Skip to content

Commit 203a178

Browse files
mcollins-ttdmcollins-ttd
authored
Merge pull request #402 from IABTechLab/mkc-UID2-4963-remove-azure-cc-aks-attestation
Revert "UID2-4808 Add AKS protocol for `AzureCCCoreAttestationService`" (#374)
2 parents ebff73e + a441c03 commit 203a178

File tree

10 files changed

+40
-179
lines changed

10 files changed

+40
-179
lines changed

‎src/main/java/com/uid2/shared/secure/AzureCCCoreAttestationService.java‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,38 +25,34 @@ public class AzureCCCoreAttestationService implements ICoreAttestationService {
2525

2626
private final IPolicyValidator policyValidator;
2727

28-
private final String azureCcProtocol;
29-
30-
public AzureCCCoreAttestationService(String maaServerBaseUrl, String attestationUrl, String azureCcProtocol) {
31-
this(new MaaTokenSignatureValidator(maaServerBaseUrl), new PolicyValidator(attestationUrl), azureCcProtocol);
28+
public AzureCCCoreAttestationService(String maaServerBaseUrl, String attestationUrl) {
29+
this(new MaaTokenSignatureValidator(maaServerBaseUrl), new PolicyValidator(attestationUrl));
3230
}
3331

3432
// used in UT
35-
protected AzureCCCoreAttestationService(IMaaTokenSignatureValidator tokenSignatureValidator, IPolicyValidator policyValidator, String azureCcProtocol) {
33+
protected AzureCCCoreAttestationService(IMaaTokenSignatureValidator tokenSignatureValidator, IPolicyValidator policyValidator) {
3634
this.tokenSignatureValidator = tokenSignatureValidator;
3735
this.policyValidator = policyValidator;
38-
this.azureCcProtocol = azureCcProtocol;
3936
}
4037

4138
@Override
4239
public void attest(byte[] attestationRequest, byte[] publicKey, Handler<AsyncResult<AttestationResult>> handler) {
4340
try {
4441
var tokenString = new String(attestationRequest, StandardCharsets.US_ASCII);
4542

46-
log.debug("Attesting for {} operator...", azureCcProtocol);
4743
log.debug("Validating signature...");
48-
var tokenPayload = tokenSignatureValidator.validate(tokenString, azureCcProtocol);
44+
var tokenPayload = tokenSignatureValidator.validate(tokenString);
4945

5046
log.debug("Validating policy...");
5147
var encodedPublicKey = Utils.toBase64String(publicKey);
5248

5349
var enclaveId = policyValidator.validate(tokenPayload, encodedPublicKey);
5450

5551
if (allowedEnclaveIds.contains(enclaveId)) {
56-
log.info("Successfully attested {} against registered enclaves, enclave id: {}", azureCcProtocol, enclaveId);
52+
log.info("Successfully attested azure-cc against registered enclaves, enclave id: {}", enclaveId);
5753
handler.handle(Future.succeededFuture(new AttestationResult(publicKey, enclaveId)));
5854
} else {
59-
log.warn("Got unsupported {} enclave id: {}", azureCcProtocol, enclaveId);
55+
log.warn("Got unsupported azure-cc enclave id: {}", enclaveId);
6056
handler.handle(Future.succeededFuture(new AttestationResult(AttestationFailure.FORBIDDEN_ENCLAVE)));
6157
}
6258
}

‎src/main/java/com/uid2/shared/secure/azurecc/IMaaTokenSignatureValidator.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ public interface IMaaTokenSignatureValidator {
1010
* @return Parsed token payload.
1111
* @throws AttestationException
1212
*/
13-
MaaTokenPayload validate(String tokenString, String protocol) throws AttestationException;
13+
MaaTokenPayload validate(String tokenString) throws AttestationException;
1414
}

‎src/main/java/com/uid2/shared/secure/azurecc/MaaTokenPayload.java‎

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,14 @@
11
package com.uid2.shared.secure.azurecc;
22

