dcap.rs

pub mod certificate_chain;
pub mod mc_attest_verifier;
pub mod mc_attest_verifier_types;

/// Root anchor PEM file for use with DCAP
pub const DCAP_ROOT_ANCHOR: &str = include_str!("../../data/DcapRootCACert.pem");

use mc_attestation_verifier::*;
use mc_sgx_dcap_types::{Collateral, Quote3};

use self::{
    mc_attest_verifier::dcap::{DcapVerifier, DcapVerifierOutput},
    mc_attest_verifier_types::verification::EnclaveReportDataContents,
};

pub fn verify(
    quote: Quote3<Vec<u8>>,
    collateral: Collateral,
    identities: &[TrustedIdentity],
) -> VerificationOutput<DcapVerifierOutput> {
    let report_data_contents = EnclaveReportDataContents::new([0x42u8; 16].into(), [0xAAu8; 32]);
    let evidence = Evidence::new(quote, collateral).expect("Failed to get evidence");
    let verifier = DcapVerifier::new(identities, None, report_data_contents);
    verifier.verify(&evidence)
}

#[cfg(test)]
mod tests {
    use hex::FromHex;
    use hex_literal::hex;
    use mc_attestation_verifier::{Evidence, EvidenceVerifier, TrustedMrEnclaveIdentity, Verifier};
    use mc_sgx_core_types::MrEnclave;
    use mc_sgx_dcap_sys_types::sgx_ql_qve_collateral_t;
    use mc_sgx_dcap_types::{Collateral, Quote3};

    use crate::intel_sgx::dcap::certificate_chain::TlsCertificateChainVerifier;

    const TCB_INFO_JSON: &str = include_str!("../../data/fmspc_00906ED50000_2023_07_12.json");
    const QE_IDENTITY_JSON: &str = include_str!("../../data/qe_identity.json");

    fn collateral(tcb_info: &str, qe_identity: &str) -> Collateral {
        let mut sgx_collateral = sgx_ql_qve_collateral_t::default();

        // SAFETY: Version is a union which is inherently unsafe
        #[allow(unsafe_code)]
        let version = unsafe { sgx_collateral.__bindgen_anon_1.__bindgen_anon_1.as_mut() };
        version.major_version = 3;
        version.minor_version = 1;

        let pck_issuer_cert = include_str!("../../data/processor_ca.pem");
        let root_cert = include_str!("../../data/root_ca.pem");
        let mut pck_crl_chain = [pck_issuer_cert, root_cert].join("\n").as_bytes().to_vec();
        pck_crl_chain.push(0);
        sgx_collateral.pck_crl_issuer_chain = pck_crl_chain.as_ptr() as _;
        sgx_collateral.pck_crl_issuer_chain_size = pck_crl_chain.len() as u32;

        let mut root_crl = include_bytes!("../../data/root_crl.der").to_vec();
        root_crl.push(0);
        sgx_collateral.root_ca_crl = root_crl.as_ptr() as _;
        sgx_collateral.root_ca_crl_size = root_crl.len() as u32;

        let mut pck_crl = include_bytes!("../../data/processor_crl.der").to_vec();
        pck_crl.push(0);
        sgx_collateral.pck_crl = pck_crl.as_ptr() as _;
        sgx_collateral.pck_crl_size = pck_crl.len() as u32;

        let tcb_cert = include_str!("../../data/tcb_signer.pem");
        let mut tcb_chain = [tcb_cert, root_cert].join("\n").as_bytes().to_vec();
        tcb_chain.push(0);
        sgx_collateral.tcb_info_issuer_chain = tcb_chain.as_ptr() as _;
        sgx_collateral.tcb_info_issuer_chain_size = tcb_chain.len() as u32;

        sgx_collateral.tcb_info = tcb_info.as_ptr() as _;
        sgx_collateral.tcb_info_size = tcb_info.len() as u32;

        // For live data the QE identity uses the same chain as the TCB info
        sgx_collateral.qe_identity_issuer_chain = tcb_chain.as_ptr() as _;
        sgx_collateral.qe_identity_issuer_chain_size = tcb_chain.len() as u32;

        sgx_collateral.qe_identity = qe_identity.as_ptr() as _;
        sgx_collateral.qe_identity_size = qe_identity.len() as u32;

