Skip to content

Commit 7bef29b

Browse files
thomas-fossatithomas-fossati
committed
wip
Signed-off-by: Thomas Fossati <[email protected]>
1 parent c46900d commit 7bef29b

File tree

4 files changed

+134
-85
lines changed

4 files changed

+134
-85
lines changed

‎vts/appraisal/appraisal.go‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2022-2023 Contributors to the Veraison project.
1+
// Copyright 2022-2026 Contributors to the Veraison project.
22
// SPDX-License-Identifier: Apache-2.0
33

44
package appraisal
@@ -12,6 +12,7 @@ import (
1212
"github.com/veraison/services/config"
1313
"github.com/veraison/services/policy"
1414
"github.com/veraison/services/proto"
15+
"google.golang.org/protobuf/types/known/structpb"
1516
)
1617

1718
// Appraisal provides an appraisal context internally within the VTS (e.g. for
@@ -22,6 +23,7 @@ type Appraisal struct {
2223
EvidenceContext *proto.EvidenceContext
2324
Result *ear.AttestationResult
2425
SignedEAR []byte
26+
Endorsements []string
2527
}
2628

2729
func New(tenantID string, nonce []byte, scheme string) *Appraisal {
@@ -33,31 +35,53 @@ func New(tenantID string, nonce []byte, scheme string) *Appraisal {
3335
Result: ear.NewAttestationResult(scheme, config.Version, config.Developer),
3436
}
3537

36-
encodedNonce := base64.URLEncoding.EncodeToString(nonce)
37-
appraisal.Result.Nonce = &encodedNonce
38-
39-
appraisal.Result.VerifierID.Build = &config.Version
40-
appraisal.Result.VerifierID.Developer = &config.Developer
38+
appraisal.setResultNonce(nonce)
4139

4240
appraisal.InitPolicyID()
4341

4442
return &appraisal
4543
}
4644

45+
func (o *Appraisal) setResultNonce(v []byte) {
46+
encodedNonce := base64.URLEncoding.EncodeToString(v)
47+
o.Result.Nonce = &encodedNonce
48+
}
49+
50+
func (o *Appraisal) SetTrustAnchorIDs(v []string) {
51+
o.EvidenceContext.TrustAnchorIds = v
52+
}
53+
54+
func (o *Appraisal) SetReferenceIDs(v []string) {
55+
o.EvidenceContext.ReferenceIds = v
56+
}
57+
58+
func (o *Appraisal) SetEvidenceClaims(v *structpb.Struct) {
59+
o.EvidenceContext.Evidence = v
60+
}
61+
62+
func (o *Appraisal) SetEndorsements(v []string) {
63+
o.Endorsements = v
64+
}
65+
66+
func (o *Appraisal) SetResultWithNonce(result *ear.AttestationResult, nonce []byte) {
67+
o.Result = result
68+
o.setResultNonce(nonce)
69+
}
70+
4771
func (o Appraisal) GetContext() *proto.AppraisalContext {
4872
return &proto.AppraisalContext{
4973
Evidence: o.EvidenceContext,
5074
Result: o.SignedEAR,
5175
}
5276
}
5377

54-
func (o Appraisal) SetAllClaims(claim ear.TrustClaim) {
78+
func (o *Appraisal) SetAllClaims(claim ear.TrustClaim) {
5579
for _, submod := range o.Result.Submods {
5680
submod.TrustVector.SetAll(claim)
5781
}
5882
}
5983

60-
func (o Appraisal) AddPolicyClaim(name, claim string) {
84+
func (o *Appraisal) AddPolicyClaim(name, claim string) {
6185
for _, submod := range o.Result.Submods {
6286
if submod.AppraisalExtensions.VeraisonPolicyClaims == nil {
6387
claimsMap := make(map[string]interface{})

‎vts/policymanager/policymanager.go‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2022-2024 Contributors to the Veraison project.
1+
// Copyright 2022-2026 Contributors to the Veraison project.
22
// SPDX-License-Identifier: Apache-2.0
33
package policymanager
44

@@ -32,13 +32,12 @@ func New(v *viper.Viper, store *policy.Store, logger *zap.SugaredLogger) (*Polic
3232
return pm, nil
3333
}
3434

35+
// XXX(tho) revisit coupling between appraisal and policy manager
3536
func (o *PolicyManager) Evaluate(
3637
ctx context.Context,
37-
scheme string,
3838
appraisal *appraisal.Appraisal,
39-
endorsements []string,
4039
) error {
41-
policyKey := o.getPolicyKey(appraisal)
40+
policyKey := o.getPolicyKey(appraisal.EvidenceContext.TenantId, appraisal.Scheme)
4241

4342
pol, err := o.getPolicy(policyKey)
4443
if err != nil {
@@ -58,12 +57,12 @@ func (o *PolicyManager) Evaluate(
5857
evaluated, err := o.Agent.Evaluate(
5958
ctx,
6059
appraisalContext,
61-
scheme,
60+
appraisal.Scheme,
6261
pol,
6362
submod,
6463
submodAppraisal,
6564
appraisal.EvidenceContext,
66-
endorsements,
65+
appraisal.Endorsements,
6766
)
6867
if err != nil {
6968
return err
@@ -77,10 +76,10 @@ func (o *PolicyManager) Evaluate(
7776
return nil
7877
}
7978