3-
import com.uid2.shared.secure.AttestationClientException;
4-
import com.uid2.shared.secure.AttestationException;
5-
import com.uid2.shared.secure.AttestationFailure;
63
import lombok.Builder;
74
import lombok.Value;
85

96
@Value
107
@Builder(toBuilder = true)
118
public class MaaTokenPayload {
129
public static final String SEV_SNP_VM_TYPE = "sevsnpvm";
13-
public static final String AZURE_CC_ACI_PROTOCOL = "azure-cc";
14-
public static final String AZURE_CC_AKS_PROTOCOL = "azure-cc-aks";
15-
// the `x-ms-compliance-status` value for ACI CC
1610
public static final String AZURE_COMPLIANT_UVM = "azure-compliant-uvm";
17-
// the `x-ms-compliance-status` value for AKS CC
18-
public static final String AZURE_COMPLIANT_UVM_AKS = "azure-signed-katacc-uvm";
1911

20-
private String azureProtocol;
2112
private String attestationType;
2213
private String complianceStatus;
2314
private boolean vmDebuggable;
@@ -29,13 +20,7 @@ public boolean isSevSnpVM(){
2920
return SEV_SNP_VM_TYPE.equalsIgnoreCase(attestationType);
3021
}
3122

32-
public boolean isUtilityVMCompliant() throws AttestationClientException {
33-
if (azureProtocol == AZURE_CC_ACI_PROTOCOL) {
34-
return AZURE_COMPLIANT_UVM.equalsIgnoreCase(complianceStatus);
35-
} else if (azureProtocol == AZURE_CC_AKS_PROTOCOL) {
36-
return AZURE_COMPLIANT_UVM_AKS.equalsIgnoreCase(complianceStatus);
37-
} else {
38-
throw new AttestationClientException(String.format("Azure protocol: %s not supported", azureProtocol), AttestationFailure.INVALID_PROTOCOL);
39-
}
23+
public boolean isUtilityVMCompliant(){
24+
return AZURE_COMPLIANT_UVM.equalsIgnoreCase(complianceStatus);
4025
}
4126
}

‎src/main/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidator.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import static com.uid2.shared.secure.JwtUtils.tryGetField;
1616

1717
public class MaaTokenSignatureValidator implements IMaaTokenSignatureValidator {
18+
1819
// set to true to facilitate local test.
1920
public static final boolean BYPASS_SIGNATURE_CHECK = false;
2021

@@ -51,7 +52,7 @@ private TokenVerifier buildTokenVerifier(String kid) throws AttestationException
5152
}
5253

5354
@Override
54-
public MaaTokenPayload validate(String tokenString, String protocol) throws AttestationException {
55+
public MaaTokenPayload validate(String tokenString) throws AttestationException {
5556
if (Strings.isNullOrEmpty(tokenString)) {
5657
throw new IllegalArgumentException("tokenString can not be null or empty");
5758
}
@@ -76,7 +77,6 @@ public MaaTokenPayload validate(String tokenString, String protocol) throws Atte
7677

7778
var tokenPayloadBuilder = MaaTokenPayload.builder();
7879

79-
tokenPayloadBuilder.azureProtocol(protocol);
8080
tokenPayloadBuilder.attestationType(tryGetField(rawPayload, "x-ms-attestation-type", String.class));
8181
tokenPayloadBuilder.complianceStatus(tryGetField(rawPayload, "x-ms-compliance-status", String.class));
8282
tokenPayloadBuilder.vmDebuggable(tryGetField(rawPayload, "x-ms-sevsnpvm-is-debuggable", Boolean.class));

