Skip to content

Commit 4e66fdd

Browse files
setrofimsetrofim
committed
handler: add GetRefValueIDs to IStoreHandler
Move reference value ID extraction from evidence into store handler. Prior to this, it was done inside evidence handler as part of claims extraction. This ensure that ID generation on both provisioning and verification paths is handled in the same place, and is symmetrical with trust anchor ID generation. This also means that ExtractClaims method is now responsible _only_ for claim extraction. ExtractedClaims structure is removed, and the method now returns the map[string]interface{} claims set (ExtractedClaims combined that with reference IDs). Signed-off-by: Sergei Trofimov <[email protected]>
1 parent 2e858b7 commit 4e66fdd

23 files changed

+287
-156
lines changed

‎handler/evidence_rpc.go

+12-6
Original file line numberDiff line numberDiff line change
@@ -163,12 +163,15 @@ func (s *RPCClient) GetSupportedMediaTypes() []string {
163163
return resp
164164
}
165165

166-
func (s *RPCClient) ExtractEvidence(token *proto.AttestationToken, trustAnchors []string) (*ExtractedClaims, error) {
166+
func (s *RPCClient) ExtractEvidence(
167+
token *proto.AttestationToken,
168+
trustAnchors []string,
169+
) (map[string]interface{}, error) {
167170
var (
168171
err error
169172
args ExtractClaimsArgs
170173
resp []byte
171-
extracted ExtractedClaims
174+
extracted map[string]interface{}
172175
)
173176

174177
args.Token, err = json.Marshal(token)
@@ -188,7 +191,7 @@ func (s *RPCClient) ExtractEvidence(token *proto.AttestationToken, trustAnchors
188191
return nil, fmt.Errorf("unmarshaling extracted evidence: %w", err)
189192
}
190193

191-
return &extracted, nil
194+
return extracted, nil
192195
}
193196

194197
func (s *RPCClient) ValidateEvidenceIntegrity(
@@ -240,11 +243,14 @@ func (s *RPCClient) AppraiseEvidence(ec *proto.EvidenceContext, endorsements []s
240243
return &result, err
241244
}
242245

243-
func (s *RPCClient) ExtractClaims(token *proto.AttestationToken, trustAnchors []string) (*ExtractedClaims, error) {
246+
func (s *RPCClient) ExtractClaims(
247+
token *proto.AttestationToken,
248+
trustAnchors []string,
249+
) (map[string]interface{}, error) {
244250
var (
245251
err error
246252
args ExtractClaimsArgs
247-
extractedClaims ExtractedClaims
253+
extractedClaims map[string]interface{}
248254
)
249255

250256
args.Token, err = json.Marshal(token)
@@ -266,5 +272,5 @@ func (s *RPCClient) ExtractClaims(token *proto.AttestationToken, trustAnchors []
266272
return nil, fmt.Errorf("unmarshaling extracted claims: %w", err)
267273
}
268274

269-
return &extractedClaims, nil
275+
return extractedClaims, nil
270276
}

‎handler/ievidencehandler.go

+1-19
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ type IEvidenceHandler interface {
1919
ExtractClaims(
2020
token *proto.AttestationToken,
2121
trustAnchors []string,
22-
) (*ExtractedClaims, error)
22+
) (map[string]interface{}, error)
2323

2424
// ValidateEvidenceIntegrity verifies the structural integrity and validity of the
2525
// token. The exact checks performed are scheme-specific, but they
@@ -50,21 +50,3 @@ type IEvidenceHandler interface {
5050
endorsements []string,
5151
) (*ear.AttestationResult, error)
5252
}
53-
54-
// ExtractedClaims contains a map of claims extracted from an attestation
55-
// token along with the corresponding ReferenceIDs that are used to fetch
56-
// the associated endorsements.
57-
//
58-
// ReferenceID is the key used to fetch all the Endorsements
59-
// generated from claims extracted from the token
60-
type ExtractedClaims struct {
61-
ClaimsSet map[string]interface{} `json:"claims-set"`
62-
ReferenceIDs []string `json:"reference-ids"`
63-
// please refer issue #106 for unprocessed claim set
64-
}
65-
66-
func NewExtractedClaims() *ExtractedClaims {
67-
return &ExtractedClaims{
68-
ClaimsSet: make(map[string]interface{}),
69-
}
70-
}

‎handler/istorehandler.go

+10-1
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,20 @@ import (
1414
type IStoreHandler interface {
1515
plugin.IPluggable
1616

17-
// GetTrustAnchorIDs returns an array of trust anchor identifiers used
17+
// GetTrustAnchorIDs returns a slice of trust anchor identifiers used
1818
// to retrieve the trust anchors associated with this token. The trust anchors may be necessary to validate the
1919
// entire token and/or extract its claims (if it is encrypted).
2020
GetTrustAnchorIDs(token *proto.AttestationToken) ([]string, error)
2121

