Skip to content

Commit 2c070b7

Browse files
thomas-fossatithomas-fossati
committed
wip
Signed-off-by: Thomas Fossati <[email protected]>
1 parent 0007733 commit 2c070b7

File tree

12 files changed

+271
-25
lines changed

12 files changed

+271
-25
lines changed

‎api/api.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,17 @@ import "mime"
88
// parameters) and returns it in normalized form, i.e., with lowercase type,
99
// subtype and, optionally, parameter name. An error is returned if the
1010
// supplied media type is invalid.
11-
func NormalizeMediaType(mt string) (string, error) {
11+
// If dropParams is true, any parameters in the supplied media type are
12+
// discarded in the returned normalized media type.
13+
func NormalizeMediaType(mt string, dropParams bool) (string, error) {
1214
m, p, err := mime.ParseMediaType(mt)
1315
if err != nil {
1416
return "", err
1517
}
1618

19+
if dropParams {
20+
p = nil
21+
}
22+
1723
return mime.FormatMediaType(m, p), nil
1824
}

‎capability/well-known.go‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,13 @@ const (
1111
)
1212

1313
type WellKnownInfo struct {
14-
PublicKey jwk.Key `json:"ear-verification-key,omitempty"`
15-
MediaTypes []string `json:"media-types,omitempty"`
16-
Schemes []string `json:"attestation-schemes,omitempty"`
17-
Version string `json:"version"`
18-
ServiceState string `json:"service-state"`
19-
ApiEndpoints map[string]string `json:"api-endpoints"`
14+
PublicKey jwk.Key `json:"ear-verification-key,omitempty"`
15+
MediaTypes []string `json:"media-types,omitempty"`
16+
CompositeEvidenceMediaTypes []string `json:"composite-evidence-media-types,omitempty"`
17+
Schemes []string `json:"attestation-schemes,omitempty"`
18+
Version string `json:"version"`
19+
ServiceState string `json:"service-state"`
20+
ApiEndpoints map[string]string `json:"api-endpoints"`
2021
}
2122

2223
var ssTrans = map[string]string{
@@ -38,19 +39,21 @@ func ServiceStateToAPI(ss string) string {
3839
func NewWellKnownInfoObj(
3940
key jwk.Key,
4041
mediaTypes []string,
42+
compositeEvidenceMediaTypes []string,
4143
schemes []string,
4244
version string,
4345
serviceState string,
4446
endpoints map[string]string,
4547
) (*WellKnownInfo, error) {
4648
// MUST be kept in sync with proto/state.proto
4749
obj := &WellKnownInfo{
48-
PublicKey: key,
49-
MediaTypes: mediaTypes,
50-
Schemes: schemes,
51-
Version: version,
52-
ServiceState: ServiceStateToAPI(serviceState),
53-
ApiEndpoints: endpoints,
50+
PublicKey: key,
51+
MediaTypes: mediaTypes,
52+
CompositeEvidenceMediaTypes: compositeEvidenceMediaTypes,
53+
Schemes: schemes,
54+
Version: version,
55+
ServiceState: ServiceStateToAPI(serviceState),
56+
ApiEndpoints: endpoints,
5457
}
5558

5659
return obj, nil

‎management/api/handler.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,7 @@ func (o Handler) GetManagementWellKnownInfo(c *gin.Context) {
256256
obj, err := capability.NewWellKnownInfoObj(
257257
nil, // key
258258
nil, // media types
259+
nil, // composite evidence media types
259260
o.Manager.SupportedSchemes,
260261
config.Version,
261262
"SERVICE_STATUS_READY",

‎provisioning/api/handler.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ func (o *Handler) GetWellKnownProvisioningInfo(c *gin.Context) {
207207
endpoints := getProvisioningEndpoints()
208208

209209
// Get final object with well known information
210-
obj, err := capability.NewWellKnownInfoObj(nil, mediaTypes, nil, version, state, endpoints)
210+
obj, err := capability.NewWellKnownInfoObj(nil, mediaTypes, nil, nil, version, state, endpoints)
211211
if err != nil {
212212
ReportProblem(c,
213213
http.StatusInternalServerError,

‎provisioning/provisioner/provisioner.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ func New(vtsClient vtsclient.IVTSClient) IProvisioner {
2727
}
2828