        Collateral::try_from(&sgx_collateral).expect("Failed to parse collateral")
    }

    #[test]
    #[ignore]
    fn evidence_verifier_succeeds_with_tls_x509_verifier() {
        let root_ca = include_str!("../../data/root_ca.pem");
        let certificate_verifier = TlsCertificateChainVerifier::new(root_ca);
        let identities = [TrustedMrEnclaveIdentity::new(
            MrEnclave::from_hex("840d61b0585dc8b4dc90f53af293c760fda06bee75978a6a86263ffb296423f4")
                .expect("malformed MRENCLAVE hex"),
            [""; 0],
            ["INTEL-SA-00334", "INTEL-SA-00615"],
        )
        .into()];
        let verifier = EvidenceVerifier::new(certificate_verifier, identities.as_ref(), None);
        let quote_bytes = include_bytes!("../../data/hw_quote.dat");
        let quote = Quote3::try_from(quote_bytes.as_ref()).expect("Failed to parse quote");
        let collateral = collateral(TCB_INFO_JSON, QE_IDENTITY_JSON);
        let evidence: Evidence<Vec<u8>> = Evidence::new(quote, collateral)
            .expect("Failed to create evidence")
            .into();

        let verification = verifier.verify(&evidence);

        assert_eq!(verification.is_success().unwrap_u8(), 1);
        // let displayable = VerificationTreeDisplay::new(&verifier, verification);
        // println!("\n{displayable}");
    }