22+
// GetRefValueIDs returns a slice of identifiers used to retrieve
23+
// reference values for an attestation scheme, using the claims
24+
// extracted from attestation token and the associated trust anchors.
25+
GetRefValueIDs(
26+
tenantID string,
27+
trustAnchors []string,
28+
claims map[string]interface{},
29+
) ([]string, error)
30+
2231
// SynthKeysFromRefValue synthesizes lookup key(s) for the
2332
// provided reference value endorsement.
2433
SynthKeysFromRefValue(tenantID string, refVal *Endorsement) ([]string, error)

‎handler/store_rpc.go

+51
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,28 @@ func (s *StoreRPCServer) GetTrustAnchorIDs(data []byte, resp *[]string) error {
101101
return err
102102
}
103103

104+
type GetRefValueIDsArgs struct {
105+
TenantID string
106+
TrustAnchors []string
107+
Claims []byte
108+
}
109+
110+
func (s *StoreRPCServer) GetRefValueIDs(args GetRefValueIDsArgs, resp *[]string) error {
111+
var claims map[string]interface{}
112+
113+
err := json.Unmarshal(args.Claims, &claims)
114+
if err != nil {
115+
return fmt.Errorf("unmarshaling token: %w", err)
116+
}
117+
118+
*resp, err = s.Impl.GetRefValueIDs(args.TenantID, args.TrustAnchors, claims)
119+
if err != nil {
120+
return err
121+
}
122+
123+
return err
124+
}
125+
104126
/*
105127
RPC client
106128
(plugin caller side)
@@ -230,3 +252,32 @@ func (s *StoreRPCClient) GetTrustAnchorIDs(token *proto.AttestationToken) ([]str
230252

231253
return resp, nil
232254
}
255+
256+
func (s *StoreRPCClient) GetRefValueIDs(
257+
tenantID string,
258+
trustAnchors []string,
259+
claims map[string]interface{},
260+
) ([]string, error) {
261+
var (
262+
err error
263+
resp []string
264+
)
265+
266+
args := GetRefValueIDsArgs{
267+
TenantID: tenantID,
268+
TrustAnchors: trustAnchors,
269+
}
270+
271+
args.Claims, err = json.Marshal(claims)
272+
if err != nil {
273+
return nil, err
274+
}
275+
276+
err = s.client.Call("Plugin.GetRefValueIDs", args, &resp)
277+
if err != nil {
278+
err = ParseError(err)
279+
return nil, fmt.Errorf("Plugin.GetRefValueIDs RPC call failed: %w", err) // nolint
280+
}
281+
282+
return resp, nil
283+
}

‎scheme/cca-ssd-platform/evidence_handler.go

+3-10
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,14 @@ func (s EvidenceHandler) GetSupportedMediaTypes() []string {
3636
func (s EvidenceHandler) ExtractClaims(
3737
token *proto.AttestationToken,
3838
trustAnchors []string,
39-
) (*handler.ExtractedClaims, error) {
39+
) (map[string]interface{}, error) {
4040

4141
var ccaToken ccatoken.Evidence
4242

4343
if err := ccaToken.FromCBOR(token.Data); err != nil {
4444
return nil, handler.BadEvidence(err)
4545
}
4646

47-
var extracted handler.ExtractedClaims
4847

4948
platformClaimsSet, err := common.ClaimsToMap(ccaToken.PlatformClaims)
5049
if err != nil {
@@ -58,18 +57,12 @@ func (s EvidenceHandler) ExtractClaims(
5857
"could not convert realm claims: %w", err))
5958
}
6059

61-
extracted.ClaimsSet = map[string]interface{}{
60+
claims := map[string]interface{}{
6261
"platform": platformClaimsSet,
6362
"realm": realmClaimsSet,
6463
}
6564

66-
extracted.ReferenceIDs = []string{arm.RefValLookupKey(
67-
SchemeName,
68-
token.TenantId,
69-
arm.MustImplIDString(ccaToken.PlatformClaims),
70-
)}
71-
log.Debugf("extracted Reference ID Key = %s", extracted.ReferenceIDs)
72-
return &extracted, nil
65+
return claims, nil
7366
}
7467

7568
// ValidateEvidenceIntegrity, decodes CCA collection and then invokes Verify API of ccatoken library

‎scheme/cca-ssd-platform/evidence_handler_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ func Test_ExtractVerifiedClaims_ok(t *testing.T) {
110110
ta := string(taEndValBytes)
111111

112112
extracted, err := scheme.ExtractClaims(&token, []string{ta})
113-
platformClaims := extracted.ClaimsSet["platform"].(map[string]interface{})
113+
platformClaims := extracted["platform"].(map[string]interface{})
114114