2929
func (p *Provisioner) IsSupportedMediaType(mt string) (bool, error) {
30-
normalizedMediaType, err := api.NormalizeMediaType(mt)
30+
dropParams := false
31+
normalizedMediaType, err := api.NormalizeMediaType(mt, dropParams)
3132
if err != nil {
3233
return false, fmt.Errorf("%w: validation failed for %s (%v)", ErrInputParam, mt, err)
3334
}

‎verification/api/handler.go‎

Lines changed: 70 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,7 @@ func (o *Handler) SubmitEvidence(c *gin.Context) {
357357
}
358358
}
359359

360-
isSupported, err := o.Verifier.IsSupportedMediaType(mediaType)
360+
isSupportedMediaType, err := o.Verifier.IsSupportedMediaType(mediaType)
361361
if err != nil {
362362
status := http.StatusInternalServerError
363363
if errors.Unwrap(err) == verifier.ErrInputParam {
@@ -368,6 +368,19 @@ func (o *Handler) SubmitEvidence(c *gin.Context) {
368368
return
369369
}
370370

371+
isSupportedCompositeEvidenceMediaType, err := o.Verifier.IsSupportedCompositeEvidenceMediaType(mediaType)
372+
if err != nil {
373+
status := http.StatusInternalServerError
374+
if errors.Unwrap(err) == verifier.ErrInputParam {
375+
status = http.StatusBadRequest
376+
}
377+
378+
ReportProblem(c, status, fmt.Sprintf("could not check composite evidence media type with verifier: %v", err))
379+
return
380+
}
381+
382+
isSupported := isSupportedMediaType || isSupportedCompositeEvidenceMediaType
383+
371384
if !isSupported {
372385
supportedMediaTypes, err := o.Verifier.SupportedMediaTypes()
373386
if err != nil {
@@ -379,6 +392,18 @@ func (o *Handler) SubmitEvidence(c *gin.Context) {
379392
return
380393
}
381394

395+
supportedCompositeEvidenceMediaTypes, err := o.Verifier.SupportedCompositeEvidenceMediaTypes()
396+
if err != nil {
397+
ReportProblem(c,
398+
http.StatusInternalServerError,
399+
fmt.Sprintf("could not get supported composite evidence media types from verifier: %v",
400+
err),
401+
)
402+
return
403+
}
404+
405+
supportedMediaTypes = append(supportedMediaTypes, supportedCompositeEvidenceMediaTypes...)
406+
382407
c.Header("Accept", strings.Join(supportedMediaTypes, ", "))
383408
ReportProblem(c,
384409
http.StatusUnsupportedMediaType,
@@ -411,8 +436,16 @@ func (o *Handler) SubmitEvidence(c *gin.Context) {
411436
// reported if something in the verifier or the connection goes wrong.
412437
// Any problems with the evidence are expected to be reported via the
413438
// attestation result.
414-
attestationResult, err := o.Verifier.ProcessEvidence(tenantID, session.Nonce,
415-
evidence, mediaType)
439+
var attestationResult []byte
440+
441+
if isSupportedMediaType {
442+
attestationResult, err = o.Verifier.ProcessEvidence(tenantID, session.Nonce,
443+
evidence, mediaType)
444+
} else if isSupportedCompositeEvidenceMediaType {
445+
attestationResult, err = o.Verifier.ProcessCompositeEvidence(tenantID, session.Nonce,
446+
evidence, mediaType)
447+
}
448+
416449
if err != nil {
417450
o.logger.Error(err)
418451
session.SetStatus(StatusFailed)
@@ -474,11 +507,27 @@ func (o *Handler) NewChallengeResponse(c *gin.Context) {
474507
if err != nil {
475508
ReportProblem(c,
476509
http.StatusInternalServerError,
477-
fmt.Sprintf("could not get media types form verifier: %v", err),
510+
fmt.Sprintf("could not get media types from verifier: %v", err),
478511
)
479512
return
480513
}
481514

515+
// In lead-verifier mode, we need to get the supported collection media types
516+
// from the verifier as well, to be able to create sessions that can accept
517+
// composite evidence.
518+
supportedCollectionMediaTypes, err := o.Verifier.SupportedCompositeEvidenceMediaTypes()
519+
if err != nil {
520+
ReportProblem(c,
521+
http.StatusInternalServerError,
522+
fmt.Sprintf("could not get collection media types from verifier: %v", err),
523+
)
524+
return
525+
}
526+
527+
// Note that if the node is not a lead-verifier, the supported collection
528+
// media types list is empty, which makes the following a no-op.
529+
supportedMediaTypes = append(supportedMediaTypes, supportedCollectionMediaTypes...)
530+
482531
id, session, err := newSession(nonce, supportedMediaTypes, ConfigSessionTTL)
483532
if err != nil {
484533
ReportProblem(c,
@@ -529,15 +578,20 @@ func (o *Handler) getVerificationMediaTypes() ([]string, error) {
529578
return o.Verifier.SupportedMediaTypes()
530579
}
531580

