Use TDX quote provider to attest and verify. #405

vbalain · 2023-12-22T11:18:18Z

go-tpm-tools uses go-tdx-guest's device driver to attest and verify quotes but with the recently upstreamed Unified ABI patch from Intel fetches attestation quotes via ConfigFS subsystem. go-tdx-guest has incorporated this change and now fetches quote via go-configfs-tsm library instead of device driver's IOCTLs. Added TDX quote provider in attest module which would be used instead of TDX device driver, and updated unit tests.

client/attest.go

go.mod

vbalain · 2023-12-22T11:21:55Z

server/verify_tdx.go

@@ -19,7 +18,7 @@ func TdxDefaultOptions() *VerifyTdxOpts {
 }

 // VerifyTdxAttestation checks that the TDX attestation quote is valid
-func VerifyTdxAttestation(attestation *tpb.QuoteV4, opts *VerifyTdxOpts) error {
+func VerifyTdxAttestation(attestation any, opts *VerifyTdxOpts) error {


Making API future compatible with other quote formats.

This (any) can be confused for people to call this function, could you add more description of "attestation" and potentially how to generate an "attestation"

Added description.

jkl73 · 2023-12-26T19:41:16Z

/gcbrun

jkl73 · 2023-12-26T19:56:47Z

cmd/attest_test.go

Seems like TestHardwareAttestationPass is failing in CI, probably just need to update the wanterr

Yes. Command go test ./... didn't run tests in go-tpm-tools/cmd directory. Updated expected errors in attest_test.go and verify_test.go in cmd. It should fix CI errors.

jkl73 · 2023-12-27T06:45:30Z

/gcbrun

@KeithMoyer

New Features: [launcher] Add TEE server IPC implementation google#367 [launcher] Enable memory monitoring in CS google#391 Use TDX quote provider to attest and verify google#405 Integrate nonce verification as part of the TDX quote validation procedure. google#395 Add RISC V support google#407 [launcher] Use resizable integrity-fs with in-memory tags google#412 Bug Fixes: [launcher] Fix launcher exit code google#384 [launcher] Handle exit code checking during deferral evaluation google#392 [cmd] Skip tests that call setGCEAKTemplate google#402 [launcher] Fix teeserver context reset issue & add container signature cache google#397 Set all unused parameters as _ to fix CI lint failure google#411 [launcher] Make customtoken test sleep to mitigate clock skew google#413 Other Changes: Add eventlog parse logics for memory monitoring google#404 [launcher]: Add memory monitor measurement logics google#408 Update go-tdx-guest version to v0.3.1 google#414 New Contributors: @KeithMoyer in google#392 @vbalain in google#405 @aimixsaka in google#407

@KeithMoyer

New Features: [launcher] Add TEE server IPC implementation #367 [launcher] Enable memory monitoring in CS #391 Use TDX quote provider to attest and verify #405 Integrate nonce verification as part of the TDX quote validation procedure. #395 Add RISC V support #407 [launcher] Use resizable integrity-fs with in-memory tags #412 Bug Fixes: [launcher] Fix launcher exit code #384 [launcher] Handle exit code checking during deferral evaluation #392 [cmd] Skip tests that call setGCEAKTemplate #402 [launcher] Fix teeserver context reset issue & add container signature cache #397 Set all unused parameters as _ to fix CI lint failure #411 [launcher] Make customtoken test sleep to mitigate clock skew #413 Other Changes: Add eventlog parse logics for memory monitoring #404 [launcher]: Add memory monitor measurement logics #408 Update go-tdx-guest version to v0.3.1 #414 New Contributors: @KeithMoyer in #392 @vbalain in #405 @aimixsaka in #407

@KeithMoyer

New Features: [launcher] Add TEE server IPC implementation google#367 [launcher] Enable memory monitoring in CS google#391 Use TDX quote provider to attest and verify google#405 Integrate nonce verification as part of the TDX quote validation procedure. google#395 Add RISC V support google#407 [launcher] Use resizable integrity-fs with in-memory tags google#412 Bug Fixes: [launcher] Fix launcher exit code google#384 [launcher] Handle exit code checking during deferral evaluation google#392 [cmd] Skip tests that call setGCEAKTemplate google#402 [launcher] Fix teeserver context reset issue & add container signature cache google#397 Set all unused parameters as _ to fix CI lint failure google#411 [launcher] Make customtoken test sleep to mitigate clock skew google#413 Other Changes: Add eventlog parse logics for memory monitoring google#404 [launcher]: Add memory monitor measurement logics google#408 Update go-tdx-guest version to v0.3.1 google#414 New Contributors: @KeithMoyer in google#392 @vbalain in google#405 @aimixsaka in google#407

Use TDX quote provider to perform attestation.

3b7c3cf