    #[test]
    fn test_quote_parse() {
        let quote_bytes = hex!(
            "03000200000000000a000f00939a7233f79c4ca9940a0db3957f0607ce4\
        8836fd48a951172fe155220a719bd00000000141402070180010000000000000000000000000000000000000000\
        00000000000000000000000000000000000000000005000000000000000700000000000000dc43f8c42d8e5f52c\
        8bbd68f426242153f0be10630ff8cca255129a3ca03d27300000000000000000000000000000000000000000000\
        000000000000000000001cf2e52911410fbf3f199056a98d58795a559a2e800933f7fcd13d048462271c0000000\
        0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\
        0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\
        0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\
        00000000000000000000000000000000000000009113b0be77ed5d0d68680ec77206b8d587ed40679b71321ccdd\
        5405e4d54a682000000000000000000000000000000000000000000000000000000000000000044100000552c9b\
        321744cf259b8c239213413ca4226ea8a705ad6eabb505bb4f3a8850f1ed9f2ff3d9e17ba8be8cc69a0d911575a\
        813392202bddaa7b971d406704989e0be6177e039634cfbca4739ac246fda7df8c312a98f30f57b63f3c8921fce\
        51d90a93031f97f769637be9b028e7b007a4e458d4fa717befbd81b069050825801314140207018001000000000\
        0000000000000000000000000000000000000000000000000000000000000000000000000150000000000000007\
        0000000000000096b347a64e5a045e27369c26e6dcda51fd7c850e9b3a3a79e718f43261dee1e40000000000000\
        0000000000000000000000000000000000000000000000000008c4f5775d796503e96137f77c68a829a0056ac8d\
        ed70140b081b094490c57bff0000000000000000000000000000000000000000000000000000000000000000000\
        0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\
        000000000000000000000000000000000001000a000000000000000000000000000000000000000000000000000\
        00000000000000000000000000000000000000000000000000000000000000000000000b0f056c5355f6c770413\
        938c2a41ed1b5c34ecb35f85fa539f16cca7a30d6da900000000000000000000000000000000000000000000000\
        00000000000000000010a4d552582e428f8fd138cbb5f8af51050776f2c487996147d4ebfb5c817ba733905f30a\
        f7b4f340eaf0fdf2bb64dcb045d56f1609a1b042e6f5aeed09175c2000000102030405060708090a0b0c0d0e0f1\
        01112131415161718191a1b1c1d1e1f0500dc0d00002d2d2d2d2d424547494e2043455254494649434154452d2d\
        2d2d2d0a4d4949456a544343424453674177494241674956414a5172493559365a78484836785034424941715a4\
        e6b326e4c7a594d416f4743437147534d343942414d430a4d484578497a416842674e5642414d4d476b6c756447\
        567349464e48574342515130736755484a765932567a6332397949454e424d526f77474159445651514b0a44424\
        64a626e526c6243424462334a7762334a6864476c76626a45554d424947413155454277774c5532467564474567\
        51327868636d4578437a414a42674e560a4241674d416b4e424d517377435159445651514745774a56557a41654\
        67730794d7a45784d5441784e7a45334d4452614677307a4d4445784d5441784e7a45330a4d4452614d48417849\
        6a416742674e5642414d4d47556c756447567349464e4857434251513073675132567964476c6d61574e6864475\
        578476a415942674e560a42416f4d45556c756447567349454e76636e4276636d4630615739754d525177456759\
        4456515148444174545957353059534244624746795954454c4d416b470a413155454341774351304578437a414\
        a42674e5642415954416c56544d466b77457759484b6f5a497a6a3043415159494b6f5a497a6a30444151634451\
        6741450a77625468574d583134443163657835317875614958456771517a69636e744b7a48454a32536f31336e3\
        84a427050314a67383673764263462f7070715a554e710a68524b4642667469584c6d4f536c614955784e6e5136\
        4f434171677767674b6b4d42384741315564497751594d426141464e446f71747031312f6b75535265590a50487\
        3555a644456386c6c4e4d477747413155644877526c4d474d77596142666f463247573268306448427a4f693876\
        595842704c6e527964584e305a57527a0a5a584a3261574e6c63793570626e526c6243356a62323076633264344\
        c324e6c636e52705a6d6c6a5958527062323476646a517663474e7259334a7350324e680a5058427962324e6c63\
        334e7663695a6c626d4e765a476c755a7a316b5a584977485159445652304f42425945464a57566e41395a63736\
        f3753356b6a2f647a4a0a594f3034534175644d41344741315564447745422f775145417749477744414d42674e\
        5648524d4241663845416a41414d4949423141594a4b6f5a496876684e0a4151304242494942785443434163457\
        74867594b4b6f5a496876684e41513042415151514d6d5867725757774c59554164456d6c766c36615344434341\
        5751470a43697147534962345451454e41514977676746554d42414743797147534962345451454e41514942416\
        745554d42414743797147534962345451454e415149430a416745554d42414743797147534962345451454e4151\
        4944416745434d42414743797147534962345451454e41514945416745454d42414743797147534962340a54514\
        54e41514946416745424d42454743797147534962345451454e41514947416749416744415142677371686b6947\
        2b4530424451454342774942414441510a42677371686b69472b453042445145434341494241444151426773716\
        86b69472b45304244514543435149424144415142677371686b69472b453042445145430a436749424144415142\
        677371686b69472b45304244514543437749424144415142677371686b69472b453042445145434441494241444\
        15142677371686b69470a2b45304244514543445149424144415142677371686b69472b45304244514543446749\
