[launcher] Support TDX RTMR based attestation in launcher #478

jkl73 · 2024-08-20T01:00:27Z

Allow a TDX machine to create a TD quote and request a hardware rooted attestation from the attestation verifier.

./launcher ci will now only run in linux. (because launcher now depends on *tg.LinuxConfigFsQuoteProvider which only presents in linux)

jkl73 · 2024-08-20T02:31:24Z

/gcbrun

jkl73 · 2024-08-20T02:38:14Z

/gcbrun

jkl73 · 2024-08-20T07:16:53Z

/gcbrun

jkl73 · 2024-10-08T00:40:42Z

/gcbrun

jkl73 · 2024-10-09T08:24:23Z

/gcbrun

jkl73 · 2024-10-09T18:52:41Z

/gcbrun

client/attest.go

jkl73 · 2024-10-09T21:04:08Z

/gcbrun

alexmwu

The verifier build is failing

alexmwu · 2024-10-09T22:38:37Z

client/attest.go

 // If an error is encountered in the process, return what has been constructed so far.
-func (k *Key) getCertificateChain(client *http.Client) ([][]byte, error) {


don't export this. put this in internal somewhere and take a key.

func getCertificateChain(cert *x509.Certificate, client *http.Client) ([][]byte, error)

moved to internal/cert.go

client/attest.go

alexmwu · 2024-10-09T22:45:24Z

go.mod

@@ -7,7 +7,7 @@ require (
 	github.com/google/go-attestation v0.5.1
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-configfs-tsm v0.3.3-0.20240910040719-1cc7e25d9272
-	github.com/google/go-sev-guest v0.11.1
+	github.com/google/go-sev-guest v0.11.2-0.20241009005433-de2ac900e958


why are we updating this?

#478 (comment)

launcher/agent/agent.go

yawangwang · 2024-10-10T16:45:02Z

launcher/cloudbuild.yaml

@@ -1,7 +1,7 @@
 substitutions:
  '_BASE_IMAGE': '' # an empty base image means the build will use the latest image in '_BASE_IMAGE_FAMILY'
-  '_BASE_IMAGE_FAMILY': 'cos-113-lts' # base image family
-  '_OUTPUT_IMAGE_PREFIX': 'confidential-space'
+  '_BASE_IMAGE_FAMILY': 'cos-tdx-113-lts' # base image family


nit: so I'm assuming cos-tdx-113-lts family will also work for SEV-based CS image?

yes, it's SEV_CAPABLE as well

jkl73 · 2024-10-10T17:44:56Z

/gcbrun

verifier/client.go

launcher/launcher/main.go

JoshuaKrstic · 2024-10-10T18:09:53Z

launcher/agent/agent.go

+type tpmAttestRoot struct {
+	tpmMu     sync.Mutex
+	fetchedAK *client.Key
+	tpm       io.ReadWriteCloser
+}
+
+func (t *tpmAttestRoot) Extend(c cel.Content, l *cel.CEL) error {
+	return l.AppendEventPCR(t.tpm, cel.CosEventPCR, defaultCELHashAlgo, c)
+}
+
+func (t *tpmAttestRoot) Attest(nonce []byte) (any, error) {
+	t.tpmMu.Lock()
+	defer t.tpmMu.Unlock()
+
+	return t.fetchedAK.Attest(client.AttestOpts{
+		Nonce:            nonce,
+		CertChainFetcher: http.DefaultClient,
+	})
+}
+
+type tdxAttestRoot struct {
+	tdxMu     sync.Mutex
+	qp        *tg.LinuxConfigFsQuoteProvider
+	tsmClient configfsi.Client
+}
+
+func (t *tdxAttestRoot) Extend(c cel.Content, l *cel.CEL) error {
+	return l.AppendEventRTMR(t.tsmClient, cel.CosRTMR, c)
+}
+
+func (t *tdxAttestRoot) Attest(nonce []byte) (any, error) {
+	t.tdxMu.Lock()
+	defer t.tdxMu.Unlock()
+
+	var tdxNonce [tlabi.TdReportDataSize]byte
+	copy(tdxNonce[:], nonce)
+
+	rawQuote, err := tg.GetRawQuote(t.qp, tdxNonce)
+	if err != nil {
+		return nil, err
+	}
+
+	ccelData, err := os.ReadFile("/sys/firmware/acpi/tables/data/CCEL")
+	if err != nil {
+		return nil, err
+	}
+	ccelTable, err := os.ReadFile("/sys/firmware/acpi/tables/CCEL")
+	if err != nil {
+		return nil, err
+	}
+
+	return &verifier.TDCCELAttestation{
+		CcelAcpiTable: ccelTable,
+		CcelData:      ccelData,
+		TdQuote:       rawQuote,
+	}, nil


Should these live in attest.go instead of here?