‎src/test/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceTest.java‎

Lines changed: 21 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,6 @@
99
import org.junit.jupiter.api.BeforeEach;
1010
import org.junit.jupiter.api.Test;
1111
import org.junit.jupiter.api.extension.ExtendWith;
12-
import org.junit.jupiter.params.ParameterizedTest;
13-
import org.junit.jupiter.params.provider.Arguments;
14-
import org.junit.jupiter.params.provider.MethodSource;
15-
import org.junit.jupiter.params.provider.ValueSource;
1612
import org.mockito.Mock;
1713
import org.mockito.junit.jupiter.MockitoExtension;
1814
import org.mockito.junit.jupiter.MockitoSettings;
@@ -22,7 +18,6 @@
2218
import java.nio.charset.StandardCharsets;
2319
import java.util.Arrays;
2420
import java.util.Base64;
25-
import java.util.stream.Stream;
2621

2722
import static org.junit.jupiter.api.Assertions.*;
2823
import static org.mockito.ArgumentMatchers.any;
@@ -60,27 +55,25 @@ private static byte[] encodeStringUnicodeAttestationEndpoint(String data) {
6055

6156
@BeforeEach
6257
public void setup() throws AttestationException {
63-
when(alwaysPassTokenValidator.validate(any(), any())).thenReturn(VALID_TOKEN_PAYLOAD);
58+
when(alwaysPassTokenValidator.validate(any())).thenReturn(VALID_TOKEN_PAYLOAD);
6459
when(alwaysPassPolicyValidator.validate(any(), any())).thenReturn(ENCLAVE_ID);
6560
}
6661

67-
@ParameterizedTest
68-
@MethodSource("argumentProvider")
69-
public void testHappyPath(String azureProtocol) throws AttestationException {
70-
var provider = new AzureCCCoreAttestationService(alwaysPassTokenValidator, alwaysPassPolicyValidator, azureProtocol);
62+
@Test
63+
public void testHappyPath() throws AttestationException {
64+
var provider = new AzureCCCoreAttestationService(alwaysPassTokenValidator, alwaysPassPolicyValidator);
7165
provider.registerEnclave(ENCLAVE_ID);
7266
attest(provider, ar -> {
7367
assertTrue(ar.succeeded());
7468
assertTrue(ar.result().isSuccess());
7569
});
7670
}
7771

78-
@ParameterizedTest
79-
@MethodSource("argumentProvider")
80-
public void testSignatureCheckFailed_ClientError(String azureProtocol) throws AttestationException {
72+
@Test
73+
public void testSignatureCheckFailed_ClientError() throws AttestationException {
8174
var errorStr = "token signature validation failed";
82-
when(alwaysFailTokenValidator.validate(any(), any())).thenThrow(new AttestationClientException(errorStr, AttestationFailure.BAD_PAYLOAD));
83-
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysPassPolicyValidator, azureProtocol);
75+
when(alwaysFailTokenValidator.validate(any())).thenThrow(new AttestationClientException(errorStr, AttestationFailure.BAD_PAYLOAD));
76+
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysPassPolicyValidator);
8477
provider.registerEnclave(ENCLAVE_ID);
8578
attest(provider, ar -> {
8679
assertTrue(ar.succeeded());
@@ -89,24 +82,22 @@ public void testSignatureCheckFailed_ClientError(String azureProtocol) throws At
8982
});
9083
}
9184

92-
@ParameterizedTest
93-
@MethodSource("argumentProvider")
94-
public void testSignatureCheckFailed_ServerError(String azureProtocol) throws AttestationException {
95-
when(alwaysFailTokenValidator.validate(any(), any())).thenThrow(new AttestationException("unknown server error"));
96-
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysPassPolicyValidator, azureProtocol);
85+
@Test
86+
public void testSignatureCheckFailed_ServerError() throws AttestationException {
87+
when(alwaysFailTokenValidator.validate(any())).thenThrow(new AttestationException("unknown server error"));
88+
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysPassPolicyValidator);
9789
provider.registerEnclave(ENCLAVE_ID);
9890
attest(provider, ar -> {
9991
assertFalse(ar.succeeded());
10092
assertTrue(ar.cause() instanceof AttestationException);
10193
});
10294
}
10395