581+
func (o *Handler) getSupportedCompositeEvidenceMediaTypes() ([]string, error) {
582+
return o.Verifier.SupportedCompositeEvidenceMediaTypes()
583+
}
584+
532585
func (o *Handler) getVerificationServerVersionAndState() (string, string, error) {
533586
vtsState, err := o.Verifier.GetVTSState()
534587
if err != nil {
535588
return "", "", err
536589
}
590+
537591
version := vtsState.ServerVersion
538592
state := vtsState.Status.String()
539-
return version, state, nil
540593

594+
return version, state, nil
541595
}
542596

543597
func getVerificationEndpoints() map[string]string {
@@ -574,6 +628,16 @@ func (o *Handler) GetWellKnownVerificationInfo(c *gin.Context) {
574628
return
575629
}
576630

631+
// Get verification composite evidence media types
632+
compositeEvidenceMediaTypes, err := o.getSupportedCompositeEvidenceMediaTypes()
633+
if err != nil {
634+
ReportProblem(c,
635+
http.StatusInternalServerError,
636+
err.Error(),
637+
)
638+
return
639+
}
640+
577641
// Get verification server version and state
578642
version, state, err := o.getVerificationServerVersionAndState()
579643
if err != nil {
@@ -588,7 +652,7 @@ func (o *Handler) GetWellKnownVerificationInfo(c *gin.Context) {
588652
endpoints := getVerificationEndpoints()
589653

590654
// Get final object with well known information
591-
obj, err := capability.NewWellKnownInfoObj(key, mediaTypes, nil, version, state, endpoints)
655+
obj, err := capability.NewWellKnownInfoObj(key, mediaTypes, compositeEvidenceMediaTypes, nil, version, state, endpoints)
592656
if err != nil {
593657
ReportProblem(c,
594658
http.StatusInternalServerError,

‎verification/api/handler_test.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,9 @@ func TestHandler_NewChallengeResponse_NoNonceParameters(t *testing.T) {
222222
v.EXPECT().
223223
SupportedMediaTypes().
224224
Return(testSupportedMediaTypes, nil)
225+
v.EXPECT().
226+
SupportedCompositeEvidenceMediaTypes().
227+
Return([]string{}, nil)
225228

226229
h := NewHandler(sm, v)
227230

@@ -262,6 +265,9 @@ func TestHandler_NewChallengeResponse_NonceParameter(t *testing.T) {
262265
v.EXPECT().
263266
SupportedMediaTypes().
264267
Return(testSupportedMediaTypes, nil)
268+
v.EXPECT().
269+
SupportedCompositeEvidenceMediaTypes().
270+
Return([]string{}, nil)
265271

266272
h := NewHandler(sm, v)
267273

@@ -308,6 +314,9 @@ func TestHandler_NewChallengeResponse_NonceSizeParameter(t *testing.T) {
308314
v.EXPECT().
309315
SupportedMediaTypes().
310316
Return(testSupportedMediaTypes, nil)
317+
v.EXPECT().
318+
SupportedCompositeEvidenceMediaTypes().
319+
Return([]string{}, nil)
311320

312321
h := NewHandler(sm, v)
313322

@@ -364,6 +373,9 @@ func TestHandler_NewChallengeResponse_SetSessionFailure(t *testing.T) {
364373
v.EXPECT().
365374
SupportedMediaTypes().
366375
Return(testSupportedMediaTypes, nil)
376+
v.EXPECT().
377+
SupportedCompositeEvidenceMediaTypes().
378+
Return([]string{}, nil)
367379

368380
h := NewHandler(sm, v)
369381

@@ -445,6 +457,12 @@ func TestHandler_SubmitEvidence_unsupported_evidence_format(t *testing.T) {
445457
v.EXPECT().
446458
IsSupportedMediaType(testUnsupportedMediaType).
447459
Return(false, nil)
460+
v.EXPECT().
461+
SupportedCompositeEvidenceMediaTypes().
462+
Return([]string{}, nil)
463+
v.EXPECT().
464+
IsSupportedCompositeEvidenceMediaType(testUnsupportedMediaType).
465+
Return(false, nil)
448466