No. Really most of this should belong in go-tdx-guest, but it's okay to be here for now.

alexmwu · 2024-10-10T19:34:52Z

.github/workflows/ci.yml

-        if: (runner.os == 'Linux' || runner.os == 'macOS') && matrix.architecture == 'x64'
-      - name: Test all modules
-        run: go test -v ./... ./cmd/... ./launcher/... ./verifier/... -skip='TestCacheConcurrentSetGet|TestHwAttestationPass|TestHardwareAttestationPass'


Why do we need this change?

launcher now depends on LinuxConfigFsQuoteProvider (which is in tdxAttestRoot). Which can be only complied on Linux. So trying to compile launcher on mac will fail

alexmwu · 2024-10-10T20:26:00Z

launcher/agent/agent.go

+type tpmAttestRoot struct {
+	tpmMu     sync.Mutex
+	fetchedAK *client.Key
+	tpm       io.ReadWriteCloser
+}
+
+func (t *tpmAttestRoot) Extend(c cel.Content, l *cel.CEL) error {
+	return l.AppendEventPCR(t.tpm, cel.CosEventPCR, defaultCELHashAlgo, c)
+}
+
+func (t *tpmAttestRoot) Attest(nonce []byte) (any, error) {
+	t.tpmMu.Lock()
+	defer t.tpmMu.Unlock()
+
+	return t.fetchedAK.Attest(client.AttestOpts{
+		Nonce:            nonce,
+		CertChainFetcher: http.DefaultClient,
+	})
+}
+
+type tdxAttestRoot struct {
+	tdxMu     sync.Mutex
+	qp        *tg.LinuxConfigFsQuoteProvider
+	tsmClient configfsi.Client
+}
+
+func (t *tdxAttestRoot) Extend(c cel.Content, l *cel.CEL) error {
+	return l.AppendEventRTMR(t.tsmClient, cel.CosRTMR, c)
+}
+
+func (t *tdxAttestRoot) Attest(nonce []byte) (any, error) {
+	t.tdxMu.Lock()
+	defer t.tdxMu.Unlock()
+
+	var tdxNonce [tlabi.TdReportDataSize]byte
+	copy(tdxNonce[:], nonce)
+
+	rawQuote, err := tg.GetRawQuote(t.qp, tdxNonce)
+	if err != nil {
+		return nil, err
+	}
+
+	ccelData, err := os.ReadFile("/sys/firmware/acpi/tables/data/CCEL")
+	if err != nil {
+		return nil, err
+	}
+	ccelTable, err := os.ReadFile("/sys/firmware/acpi/tables/CCEL")
+	if err != nil {
+		return nil, err
+	}
+
+	return &verifier.TDCCELAttestation{
+		CcelAcpiTable: ccelTable,
+		CcelData:      ccelData,
+		TdQuote:       rawQuote,
+	}, nil


No. Really most of this should belong in go-tdx-guest, but it's okay to be here for now.

alexmwu · 2024-10-10T20:27:16Z

launcher/agent/agent.go

+	ccelData, err := os.ReadFile("/sys/firmware/acpi/tables/data/CCEL")
+	if err != nil {
+		return nil, err
+	}
+	ccelTable, err := os.ReadFile("/sys/firmware/acpi/tables/CCEL")


I am surprised there's no utilities for this in go-tdx-guest. There should be.

noted google/go-tdx-guest#53

alexmwu · 2024-10-10T20:27:54Z

launcher/cloudbuild.yaml

@@ -21,7 +21,7 @@ steps:
    if [ -z ${base_image} ]
    then
      echo "getting the latest COS image"
-      base_image=$(gcloud compute images describe-from-family ${BASE_IMAGE_FAMILY} --project cos-cloud | grep name | cut -d ' ' -f 2)
+      base_image=$(gcloud compute images describe-from-family ${BASE_IMAGE_FAMILY} --project confidential-vm-images | grep name | cut -d ' ' -f 2)


Why are we changing the project?

COS TDX_capable images are not released in regular cos-cloud project

verifier/client.go

verifier/rest/rest.go

Allow a TDX machine to create a TD quote and request a hardware rooted attestation from the attestation verifier. ./launcher ci will now only run in linux. Upgrade go-sev-guest. Signed-off-by: Jiankun Lu <jiankun@google.com>

jkl73 · 2024-10-10T23:30:12Z

/gcbrun

jkl73 changed the base branch from tdx_rtmr to main August 20, 2024 01:02

jkl73 force-pushed the tdxrmtr branch 4 times, most recently from c75591b to b9c1240 Compare August 20, 2024 02:30

jkl73 force-pushed the tdxrmtr branch from b9c1240 to 7b6dd54 Compare August 20, 2024 02:36

jkl73 force-pushed the tdxrmtr branch from 7b6dd54 to 54fd5a7 Compare August 20, 2024 07:15

qinkunbao mentioned this pull request Sep 25, 2024

Refactor CEL AppendEvent, to support RTMR #486

Merged

jkl73 force-pushed the tdxrmtr branch 2 times, most recently from a3066ba to cf3b63c Compare October 8, 2024 00:39

jkl73 force-pushed the tdxrmtr branch 3 times, most recently from 9df421f to 7244331 Compare October 9, 2024 08:22

jkl73 force-pushed the tdxrmtr branch 6 times, most recently from 6307fc9 to 952db42 Compare October 9, 2024 18:51

