("{base_url}/qe/identity?update={update_policy}"))?.text()?;
99101

100-
let pck_crl_url = match get_x509_subject_cn(pck_cert_issuer).as_str() {
101-
"Intel SGX PCK Platform CA" => {
102-
format!("{pcs_url}/sgx/certification/v4/pckcrl?ca=platform&encoding=der")
103-
}
104-
"Intel SGX PCK Processor CA" => {
105-
format!("{pcs_url}/sgx/certification/v4/pckcrl?ca=processor&encoding=der")
106-
}
107-
cn => {
108-
bail!("unknown PCK issuer: {}", cn);
109-
}
102+
let pck_crl_url = if is_sgx_pck_platform_ca_dn(pck_cert_issuer.subject())? {
103+
format!("{pcs_url}/sgx/certification/v4/pckcrl?ca=platform&encoding=der")
104+
} else if is_sgx_pck_processor_ca_dn(pck_cert_issuer.subject())? {
105+
format!("{pcs_url}/sgx/certification/v4/pckcrl?ca=processor&encoding=der")
106+
} else {
107+
bail!("unknown PCK issuer");
110108
};
109+
111110
let sgx_pck_crl_der = http_get(pck_crl_url)?.bytes()?.to_vec();
112111

113112
let sgx_root_cert_der = http_get(format!(

‎crates/quote-verifier/data/qv_collateral.bin‎

12.1 KB
Binary file not shown.

0 commit comments

Comments
 (0)