-
Notifications
You must be signed in to change notification settings - Fork 12
COCOS-153 - Add host-data
option
#163
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
manager/service.go
Outdated
jsonData, err := json.Marshal(ac) | ||
if err != nil { | ||
ms.publishEvent("vm-provision", c.Id, "failed", json.RawMessage{}) | ||
return "", errors.Wrap(ErrFailedToMarshalJSON, err) | ||
} | ||
computationHash := sha3.Sum256(jsonData) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
move to a function
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
cli/backend_info.go
Outdated
|
||
type AttestationConfiguration struct { | ||
SNPPolicy *check.Policy `json:"snp_policy,omitempty"` | ||
RootOFTrust *check.RootOfTrust `json:"root_of_trust,omitempty"` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
RootOfTrust
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done, my mistake. Thanks.
manager/service.go
Outdated
@@ -156,3 +170,12 @@ func (ms *managerService) publishEvent(event, cmpID, status string, details json | |||
}, | |||
} | |||
} | |||
|
|||
func getComputationHash(ac *agent.Computation) ([32]byte, error) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Rename to computationHash
and use like ch := computationHash(ac)
. If there is no need to pass the pointer param here (i.e. we do not change the computation from this function), pass by value instead.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done. The computation is passed by value now.
cli/backend_info.go
Outdated
measurement, err := base64.StdEncoding.DecodeString(args[0]) | ||
if err != nil { | ||
log.Fatalf("Error could not decode base64: %v", err) | ||
} | ||
|
||
if len(measurement) != measurementLength { | ||
log.Fatalf("Measurement must be 48 bytes in length") | ||
} | ||
attestationConfiguration := AttestationConfiguration{} | ||
|
||
backendInfo, err := os.OpenFile(args[1], os.O_RDWR, filePermision) | ||
if err != nil { | ||
log.Fatalf("Error opening the backend information file: %v", err) | ||
} | ||
defer backendInfo.Close() | ||
|
||
decoder := json.NewDecoder(backendInfo) | ||
err = decoder.Decode(&attestationConfiguration) | ||
if err != nil { | ||
log.Fatalf("Error decoding the backend information file: %v", err) | ||
} | ||
|
||
attestationConfiguration.SNPPolicy.Measurement = measurement | ||
if err = backendInfo.Truncate(0); err != nil { | ||
log.Fatalf("Error could not truncate backend information JSON file: %v", err) | ||
} | ||
|
||
fileJson, err := json.MarshalIndent(attestationConfiguration, "", " ") | ||
if err != nil { | ||
log.Fatalf("Error marshaling the backend information JSON: %v", err) | ||
} | ||
if err = os.WriteFile(backendInfo.Name(), fileJson, filePermision); err != nil { | ||
log.Fatalf("Error writing into backend information JSON file: %v", err) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is it possible to simplify with something like:
measurement, err := base64.StdEncoding.DecodeString(args[0]) | |
if err != nil { | |
log.Fatalf("Error could not decode base64: %v", err) | |
} | |
if len(measurement) != measurementLength { | |
log.Fatalf("Measurement must be 48 bytes in length") | |
} | |
attestationConfiguration := AttestationConfiguration{} | |
backendInfo, err := os.OpenFile(args[1], os.O_RDWR, filePermision) | |
if err != nil { | |
log.Fatalf("Error opening the backend information file: %v", err) | |
} | |
defer backendInfo.Close() | |
decoder := json.NewDecoder(backendInfo) | |
err = decoder.Decode(&attestationConfiguration) | |
if err != nil { | |
log.Fatalf("Error decoding the backend information file: %v", err) | |
} | |
attestationConfiguration.SNPPolicy.Measurement = measurement | |
if err = backendInfo.Truncate(0); err != nil { | |
log.Fatalf("Error could not truncate backend information JSON file: %v", err) | |
} | |
fileJson, err := json.MarshalIndent(attestationConfiguration, "", " ") | |
if err != nil { | |
log.Fatalf("Error marshaling the backend information JSON: %v", err) | |
} | |
if err = os.WriteFile(backendInfo.Name(), fileJson, filePermision); err != nil { | |
log.Fatalf("Error writing into backend information JSON file: %v", err) | |
} | |
measurement, err := base64.StdEncoding.DecodeString(args[0]) | |
if err != nil { | |
log.Fatalf("Error could not decode base64: %v", err) | |
} | |
if len(measurement) != measurementLength { | |
log.Fatalf("Measurement must be 48 bytes in length") | |
} | |
ac := AttestationConfiguration{} | |
bi, err := os.ReadFile(args[1]) | |
if err != nil { | |
log.Fatalf("Failed to read the config file: %v", err) | |
} | |
if err := json.Unmarshal(bi, &ac); err != nil { | |
log.Fatalf("Failed to unmarshal JSON data: %v", err) | |
} | |
ac.SNPPolicy.Measurement = measurement | |
bi, err = json.MarshalIndent(ac, "", "") | |
if err != nil { | |
log.Fatalf("Failed to marshal JSON configuration: %v", err) | |
} | |
if err := os.WriteFile(args[1], bi, filePermission); err != nil { | |
log.Fatalf("Failed to write config to the file: %v", err) | |
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
cli/backend_info.go
Outdated
) | ||
|
||
const ( | ||
filePermision = 0o755 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fix typo permission
. Also, consider completely removing it and using predefined modes from the fs
like fs.<Whatever_mode_we_need_here>
.
} | ||
} | ||
|
||
func (cli *CLI) NewAddMeasurementCmd() *cobra.Command { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are a lot of repetitions, please extract to an unexported function.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changed. I have written a single function that alters the backend info file (adds the measurement and host data) and takes the fieldType
argument so that the function knows if it should change the measurement field or host data field.
cli/backend_info.go
Outdated
) | ||
|
||
const ( | ||
// 0o744 file permission gives RWX permission to the user and only the R permission to others |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
// 0o744 file permission gives RWX permission to the user and only the R permission to others | |
// 0o744 file permission gives RWX permission to the user and only the R permission to others. |
df6ddfc
to
662aca0
Compare
case measurementField: | ||
ac.SNPPolicy.Measurement = data | ||
case hostDataField: | ||
ac.SNPPolicy.HostData = data |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add a default case that returns an error.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
What type of PR is this?
This is a feature because it adds:
host-data
option to the launching of CVMs.This PR also renames the
platform_info.json
intobackend_info.json
.What does this do?
This PR enables the Manager to launch CVMs with the
host-data
filed of the attestation report populated with the computation configuration of the Agent. This way, the Agent can check what is being sent to him by the Manager.This PR also renames the
platform_info.json
intobackend_info.json
.Which issue(s) does this PR fix/relate to?
host-data
QEMU option to CVM boot up #153Have you included tests for your changes?
The manual README.md has been changed to reflect this new feature.
Did you document any new/modified feature?
Documentation will be updated in a separate PR.
Notes