jkl73 changed the title ~~[launcher] support TDX RTMR measurements~~ [launcher] Support TDX RTMR based attestation in launcher Oct 9, 2024

jkl73 requested review from qinkunbao, alexmwu, yawangwang and JoshuaKrstic October 9, 2024 18:54

qinkunbao reviewed Oct 9, 2024

View reviewed changes

client/attest.go Outdated Show resolved Hide resolved

qinkunbao reviewed Oct 9, 2024

View reviewed changes

client/attest.go Outdated Show resolved Hide resolved

jkl73 force-pushed the tdxrmtr branch from 952db42 to e82de3b Compare October 9, 2024 20:57

jkl73 changed the base branch from main to tdx_rtmr October 9, 2024 21:03

jkl73 force-pushed the tdxrmtr branch from e82de3b to 1df86b6 Compare October 9, 2024 22:27

alexmwu requested changes Oct 9, 2024

View reviewed changes

yawangwang reviewed Oct 10, 2024

View reviewed changes

launcher/agent/agent.go Outdated Show resolved Hide resolved

launcher/agent/agent.go Outdated Show resolved Hide resolved

launcher/agent/agent.go Outdated Show resolved Hide resolved

jkl73 force-pushed the tdxrmtr branch from ebc1ffd to 9937bd0 Compare October 10, 2024 02:47

qinkunbao reviewed Oct 10, 2024

View reviewed changes

launcher/agent/agent.go Outdated Show resolved Hide resolved

jkl73 force-pushed the tdxrmtr branch from 9937bd0 to bbf4a0e Compare October 10, 2024 06:50

yawangwang approved these changes Oct 10, 2024

View reviewed changes

qinkunbao approved these changes Oct 10, 2024

View reviewed changes

jkl73 force-pushed the tdxrmtr branch from bbf4a0e to e3b337a Compare October 10, 2024 17:41

JoshuaKrstic reviewed Oct 10, 2024

View reviewed changes

verifier/client.go Outdated Show resolved Hide resolved

JoshuaKrstic reviewed Oct 10, 2024

View reviewed changes

launcher/launcher/main.go Outdated Show resolved Hide resolved

JoshuaKrstic reviewed Oct 10, 2024

View reviewed changes

alexmwu approved these changes Oct 10, 2024

View reviewed changes

google deleted a comment from jkl73 Oct 10, 2024

JoshuaKrstic approved these changes Oct 10, 2024

View reviewed changes

[launcher] Add TDX/RTMR attestation in launcher

7c61164

Allow a TDX machine to create a TD quote and request a hardware rooted attestation from the attestation verifier. ./launcher ci will now only run in linux. Upgrade go-sev-guest. Signed-off-by: Jiankun Lu <jiankun@google.com>

jkl73 force-pushed the tdxrmtr branch from e3b337a to 7c61164 Compare October 10, 2024 23:25

jkl73 merged commit c38b622 into google:tdx_rtmr Oct 11, 2024
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[launcher] Support TDX RTMR based attestation in launcher #478

[launcher] Support TDX RTMR based attestation in launcher #478

jkl73 commented Aug 20, 2024 •

edited

Loading

jkl73 commented Aug 20, 2024

jkl73 commented Aug 20, 2024

jkl73 commented Aug 20, 2024

jkl73 commented Oct 8, 2024

jkl73 commented Oct 9, 2024

jkl73 commented Oct 9, 2024

jkl73 commented Oct 9, 2024

alexmwu left a comment

alexmwu Oct 9, 2024

jkl73 Oct 10, 2024

alexmwu Oct 9, 2024

jkl73 Oct 10, 2024

yawangwang Oct 10, 2024

jkl73 Oct 10, 2024 •

edited

Loading

jkl73 commented Oct 10, 2024

JoshuaKrstic Oct 10, 2024

alexmwu Oct 10, 2024

alexmwu Oct 10, 2024

jkl73 Oct 10, 2024

alexmwu Oct 10, 2024

alexmwu Oct 10, 2024

jkl73 Oct 10, 2024 •

edited

Loading

alexmwu Oct 10, 2024

jkl73 Oct 10, 2024

jkl73 commented Oct 10, 2024

		// If an error is encountered in the process, return what has been constructed so far.
		func (k Key) getCertificateChain(client http.Client) ([][]byte, error) {

[launcher] Support TDX RTMR based attestation in launcher #478

[launcher] Support TDX RTMR based attestation in launcher #478

Conversation

jkl73 commented Aug 20, 2024 • edited Loading

jkl73 commented Aug 20, 2024

jkl73 commented Aug 20, 2024

jkl73 commented Aug 20, 2024

jkl73 commented Oct 8, 2024

jkl73 commented Oct 9, 2024

jkl73 commented Oct 9, 2024

jkl73 commented Oct 9, 2024

alexmwu left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkl73 Oct 10, 2024 • edited Loading

Choose a reason for hiding this comment

jkl73 commented Oct 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkl73 Oct 10, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jkl73 commented Oct 10, 2024

jkl73 commented Aug 20, 2024 •

edited

Loading

jkl73 Oct 10, 2024 •

edited

Loading

jkl73 Oct 10, 2024 •

edited

Loading