115115
require.NoError(t, err)
116116
assert.Equal(t, "http://arm.com/CCA-SSD/1.0.0",

‎scheme/cca-ssd-platform/store_handler.go

+25
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,11 @@
44
package cca_ssd_platform
55

66
import (
7+
"fmt"
8+
79
"github.com/veraison/services/handler"
810
"github.com/veraison/services/proto"
11+
"github.com/veraison/services/scheme/common"
912
"github.com/veraison/services/scheme/common/arm"
1013
)
1114

@@ -43,3 +46,25 @@ func (s StoreHandler) GetTrustAnchorIDs(token *proto.AttestationToken) ([]string
4346
}
4447
return []string{ta}, nil
4548
}
49+
50+
func (s StoreHandler) GetRefValueIDs(
51+
tenantID string,
52+
trustAnchors []string,
53+
claims map[string]interface{},
54+
) ([]string, error) {
55+
platformClaimsMap, ok := claims["platform"].(map[string]interface{})
56+
if !ok {
57+
return nil, fmt.Errorf("claims to do not contain platform map: %v", claims)
58+
}
59+
60+
platformClaims, err := common.MapToClaims(platformClaimsMap)
61+
if err != nil {
62+
return nil, err
63+
}
64+
65+
return []string{arm.RefValLookupKey(
66+
SchemeName,
67+
tenantID,
68+
arm.MustImplIDString(platformClaims),
69+
)}, nil
70+
}

‎scheme/parsec-cca/evidence_handler.go

+5-11
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,11 @@ func (s EvidenceHandler) GetSupportedMediaTypes() []string {
3838
return EvidenceMediaTypes
3939
}
4040

41-
func (s EvidenceHandler) ExtractClaims(token *proto.AttestationToken, trustAnchors []string) (*handler.ExtractedClaims, error) {
41+
func (s EvidenceHandler) ExtractClaims(
42+
token *proto.AttestationToken,
43+
trustAnchors []string,
44+
) (map[string]interface{}, error) {
4245
var (
43-
extracted handler.ExtractedClaims
4446
evidence parsec_cca.Evidence
4547
claimsSet = make(map[string]interface{})
4648
kat = make(map[string]interface{})
@@ -70,15 +72,7 @@ func (s EvidenceHandler) ExtractClaims(token *proto.AttestationToken, trustAncho
7072
}
7173
claimsSet["cca.realm"] = rmap
7274

73-
extracted.ClaimsSet = claimsSet
74-
75-
extracted.ReferenceIDs = []string{arm.RefValLookupKey(
76-
SchemeName,
77-
token.TenantId,
78-
arm.MustImplIDString(evidence.Pat.PlatformClaims),
79-
)}
80-
log.Debugf("extracted Reference ID Key = %s", extracted.ReferenceIDs)
81-
return &extracted, nil
75+
return claimsSet, nil
8276
}
8377

8478
func (s EvidenceHandler) ValidateEvidenceIntegrity(token *proto.AttestationToken, trustAnchors []string, endorsements []string) error {

‎scheme/parsec-cca/store_handler.go

+25
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,11 @@
33
package parsec_cca
44

55
import (
6+
"fmt"
7+
68
"github.com/veraison/services/handler"
79
"github.com/veraison/services/proto"
10+
"github.com/veraison/services/scheme/common"
811
"github.com/veraison/services/scheme/common/arm"
912
)
1013

@@ -42,3 +45,25 @@ func (s StoreHandler) GetTrustAnchorIDs(token *proto.AttestationToken) ([]string
4245
}
4346
return []string{ta}, nil
4447
}
48+
49+
func (s StoreHandler) GetRefValueIDs(
50+
tenantID string,
51+
trustAnchors []string,
52+
claims map[string]interface{},
53+
) ([]string, error) {
54+
platformClaimsMap, ok := claims["cca.platform"].(map[string]interface{})
55+
if !ok {
56+
return nil, fmt.Errorf("claims to do not contain patform map: %v", claims)
57+
}
58+
59+
platformClaims, err := common.MapToClaims(platformClaimsMap)
60+
if err != nil {
61+
return nil, err
62+
}
63+
64+
return []string{arm.RefValLookupKey(
65+
SchemeName,
66+
tenantID,
67+
arm.MustImplIDString(platformClaims),
68+
)}, nil
69+
}

‎scheme/parsec-tpm/common.go

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// Copyright 2024 Contributors to the Veraison project.
2+
// SPDX-License-Identifier: Apache-2.0
3+
package parsec_tpm
4+
5+
const (
6+
ScopeTrustAnchor = "trust anchor"
7+
ScopeRefValues = "ref values"
8+
)
9+

0 commit comments

Comments
 (0)