Refactor CEL AppendEvent, to support RTMR #486

jkl73 · 2024-09-07T01:45:53Z

CEL code was written based on TPM PCR. Now we want to support RTMR based CEL.

Add a new AppendEventRTMR to support rtmr CEL

jkl73 · 2024-09-11T01:02:18Z

/gcbrun

jkl73 · 2024-09-21T00:18:28Z

/gcbrun

jkl73 · 2024-09-21T00:27:41Z

/gcbrun

jkl73 · 2024-09-21T00:35:02Z

/gcbrun

jkl73 · 2024-09-21T00:57:59Z

/gcbrun

cel/canonical_eventlog.go

yawangwang · 2024-09-23T20:17:57Z

launcher/agent/agent.go

+	}
+
+	// append TPM PCR event to eventlog
+	return a.cosCel.AppendEvent(cel.CosEventPCR, event, tpmDigestsmap)


MeasureEvent only appends TPM PCR event, do u have a plan to have support for measuring RTMR event to event log and integration into the current container runner for TDX CS image?

I think it is done in a different PR. #478

AppendEvent is now register-agnostics, then actual "extend" operation on pcr or rtmr should be done outside "AppendEvent" function.

nit: Given that MeasureEvent appends TPM PCR event, could you rename it to something like MeasurePCREvent to distinguish it from RMTR event measurement?

yawangwang · 2024-09-23T20:34:25Z

server/eventlog.go

+	return getCosStateFromCEL(rawCanonicalEventLog, cryptoHash, pcrs.GetPcrs())
+}
+
+func parseCanonicalEventLogRTMR(rawCanonicalEventLog []byte, rtmrs [][]byte) (*pb.MachineState, error) {


Two things:

could you export this function because GAV will likely consume it.

From GAV perspective, what's the source of rtmrs? I know rawCanonicalEventLog comes from this proto field(https://source.corp.google.com/piper///depot/google3/google/cloud/confidentialcomputing/v1main/service.proto;rcl=650697927;l=231), but where can I locate rtmrs which is a digest array?

RTMRs should be read from the TD quote. https://github.com/google/go-tdx-guest/blob/main/rtmr/ccel.go#L58

+1 to Yawang. Could you export this function?

You should just use the register.RTMRBank type since that's what go-eventlog and go-tdx-guest use.

could you export this function because GAV will likely consume it.

I thought this function is only going to be consumed by the server.VerifyAttestation? But sure I can export it.

GAV will consume this function to parse and verify CosState from CEL logs for TDX RTMR. Also looks like this function is not called by server.VerifyAttestation from your PR changes.. so I think export is needed here.

server/eventlog.go

alexmwu

Given this PR has breaking changes, please note what broke (AppendEvent, Replay) in the description.

alexmwu · 2024-09-26T01:25:17Z

cel/canonical_eventlog.go

 type Record struct {
 	RecNum  uint64
-	PCR     uint8
+	PCR     uint8 // can also be RTMR index


Did we ever check with the TCG WG about putting a RTMR or CCMR type?

not yet, I'll send an email

cel/canonical_eventlog.go

alexmwu · 2024-09-26T01:42:00Z

cel/canonical_eventlog.go

-		}
-	}
-
+func (c *CEL) AppendEvent(index int, event Content, digestsMap map[crypto.Hash][]byte) error {


You do not mention how callers should populate digestsMap. Regardless, passing digestsMap seems like the wrong interface since the value is derivable from content.

Maybe we should pass either a func or a type that implements an interface as follows:

type Extender interface { // Extend hash extends the given MR bank's index with the supplied digest. Extend(crypto.Hash, int, []byte) error }

This also has the pro of decoupling the cel package from needing a real/simulated TPM to test AppendEvent.

Thought about this I also think it's better. We need have configfsi.Client type and the tpm type to implement this interface, I think I can do this later.

For now I just created two separate functions fro RTMR and PCR.

cel/canonical_eventlog.go

alexmwu · 2024-09-26T02:16:35Z

server/eventlog.go

+	return getCosStateFromCEL(rawCanonicalEventLog, cryptoHash, pcrs.GetPcrs())
+}
+
+func parseCanonicalEventLogRTMR(rawCanonicalEventLog []byte, rtmrs [][]byte) (*pb.MachineState, error) {


You should just use the register.RTMRBank type since that's what go-eventlog and go-tdx-guest use.

server/eventlog.go

cel/canonical_eventlog.go

server/verify.go

cel/canonical_eventlog.go

server/verify.go

server/eventlog_test.go

alexmwu · 2024-10-02T23:03:17Z

server/eventlog_test.go

+	// Faking PCR with RTMR
+	imposterPcrBank := map[uint32][]byte{}
+	imposterPcrBank[1] = rtmrBank.RTMRs[0].Digest
+	imposterPcrBank[2] = rtmrBank.RTMRs[1].Digest
+	imposterPcrBank[3] = rtmrBank.RTMRs[2].Digest
+	imposterPcrBank[4] = rtmrBank.RTMRs[3].Digest
+	imposterPcrs := &pb.PCRs{Hash: pb.HashAlgo_SHA384, Pcrs: imposterPcrBank}
+
+	if msState, err = ParseCosCanonicalEventLogPCR(buf.Bytes(), imposterPcrs); err != nil {
+		t.Errorf("expecting no error from parseCosEventLogRTMR(), but get %v", err)
+	} else {
+		if diff := cmp.Diff(msState.Cos.Container, &attestpb.ContainerState{}, protocmp.Transform()); diff != "" {
+			t.Error("expect no claims when replaying against imposter PCR")
+		}
+		if diff := cmp.Diff(msState.Cos.HealthMonitoring, &attestpb.HealthMonitoringState{}, protocmp.Transform()); diff != "" {
+			t.Error("expect no claims when replaying against imposter PCR")
+		}


this should go in a separate test that makes it clear what you're trying to do.

