Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

policy: compare dst and src when op is greater_or_equal #27

Merged
merged 1 commit into from
Aug 15, 2023
Merged

policy: compare dst and src when op is greater_or_equal #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion src/migtd/src/mig_policy.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,11 @@ use tdx_tdcall::tdreport;

use crate::{config::get_policy, event_log::get_event_log};

pub fn authenticate_policy(td_report_peer: &[u8], event_log_peer: &[u8]) -> PolicyVerifyReulst {
pub fn authenticate_policy(
is_src: bool,
td_report_peer: &[u8],
event_log_peer: &[u8],
) -> PolicyVerifyReulst {
let td_report = if let Ok(td_report) = tdreport::tdcall_report(&[0u8; 64]) {
td_report
} else {
Expand All @@ -28,6 +32,7 @@ pub fn authenticate_policy(td_report_peer: &[u8], event_log_peer: &[u8]) -> Poli
};

verify_policy(
is_src,
policy,
td_report.as_bytes(),
event_log,
Expand Down
19 changes: 15 additions & 4 deletions src/migtd/src/ratls.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,15 +82,17 @@ pub fn server<T: Read + Write>(stream: T) -> Result<SecureChannel<T>> {
let mut signing_key = EcdsaPk::new()?;
let certs = vec![gen_cert(&mut signing_key)?];

let config = TlsConfig::new(certs, signing_key, verify_peer_cert)?;
// Server verifies certificate of client
let config = TlsConfig::new(certs, signing_key, verify_client_cert)?;
config.tls_server(stream).map_err(|e| e.into())
}

pub fn client<T: Read + Write>(stream: T) -> Result<SecureChannel<T>> {
let mut signing_key = EcdsaPk::new()?;
let certs = vec![gen_cert(&mut signing_key)?];

let config = TlsConfig::new(certs, signing_key, verify_peer_cert)?;
// Client verifies certificate of server
let config = TlsConfig::new(certs, signing_key, verify_server_cert)?;
config.tls_client(stream).map_err(|e| e.into())
}

Expand Down Expand Up @@ -153,7 +155,15 @@ fn gen_quote(public_key: &[u8]) -> Result<Vec<u8>> {
attestation::get_quote(td_report.as_bytes()).map_err(|_| RatlsError::GetQuote)
}

fn verify_peer_cert(cert: &[u8]) -> core::result::Result<(), CryptoError> {
fn verify_server_cert(cert: &[u8]) -> core::result::Result<(), CryptoError> {
verify_peer_cert(true, cert)
}

fn verify_client_cert(cert: &[u8]) -> core::result::Result<(), CryptoError> {
verify_peer_cert(false, cert)
}

fn verify_peer_cert(is_client: bool, cert: &[u8]) -> core::result::Result<(), CryptoError> {
let cert = Certificate::from_der(cert).map_err(|_| CryptoError::ParseCertificate)?;

let extensions = cert
Expand All @@ -168,7 +178,8 @@ fn verify_peer_cert(cert: &[u8]) -> core::result::Result<(), CryptoError> {
if let Ok(report) = attestation::verify_quote(quote_report) {
verify_signature(&cert, report.as_slice())?;

if mig_policy::authenticate_policy(report.as_slice(), event_log)
// MigTD-src acts as TLS client
if mig_policy::authenticate_policy(is_client, report.as_slice(), event_log)
!= policy::PolicyVerifyReulst::Succeed
{
return Err(CryptoError::TlsVerifyPeerCert(MIG_POLICY_ERROR.to_string()));
Expand Down
64 changes: 41 additions & 23 deletions src/policy/src/config.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ pub struct Property {
}

impl Property {
pub fn verify(&self, local: &[u8], peer: &[u8]) -> bool {
pub fn verify(&self, is_src: bool, local: &[u8], peer: &[u8]) -> bool {
match &self.reference {
Reference::Integer(i) => {
if peer.len() > size_of::<usize>() {
Expand All @@ -42,25 +42,25 @@ impl Property {
let mut bytes = [0u8; 8];
bytes[..peer.len()].copy_from_slice(peer);
let peer = usize::from_le_bytes(bytes);
i.verify(&self.operation, 0, peer)
i.verify(is_src, &self.operation, 0, peer)
}
}
Reference::String(s) => {
if let Ok(peer) = String::from_utf8(peer.to_vec()) {
s.verify(&self.operation, "", &peer)
s.verify(is_src, &self.operation, "", &peer)
} else {
false
}
}
Reference::Local(selfr) => selfr.verify(&self.operation, local, peer),
Reference::Local(selfr) => selfr.verify(is_src, &self.operation, local, peer),
Reference::IntegerRange(r) => {
if peer.len() > size_of::<usize>() {
false
} else {
let mut bytes = [0u8; 8];
bytes[..peer.len()].copy_from_slice(peer);
let peer = usize::from_le_bytes(bytes);
r.verify(&self.operation, 0, peer)
r.verify(is_src, &self.operation, 0, peer)
}
}
}
Expand Down Expand Up @@ -126,7 +126,7 @@ impl<'de> Deserialize<'de> for Operation {
struct Integer(usize);

