@@ -6,13 +6,17 @@ import (
66 "crypto"
77 "encoding/base64"
88 "encoding/binary"
9+ "errors"
910 "fmt"
1011 "strings"
1112 "time"
1213
1314 "github.com/golang-jwt/jwt/v4"
1415 "github.com/google/go-eventlog/proto/state"
1516 "github.com/google/go-eventlog/register"
17+ tabi "github.com/google/go-tdx-guest/abi"
18+ tdxpb "github.com/google/go-tdx-guest/proto/tdx"
19+ "github.com/google/go-tdx-guest/rtmr"
1620 "github.com/google/go-tpm-tools/proto/attest"
1721 "github.com/google/go-tpm-tools/proto/tpm"
1822 "github.com/google/go-tpm-tools/server"
@@ -53,12 +57,37 @@ func (fc *fakeClient) CreateChallenge(_ context.Context) (*verifier.Challenge, e
5357 }, nil
5458}
5559
56- // VerifyAttestation calls server.VerifyAttestation against the request's public key.
57- // It returns the marshaled MachineState as a claim.
58- func (fc * fakeClient ) VerifyAttestation (_ context.Context , req verifier.VerifyAttestationRequest ) (* verifier.VerifyAttestationResponse , error ) {
59- // Determine signing algorithm.
60- signingMethod := jwt .SigningMethodRS256
61- now := jwt .TimeFunc ()
60+ func verifyTDX (req verifier.VerifyAttestationRequest , nonce []byte ) (* attest.MachineState , error ) {
61+ tdQuote , err := tabi .QuoteToProto (req .TDCCELAttestation .TdQuote )
62+ if err != nil {
63+ return nil , fmt .Errorf ("failed to marshal TdQuote: %v" , err )
64+ }
65+ quoteV4 , ok := tdQuote .(* tdxpb.QuoteV4 )
66+ if ! ok {
67+ return nil , errors .New ("failed to convert TdQuote: not of type QuoteV4" )
68+ }
69+ rtmrbank , err := rtmr .GetRtmrsFromTdQuote (quoteV4 )
70+ if err != nil {
71+ return nil , err
72+ }
73+ cosState , err := server .ParseCosCELRTMR (req .TDCCELAttestation .CanonicalEventLog , * rtmrbank )
74+ if err != nil {
75+ return nil , fmt .Errorf ("failed to validate the Canonical event log: %w" , err )
76+ }
77+ opts := rtmr .TdxDefaultOpts (nonce )
78+ fls , err := rtmr .ParseCcelWithTdQuote (req .TDCCELAttestation .CcelData , req .TDCCELAttestation .CcelAcpiTable , quoteV4 , & opts )
79+ if err != nil {
80+ return nil , fmt .Errorf ("failed to parse CCEL: %w" , err )
81+ }
82+ ms , err := server .ConvertToMachineState (fls )
83+ if err != nil {
84+ return nil , fmt .Errorf ("failed to convert to MachineState: %w" , err )
85+ }
86+ ms .Cos = cosState
87+ return ms , nil
88+ }
89+
90+ func verifyTPM (req verifier.VerifyAttestationRequest , nonce []byte ) (* attest.MachineState , error ) {
6291 akPub , err := tpm2 .DecodePublic (req .Attestation .GetAkPub ())
6392 if err != nil {
6493 return nil , fmt .Errorf ("failed to decode AKPub as TPMT_PUBLIC: %v" , err )
@@ -67,7 +96,7 @@ func (fc *fakeClient) VerifyAttestation(_ context.Context, req verifier.VerifyAt
6796 if err != nil {
6897 return nil , fmt .Errorf ("failed to convert TPMT_PUBLIC to crypto.PublicKey: %v" , err )
6998 }
70- ms , err := server .VerifyAttestation (req .Attestation , server.VerifyOpts {Nonce : fc . nonce , TrustedAKs : []crypto.PublicKey {akCrypto }})
99+ ms , err := server .VerifyAttestation (req .Attestation , server.VerifyOpts {Nonce : nonce , TrustedAKs : []crypto.PublicKey {akCrypto }})
71100 if err != nil {
72101 return nil , fmt .Errorf ("failed to verify attestation: %v" , err )
73102 }
@@ -82,6 +111,31 @@ func (fc *fakeClient) VerifyAttestation(_ context.Context, req verifier.VerifyAt
82111 return nil , fmt .Errorf ("failed to validate the Canonical event log: %w" , err )
83112 }
84113 ms .Cos = cosState
114+ return ms , nil
115+ }
116+
117+ // VerifyAttestation calls server.VerifyAttestation against the request's public key.
118+ // It returns the marshaled MachineState as a claim.
119+ func (fc * fakeClient ) VerifyAttestation (_ context.Context , req verifier.VerifyAttestationRequest ) (* verifier.VerifyAttestationResponse , error ) {
120+ // Determine signing algorithm.
121+ signingMethod := jwt .SigningMethodRS256
122+ now := jwt .TimeFunc ()
123+ var ms * attest.MachineState
124+ var err error
125+
126+ if req .TDCCELAttestation != nil {
127+ ms , err = verifyTDX (req , fc .nonce )
128+ if err != nil {
129+ return nil , err
130+ }
131+ } else if req .Attestation != nil {
132+ ms , err = verifyTPM (req , fc .nonce )
133+ if err != nil {
134+ return nil , err
135+ }
136+ } else {
137+ return nil , errors .New ("contains no attestation in the request" )
138+ }
85139
86140 msJSON , err := protojson .Marshal (ms )
87141 if err != nil {
0 commit comments