        424144415142677371686b69472b4530424451454344774942414441510a42677371686b69472b4530424451454\
        3454149424144415142677371686b69472b45304244514543455149424454416642677371686b69472b45304244\
        5145430a4567515146425143424147414141414141414141414141414144415142676f71686b69472b453042445\
        14544424149414144415542676f71686b69472b4530420a44514545424159416b473668414141774477594b4b6f\
        5a496876684e4151304242516f424144414b42676771686b6a4f5051514441674e4841444245416942560a6e584\
        667364277466a6945474230417162424e702b4b56734a477245744f4f49666e6f365450387031414967536c4430\
        574e39595261575968346534656835330a314637434537664964724f55414c5177757632735948513d0a2d2d2d2\
        d2d454e442043455254494649434154452d2d2d2d2d0a2d2d2d2d2d424547494e2043455254494649434154452d\
        2d2d2d2d0a4d4949436d444343416a36674177494241674956414e446f71747031312f6b7553526559504873555\
        a644456386c6c4e4d416f4743437147534d343942414d430a4d476778476a415942674e5642414d4d45556c7564\
        47567349464e48574342536232393049454e424d526f77474159445651514b4442464a626e526c624342440a623\
        34a7762334a6864476c76626a45554d424947413155454277774c553246756447456751327868636d4578437a41\
        4a42674e564241674d416b4e424d5173770a435159445651514745774a56557a4165467730784f4441314d6a457\
        84d4455774d5442614677307a4d7a41314d6a45784d4455774d5442614d484578497a41680a42674e5642414d4d\
        476b6c756447567349464e48574342515130736755484a765932567a6332397949454e424d526f7747415944565\
        1514b4442464a626e526c0a6243424462334a7762334a6864476c76626a45554d424947413155454277774c5532\
        46756447456751327868636d4578437a414a42674e564241674d416b4e420a4d517377435159445651514745774\
        a56557a425a4d424d4742797147534d34394167454743437147534d34394177454841304941424c39712b4e4d70\
        32494f670a74646c31626b2f75575a352b5447516d38614369387a373866732b664b435133642b75447a586e565\
        44154325a68444369667949754a77764e33774e427039690a484253534d4a4d4a72424f6a676273776762677748\
        7759445652306a42426777466f4155496d554d316c71644e496e7a6737535655723951477a6b6e427177770a556\
        759445652306642457377535442486f45576751345a426148523063484d364c79396a5a584a3061575a70593246\
        305a584d7564484a316333526c5a484e6c0a636e5a705932567a4c6d6c75644756734c6d4e766253394a626e526\
        c62464e4857464a76623352445153356b5a584977485159445652304f42425945464e446f0a71747031312f6b75\
        53526559504873555a644456386c6c4e4d41344741315564447745422f77514541774942426a415342674e56485\
        24d4241663845434441470a4151482f416745414d416f4743437147534d343942414d43413067414d4555434951\
        434a6754627456714f795a316d336a716941584d365159613672357357530a34792f4737793875494a477864774\
        9675271507642534b7a7a516167424c517135733541373070646f6961524a387a2f3075447a344e675639316b3d\
        0a2d2d2d2d2d454e442043455254494649434154452d2d2d2d2d0a2d2d2d2d2d424547494e20434552544946494\
        34154452d2d2d2d2d0a4d4949436a7a4343416a53674177494241674955496d554d316c71644e496e7a67375356\
        55723951477a6b6e42717777436759494b6f5a497a6a3045417749770a614445614d42674741315545417777525\
        35735305a5777675530645949464a766233516751304578476a415942674e5642416f4d45556c75644756734945\
        4e760a636e4276636d4630615739754d52517745675944565151484441745459573530595342446247467959544\
        54c4d416b47413155454341774351304578437a414a0a42674e5642415954416c56544d423458445445344d4455\
        794d5445774e4455784d466f58445451354d54497a4d54497a4e546b314f566f77614445614d4267470a4131554\
        541777752535735305a5777675530645949464a766233516751304578476a415942674e5642416f4d45556c7564\
        47567349454e76636e4276636d46300a615739754d5251774567594456515148444174545957353059534244624\
        746795954454c4d416b47413155454341774351304578437a414a42674e56424159540a416c56544d466b774577\
        59484b6f5a497a6a3043415159494b6f5a497a6a3044415163445167414543366e45774d4449595a4f6a2f69505\
        773437a61454b69370a314f694f534c52466857476a626e42564a66566e6b59347533496a6b4459594c304d784f\
        346d717379596a6c42616c54565978465032734a424b357a6c4b4f420a757a43427544416642674e5648534d454\
        7444157674251695a517a575770303069664f44744a5653763141624f5363477244425342674e5648523845537a\
        424a0a4d45656752614244686b466f64485277637a6f764c324e6c636e52705a6d6c6a5958526c63793530636e5\
        67a6447566b63325679646d6c6a5a584d75615735300a5a577775593239744c306c756447567355306459556d39\
        7664454e424c6d526c636a416442674e564851344546675155496d554d316c71644e496e7a673753560a5572395\
        1477a6b6e4271777744675944565230504151482f42415144416745474d42494741315564457745422f7751494d\
        4159424166384341514577436759490a4b6f5a497a6a3045417749445351417752674968414f572f35516b522b5\
        33943695344634e6f6f774c7550524c735747662f59693747535839344267775477670a41694541344a306c7248\
        6f4d732b586f356f2f7358364f39515778485241765a55474f6452513763767152586171493d0a2d2d2d2d2d454\
        e442043455254494649434154452d2d2d2d2d0a00"
        );
        let _quote: Quote3<Vec<u8>> =
            Quote3::try_from(quote_bytes.to_vec()).expect("Failed to parse quote");
    }
}