Will refactor in the next PR

server/eventlog.go

cel/canonical_eventlog.go

alexmwu · 2024-10-02T23:20:55Z

cel/canonical_eventlog.go

+}
+
+// AppendEventPCR appends a new PCR record to the CEL.
+func (c *CEL) AppendEventPCR(tpm io.ReadWriteCloser, pcr int, hashAlgos []crypto.Hash, event Content) error {


I will again note that adding an AppendEvent[RegisterType] seems like the wrong interface. We will have to add a new one if we ever want to support NV registers, ARM registers, SVSM-simulated registers, GPU registers, etc.. This also introduces new dependencies every time we support a new register type since we have to create AppendEventARM and then import the ARM register library. Hopefully that's not often, but it's possible other companies decide to follow the Intel model.

I do think passing an extend func/interface as a parameter is the right call due to the decoupling, but I will leave this as optional.

Agree, AppendEvent should work on arbitrary register type (instead of creating one AppendEvent for each). The change involves upstream go-tdx-guest, I will keep this for now, and update it in a later PR.

cel/canonical_eventlog.go

launcher/agent/agent.go

qinkunbao · 2024-10-03T04:41:45Z

/gcbrun

jkl73 · 2024-10-03T18:56:09Z

/gcbrun

Add new RTMR CEL AppendEventRTMR Redirect AppendEvent to AppendEventPCR Signed-off-by: Jiankun Lu <[email protected]>

jkl73 · 2024-10-03T20:04:04Z

/gcbrun

jkl73 force-pushed the parsertmrverify branch 2 times, most recently from f59a705 to f712448 Compare September 11, 2024 00:11

jkl73 changed the title ~~Add support for CEL replay on RMTR/MRTD~~ Refactor CEL AppendEvent, to support RTMR Sep 11, 2024

jkl73 force-pushed the parsertmrverify branch from f712448 to e361054 Compare September 11, 2024 00:17

jkl73 requested a review from alexmwu September 11, 2024 01:03

jkl73 force-pushed the parsertmrverify branch from e361054 to 72ea282 Compare September 11, 2024 01:11

jkl73 force-pushed the parsertmrverify branch 4 times, most recently from a6590ed to 878d7ad Compare September 21, 2024 00:13

jkl73 force-pushed the parsertmrverify branch from 878d7ad to 73683ca Compare September 21, 2024 00:23

jkl73 force-pushed the parsertmrverify branch from 73683ca to d0df067 Compare September 21, 2024 00:42

jkl73 requested a review from yawangwang September 21, 2024 00:57

yawangwang reviewed Sep 23, 2024

View reviewed changes

jkl73 requested a review from qinkunbao September 24, 2024 00:29

qinkunbao approved these changes Sep 25, 2024

View reviewed changes

alexmwu requested changes Sep 26, 2024

View reviewed changes

jkl73 force-pushed the parsertmrverify branch from d0df067 to 61934b5 Compare October 2, 2024 22:13

yawangwang approved these changes Oct 2, 2024

View reviewed changes

cel/canonical_eventlog.go Show resolved Hide resolved

jkl73 force-pushed the parsertmrverify branch 3 times, most recently from c1e95d0 to bb5785b Compare October 2, 2024 23:25

alexmwu requested changes Oct 2, 2024

View reviewed changes

cel/canonical_eventlog.go Outdated Show resolved Hide resolved

launcher/agent/agent.go Outdated Show resolved Hide resolved

alexmwu approved these changes Oct 3, 2024

View reviewed changes

jkl73 force-pushed the parsertmrverify branch 4 times, most recently from dd82acc to 96b1a14 Compare October 3, 2024 18:51

Support RTMR CEL eventlog replay

d8643a0

Add new RTMR CEL AppendEventRTMR Redirect AppendEvent to AppendEventPCR Signed-off-by: Jiankun Lu <[email protected]>

jkl73 force-pushed the parsertmrverify branch from 96b1a14 to d8643a0 Compare October 3, 2024 20:03

jkl73 merged commit 3332c30 into google:main Oct 3, 2024

Refactor CEL AppendEvent, to support RTMR #486

Refactor CEL AppendEvent, to support RTMR #486

Uh oh!

Conversation

jkl73 commented Sep 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkl73 commented Sep 11, 2024

Uh oh!

jkl73 commented Sep 21, 2024

Uh oh!

jkl73 commented Sep 21, 2024

Uh oh!

jkl73 commented Sep 21, 2024

Uh oh!

jkl73 commented Sep 21, 2024

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alexmwu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

qinkunbao commented Oct 3, 2024

Uh oh!

jkl73 commented Sep 7, 2024 •

edited

Loading