449467
h := NewHandler(sm, v)
450468

@@ -486,6 +504,9 @@ func TestHandler_SubmitEvidence_bad_session_id_url(t *testing.T) {
486504
v.EXPECT().
487505
IsSupportedMediaType(testSupportedMediaTypeA).
488506
Return(true, nil)
507+
v.EXPECT().
508+
IsSupportedCompositeEvidenceMediaType(testSupportedMediaTypeA).
509+
Return(false, nil)
489510

490511
h := NewHandler(sm, v)
491512

@@ -531,6 +552,9 @@ func TestHandler_SubmitEvidence_session_not_found(t *testing.T) {
531552
v.EXPECT().
532553
IsSupportedMediaType(testSupportedMediaTypeA).
533554
Return(true, nil)
555+
v.EXPECT().
556+
IsSupportedCompositeEvidenceMediaType(testSupportedMediaTypeA).
557+
Return(false, nil)
534558

535559
h := NewHandler(sm, v)
536560

@@ -612,6 +636,9 @@ func TestHandler_SubmitEvidence_process_evidence_failed(t *testing.T) {
612636
v.EXPECT().
613637
IsSupportedMediaType(testSupportedMediaTypeA).
614638
Return(true, nil)
639+
v.EXPECT().
640+
IsSupportedCompositeEvidenceMediaType(testSupportedMediaTypeA).
641+
Return(false, nil)
615642
v.EXPECT().
616643
ProcessEvidence(tenantID, testNonce, []byte(testJSONBody), testSupportedMediaTypeA).
617644
Return(nil, errors.New(vmErr))
@@ -655,6 +682,9 @@ func TestHandler_SubmitEvidence_process_ok_sync(t *testing.T) {
655682
v.EXPECT().
656683
IsSupportedMediaType(testSupportedMediaTypeA).
657684
Return(true, nil)
685+
v.EXPECT().
686+
IsSupportedCompositeEvidenceMediaType(testSupportedMediaTypeA).
687+
Return(false, nil)
658688
v.EXPECT().
659689
ProcessEvidence(tenantID, testNonce, []byte(testJSONBody), testSupportedMediaTypeA).
660690
Return([]byte(testResult), nil)
@@ -698,6 +728,9 @@ func TestHandler_SubmitEvidence_process_ok_async(t *testing.T) {
698728
v.EXPECT().
699729
IsSupportedMediaType(testSupportedMediaTypeA).
700730
Return(true, nil)
731+
v.EXPECT().
732+
IsSupportedCompositeEvidenceMediaType(testSupportedMediaTypeA).
733+
Return(false, nil)
701734
v.EXPECT().
702735
ProcessEvidence(tenantID, testNonce, []byte(testJSONBody), testSupportedMediaTypeA).
703736
Return(nil, nil)
@@ -948,6 +981,9 @@ func TestHandler_GetWellKnownVerificationInfo_ok(t *testing.T) {
948981
v.EXPECT().
949982
SupportedMediaTypes().
950983
Return(supportedMediaTypes, nil)
984+
v.EXPECT().
985+
SupportedCompositeEvidenceMediaTypes().
986+
Return([]string{}, nil)
951987
v.EXPECT().
952988
GetVTSState().
953989
Return(&testGoodServiceState, nil)
@@ -1058,6 +1094,9 @@ func TestHandler_GetWellKnownVerificationInfo_GetVTSState_fail(t *testing.T) {
10581094
v.EXPECT().
10591095
SupportedMediaTypes().
10601096
Return(supportedMediaTypes, nil)
1097+
v.EXPECT().
1098+
SupportedCompositeEvidenceMediaTypes().
1099+
Return([]string{}, nil)
10611100
v.EXPECT().
10621101
GetVTSState().
10631102
Return(nil, errors.New("blah"))
@@ -1141,6 +1180,9 @@ func TestHandler_SubmitEvidence_good_CMW(t *testing.T) {
11411180
v.EXPECT().
11421181
IsSupportedMediaType(testSupportedMediaTypeA).
11431182
Return(true, nil)
1183+
v.EXPECT().
1184+
IsSupportedCompositeEvidenceMediaType(testSupportedMediaTypeA).
1185+
Return(false, nil)
11441186
v.EXPECT().
11451187
ProcessEvidence(tenantID, testNonce, []byte(testJSONBody), testSupportedMediaTypeA).
11461188
Return([]byte(testResult), nil)

0 commit comments

Comments
 (0)