这是indexloc提供的服务，不要输入任何密码
Skip to content

Fix SevProduct defaults for downstring testclient #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 26, 2023
Merged

Fix SevProduct defaults for downstring testclient #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions testing/mocks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ import (
spb "github.com/google/go-sev-guest/proto/sevsnp"
"github.com/pkg/errors"
"golang.org/x/sys/unix"
"google.golang.org/protobuf/types/known/wrapperspb"
)

// GetReportResponse represents a mocked response to a command request.
Expand Down Expand Up @@ -144,10 +143,7 @@ func (d *Device) Ioctl(command uintptr, req any) (uintptr, error) {
// Product returns the mocked product info or the default.
func (d *Device) Product() *spb.SevProduct {
if d.SevProduct == nil {
return &spb.SevProduct{
Name: spb.SevProduct_SEV_PRODUCT_MILAN,
MachineStepping: &wrapperspb.UInt32Value{Value: 0},
}
return abi.DefaultSevProduct()
}
return d.SevProduct
}
Expand Down
17 changes: 13 additions & 4 deletions testing/test_cases.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ import (
"github.com/google/go-sev-guest/abi"
labi "github.com/google/go-sev-guest/client/linuxabi"
"github.com/google/go-sev-guest/kds"
spb "github.com/google/go-sev-guest/proto/sevsnp"
)

// userZeros defines a ReportData example that is all zeros
Expand Down Expand Up @@ -151,15 +152,22 @@ func CreateRawReport(opts *TestReportOptions) [labi.SnpReportRespReportSize]byte

// DeviceOptions specifies customizations for a fake sev-guest device.
type DeviceOptions struct {
Keys map[string][]byte
Now time.Time
Signer *AmdSigner
Keys map[string][]byte
Now time.Time
Signer *AmdSigner
Product *spb.SevProduct
}

func makeTestCerts(opts *DeviceOptions) ([]byte, *AmdSigner, error) {
signer := opts.Signer
var productString string
if opts.Product != nil {
productString = kds.ProductString(opts.Product)
} else {
productString = kds.DefaultProductString()
}
if signer == nil {
s, err := DefaultTestOnlyCertChain(kds.DefaultProductString(), opts.Now)
s, err := DefaultTestOnlyCertChain(productString, opts.Now)
if err != nil {
return nil, nil, err
}
Expand Down Expand Up @@ -250,5 +258,6 @@ func TcDevice(tcs []TestCase, opts *DeviceOptions) (*Device, error) {
Certs: certs,
Signer: signer,
Keys: opts.Keys,
SevProduct: opts.Product,
}, nil
}
20 changes: 13 additions & 7 deletions verify/verify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -687,17 +687,18 @@ func SnpAttestation(attestation *spb.Attestation, options *Options) error {
// certificate chain.
func fillInAttestation(attestation *spb.Attestation, options *Options) error {
var productOverridden bool
if options.Product != nil {
attestation.Product = options.Product
productOverridden = true
} else if attestation.Product == nil {
attestation.Product = abi.DefaultSevProduct()
if attestation.Product == nil {
if options.Product != nil {
attestation.Product = options.Product
} else {
attestation.Product = abi.DefaultSevProduct()
}
productOverridden = true
}
if options.DisableCertFetching {
return nil
}
product := kds.ProductString(options.Product)
product := kds.ProductString(attestation.Product)
getter := options.Getter
if getter == nil {
getter = trust.DefaultHTTPSGetter()
Expand Down Expand Up @@ -736,6 +737,8 @@ func fillInAttestation(attestation *spb.Attestation, options *Options) error {
}
}
chain.VcekCert = vcek
// An attempt was made with defaults or the option's product, so now use
// the VCEK cert to determine the real product info.
if productOverridden {
cert, err := x509.ParseCertificate(vcek)
if err != nil {
Expand All @@ -758,7 +761,10 @@ func fillInAttestation(attestation *spb.Attestation, options *Options) error {
return ErrMissingVlek
}
}
return nil

// Pass along the expected product information for VcekDER. fillInAttestation will ensure
// that this is a noop if options.Product began as non-nil.
return updateProductExpectation(&options.Product, attestation.Product)
}

// GetAttestationFromReport uses AMD's Key Distribution Service (KDS) to download the certificate
Expand Down