80-
func (o *PolicyManager) getPolicyKey(a *appraisal.Appraisal) policy.PolicyKey {
79+
func (o *PolicyManager) getPolicyKey(tenantID string, scheme string) policy.PolicyKey {
8180
return policy.PolicyKey{
82-
TenantId: a.EvidenceContext.TenantId,
83-
Scheme: a.Scheme,
81+
TenantId: tenantID,
82+
Scheme: scheme,
8483
Name: o.Agent.GetBackendName(),
8584
}
8685
}

‎vts/policymanager/policymanager_test.go‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2022-2023 Contributors to the Veraison project.
1+
// Copyright 2022-2026 Contributors to the Veraison project.
22
// SPDX-License-Identifier: Apache-2.0
33
package policymanager
44

@@ -48,7 +48,7 @@ func TestPolicyMgr_getPolicy_not_found(t *testing.T) {
4848
pm := &PolicyManager{Store: &policy.Store{KVStore: store, Logger: log.Named("test")},
4949
Agent: agent}
5050

51-
polKey := pm.getPolicyKey(appraisal)
51+
polKey := pm.getPolicyKey(appraisal.EvidenceContext.TenantId, appraisal.Scheme)
5252
assert.Equal(t, "0:TPM_ENACTTRUST:opa", polKey.String())
5353

5454
pol, err := pm.getPolicy(polKey)
@@ -82,7 +82,7 @@ func TestPolicyMgr_getPolicy_OK(t *testing.T) {
8282

8383
pm := &PolicyManager{Store: &policy.Store{KVStore: store}, Agent: agent}
8484

85-
polKey := pm.getPolicyKey(appraisal)
85+
polKey := pm.getPolicyKey(appraisal.EvidenceContext.TenantId, appraisal.Scheme)
8686
assert.Equal(t, "0:TPM_ENACTTRUST:opa", polKey.String())
8787

8888
_, err = pm.getPolicy(polKey)
@@ -129,6 +129,7 @@ func TestPolicyMgr_Evaluate_OK(t *testing.T) {
129129
endorsements := []string{"h0KPxSKAPTEGXnvOPPA/5HUJZjHl4Hu9eg/eYMTPJcc="}
130130
ar := ear.NewAttestationResult("test", "test", "test")
131131
ap := &appraisal.Appraisal{EvidenceContext: ec, Result: ar, Scheme: "TPM_ENACTTRUST"}
132+
ap.Endorsements = endorsements
132133

133134
polID := "policy:TPM_ENACTTRUST"
134135
tier := ear.TrustTierAffirming
@@ -140,7 +141,7 @@ func TestPolicyMgr_Evaluate_OK(t *testing.T) {
140141
Evaluate(
141142
context.TODO(),
142143
gomock.Any(),
143-
"test",
144+
"TPM_ENACTTRUST",
144145
gomock.Any(),
145146
gomock.Any(),
146147
ar.Submods["test"],
@@ -153,7 +154,7 @@ func TestPolicyMgr_Evaluate_OK(t *testing.T) {
153154
Agent: agent,
154155
logger: log.Named("manager"),
155156
}
156-
err := pm.Evaluate(context.TODO(), "test", ap, endorsements)
157+
err := pm.Evaluate(context.TODO(), ap)
157158
require.NoError(t, err)
158159
}
159160

@@ -174,17 +175,17 @@ func TestPolicyMgr_Evaluate_NOK(t *testing.T) {
174175
}
175176
endorsements := []string{"h0KPxSKAPTEGXnvOPPA/5HUJZjHl4Hu9eg/eYMTPJcc="}
176177
ar := ear.NewAttestationResult("test", "test", "test")
177-
ap := &appraisal.Appraisal{EvidenceContext: ec, Result: ar, Scheme: "TPM_ENACTTRUST"}
178+
ap := &appraisal.Appraisal{EvidenceContext: ec, Result: ar, Scheme: "TPM_ENACTTRUST", Endorsements: endorsements}
178179
expectedErr := errors.New("could not evaluate policy: policy returned bad update")
179180
agent := mock_deps.NewMockIAgent(ctrl)
180181
agent.EXPECT().GetBackendName().Return("opa")
181-
agent.EXPECT().Evaluate(context.TODO(), gomock.Any(), "test", gomock.Any(), gomock.Any(), ar.Submods["test"], ec, endorsements).Return(nil, expectedErr)
182+
agent.EXPECT().Evaluate(context.TODO(), gomock.Any(), "TPM_ENACTTRUST", gomock.Any(), gomock.Any(), ar.Submods["test"], ec, endorsements).Return(nil, expectedErr)
182183
pm := &PolicyManager{
183184
Store: &policy.Store{KVStore: store, Logger: log.Named("store")},
184185
Agent: agent,
185186
logger: log.Named("manager"),
186187
}
187-
err := pm.Evaluate(context.TODO(), "test", ap, endorsements)
188+
err := pm.Evaluate(context.TODO(), ap)
188189
assert.ErrorIs(t, err, expectedErr)
189190

190191
}

0 commit comments

Comments
 (0)