impl Integer {
fn verify(&self, op: &Operation, _local: usize, peer: usize) -> bool {
fn verify(&self, _is_src: bool, op: &Operation, _local: usize, peer: usize) -> bool {
match op {
Operation::Equal => peer == self.0,
Operation::GreaterOrEqual => peer >= self.0,
Expand All @@ -141,7 +141,7 @@ impl Integer {
struct RefString(String);

impl RefString {
fn verify(&self, op: &Operation, _local: &str, peer: &str) -> bool {
fn verify(&self, _is_src: bool, op: &Operation, _local: &str, peer: &str) -> bool {
match op {
Operation::Equal => *peer == self.0,
Operation::GreaterOrEqual => false,
Expand All @@ -156,10 +156,16 @@ impl RefString {
struct RefLocal;

impl RefLocal {
fn verify(&self, op: &Operation, local: &[u8], peer: &[u8]) -> bool {
fn verify(&self, is_src: bool, op: &Operation, local: &[u8], peer: &[u8]) -> bool {
match op {
Operation::Equal => peer == local,
Operation::GreaterOrEqual => peer >= local,
Operation::GreaterOrEqual => {
if is_src {
peer >= local
} else {
local >= peer
}
}
Operation::Subset => false,
Operation::InRange => false,
Operation::InTimeRange => false,
Expand All @@ -171,7 +177,7 @@ impl RefLocal {
struct IntegerRange(ops::Range<usize>);

impl IntegerRange {
fn verify(&self, op: &Operation, _local: usize, peer: usize) -> bool {
fn verify(&self, _is_src: bool, op: &Operation, _local: usize, peer: usize) -> bool {
match op {
Operation::Equal => false,
Operation::GreaterOrEqual => false,
Expand Down Expand Up @@ -254,7 +260,9 @@ mod test {
let not_equal: usize = 0;
let op = Operation::Equal;

assert!(Integer(1).verify(&op, 0, equal) && !Integer(1).verify(&op, 0, not_equal));
assert!(
Integer(1).verify(true, &op, 0, equal) && !Integer(1).verify(true, &op, 0, not_equal)
);
}

#[test]
Expand All @@ -266,9 +274,9 @@ mod test {
let op = Operation::GreaterOrEqual;

assert!(
!Integer(1).verify(&op, 0, less)
&& Integer(1).verify(&op, 0, equal)
&& Integer(1).verify(&op, 0, greater)
!Integer(1).verify(true, &op, 0, less)
&& Integer(1).verify(true, &op, 0, equal)
&& Integer(1).verify(true, &op, 0, greater)
);
}

Expand All @@ -280,8 +288,8 @@ mod test {
let op = Operation::Equal;

assert!(
RefString(String::from("abc")).verify(&op, &local, &equal)
&& !RefString(String::from("abc")).verify(&op, &local, &not_equal)
RefString(String::from("abc")).verify(true, &op, &local, &equal)
&& !RefString(String::from("abc")).verify(true, &op, &local, &not_equal)
);
}

Expand All @@ -293,22 +301,32 @@ mod test {

let op = Operation::Equal;

assert!(!RefLocal.verify(&op, &local, &not_equal) && RefLocal.verify(&op, &local, &equal));
assert!(
!RefLocal.verify(true, &op, &local, &not_equal)
&& RefLocal.verify(true, &op, &local, &equal)
);
}

#[test]
fn test_self_greater_or_equal() {
let local = [1, 2, 3, 4];
let src = [1, 2, 3, 4];
let less = [1, 2, 3];
let equal = [1, 2, 3, 4];
let greater = [1, 2, 3, 4, 5];

let op = Operation::GreaterOrEqual;

assert!(
!RefLocal.verify(&op, &local, &less)
&& RefLocal.verify(&op, &local, &equal)
&& RefLocal.verify(&op, &local, &greater)
!RefLocal.verify(true, &op, &src, &less)
&& RefLocal.verify(true, &op, &src, &equal)
&& RefLocal.verify(true, &op, &src, &greater)
);

let dst = src;
assert!(
RefLocal.verify(false, &op, &dst, &less)
&& RefLocal.verify(false, &op, &dst, &equal)
&& !RefLocal.verify(false, &op, &dst, &greater)
);
}

Expand All @@ -320,8 +338,8 @@ mod test {
let op = Operation::InRange;

assert!(
!IntegerRange(0..3).verify(&op, 0, not_inrange)
&& IntegerRange(0..3).verify(&op, 0, inrange)
!IntegerRange(0..3).verify(true, &op, 0, not_inrange)
&& IntegerRange(0..3).verify(true, &op, 0, inrange)
);
}
}
Loading
Loading