104-
@ParameterizedTest
105-
@MethodSource("argumentProvider")
106-
public void testPolicyCheckSuccess_ClientError(String azureProtocol) throws AttestationException {
96+
@Test
97+
public void testPolicyCheckSuccess_ClientError() throws AttestationException {
10798
var errorStr = "policy validation failed";
10899
when(alwaysFailPolicyValidator.validate(any(), any())).thenThrow(new AttestationClientException(errorStr, AttestationFailure.BAD_PAYLOAD));
109-
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysFailPolicyValidator, azureProtocol);
100+
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysFailPolicyValidator);
110101
provider.registerEnclave(ENCLAVE_ID);
111102
attest(provider, ar -> {
112103
assertTrue(ar.succeeded());
@@ -115,22 +106,20 @@ public void testPolicyCheckSuccess_ClientError(String azureProtocol) throws Atte
115106
});
116107
}
117108

118-
@ParameterizedTest
119-
@MethodSource("argumentProvider")
120-
public void testPolicyCheckFailed_ServerError(String azureProtocol) throws AttestationException {
109+
@Test
110+
public void testPolicyCheckFailed_ServerError() throws AttestationException {
121111
when(alwaysFailPolicyValidator.validate(any(), any())).thenThrow(new AttestationException("unknown server error"));
122-
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysFailPolicyValidator, azureProtocol);
112+
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysFailPolicyValidator);
123113
provider.registerEnclave(ENCLAVE_ID);
124114
attest(provider, ar -> {
125115
assertFalse(ar.succeeded());
126116
assertTrue(ar.cause() instanceof AttestationException);
127117
});
128118
}
129119

130-
@ParameterizedTest
131-
@MethodSource("argumentProvider")
132-
public void testEnclaveNotRegistered(String azureProtocol) throws AttestationException {
133-
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysPassPolicyValidator, azureProtocol);
120+
@Test
121+
public void testEnclaveNotRegistered() throws AttestationException {
122+
var provider = new AzureCCCoreAttestationService(alwaysFailTokenValidator, alwaysPassPolicyValidator);
134123
attest(provider, ar -> {
135124
assertTrue(ar.succeeded());
136125
assertFalse(ar.result().isSuccess());
@@ -144,11 +133,4 @@ private static void attest(ICoreAttestationService provider, Handler<AsyncResult
144133
PUBLIC_KEY.getBytes(StandardCharsets.UTF_8),
145134
handler);
146135
}
147-
148-
static Stream<Arguments> argumentProvider() {
149-
return Stream.of(
150-
Arguments.of(MaaTokenPayload.AZURE_CC_ACI_PROTOCOL),
151-
Arguments.of(MaaTokenPayload.AZURE_CC_AKS_PROTOCOL)
152-
);
153-
}
154136
}

‎src/test/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidatorTest.java‎

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,17 @@
33
import com.uid2.shared.secure.AttestationException;
44
import com.uid2.shared.secure.TestClock;
55
import org.junit.jupiter.api.Disabled;
6-
import org.junit.jupiter.params.ParameterizedTest;
7-
import org.junit.jupiter.params.provider.Arguments;
8-
import org.junit.jupiter.params.provider.MethodSource;
9-
10-
import java.util.stream.Stream;
6+
import org.junit.jupiter.api.Test;
117

128
import static com.uid2.shared.secure.TestUtils.loadFromJson;
139
import static com.uid2.shared.secure.azurecc.MaaTokenUtils.validateAndParseToken;
1410
import static org.junit.jupiter.api.Assertions.assertEquals;
1511

1612
public class MaaTokenSignatureValidatorTest {
17-
@ParameterizedTest
18-
@MethodSource("argumentProvider")
19-
public void testPayload(String payloadPath, String protocol) throws Exception {
13+
@Test
14+
public void testPayload() throws Exception {
2015
// expire at 1695313895
16+
var payloadPath = "/com.uid2.shared/test/secure/azurecc/jwt_payload.json";
2117
var payload = loadFromJson(payloadPath);
2218
var clock = new TestClock();
2319
clock.setCurrentTimeMs(1695313893000L);
@@ -26,7 +22,7 @@ public void testPayload(String payloadPath, String protocol) throws Exception {
2622
var expectedLocation = "East US";
2723
var expectedPublicKey = "abc";
2824

29-
var tokenPayload = validateAndParseToken(payload, clock, protocol);
25+
var tokenPayload = validateAndParseToken(payload, clock);
3026
assertEquals(true, tokenPayload.isSevSnpVM());
3127
assertEquals(true, tokenPayload.isUtilityVMCompliant());
3228
assertEquals(false, tokenPayload.isVmDebuggable());
@@ -41,13 +37,6 @@ public void testE2E() throws AttestationException {
4137
var maaToken = "<Placeholder>";
4238
var maaServerUrl = "https://sharedeus.eus.attest.azure.net";
4339
var validator = new MaaTokenSignatureValidator(maaServerUrl);
44-
var token = validator.validate(maaToken, MaaTokenPayload.AZURE_CC_ACI_PROTOCOL);
45-
}
46-
47-
static Stream<Arguments> argumentProvider() {
48-
return Stream.of(
49-
Arguments.of("/com.uid2.shared/test/secure/azurecc/jwt_payload_aci.json", MaaTokenPayload.AZURE_CC_ACI_PROTOCOL),
50-
Arguments.of("/com.uid2.shared/test/secure/azurecc/jwt_payload_aks.json", MaaTokenPayload.AZURE_CC_AKS_PROTOCOL)
51-
);
40+
var token = validator.validate(maaToken);
5241
}
5342
}

‎src/test/java/com/uid2/shared/secure/azurecc/MaaTokenUtils.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
public class MaaTokenUtils {
1515
public static final String MAA_BASE_URL = "https://sharedeus.eus.attest.azure.net";
1616

17-
public static MaaTokenPayload validateAndParseToken(JsonObject payload, Clock clock, String protocol) throws Exception{
17+
public static MaaTokenPayload validateAndParseToken(JsonObject payload, Clock clock) throws Exception{
1818
var gen = KeyPairGenerator.getInstance(Const.Name.AsymetricEncryptionKeyClass);
1919
gen.initialize(2048, new SecureRandom());
2020
var keyPair = gen.generateKeyPair();
@@ -30,7 +30,7 @@ public static MaaTokenPayload validateAndParseToken(JsonObject payload, Clock cl
3030
var tokenVerifier = new MaaTokenSignatureValidator(MAA_BASE_URL, keyProvider, clock);
3131

3232
// validate token
33-
return tokenVerifier.validate(token, protocol);
33+
return tokenVerifier.validate(token);
3434
}
3535

3636
private static class MockKeyProvider implements IPublicKeyProvider {

‎src/test/java/com/uid2/shared/secure/azurecc/PolicyValidatorTest.java‎

Lines changed: 0 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,6 @@ private MaaTokenPayload generateBasicPayload() {
9797
.vmDebuggable(false)
9898
.runtimeData(generateBasicRuntimeData())
9999
.ccePolicyDigest(CCE_POLICY_DIGEST)
100-
.azureProtocol(MaaTokenPayload.AZURE_CC_ACI_PROTOCOL)
101100
.build();
102101
}
103102

@@ -126,53 +125,4 @@ public void testValidationFailure_DifferentAttestationUrl() {
126125
assertEquals(AttestationFailure.UNKNOWN_ATTESTATION_URL, ((AttestationClientException)t).getAttestationFailure());
127126

128127
}
129-
130-
@Test
131-
public void testValidationFailure_AzureCcWithOtherUvm() {
132-
var validator = new PolicyValidator(ATTESTATION_URL);
133-
var aksPayload = generateBasicPayload()
134-
.toBuilder()
135-
.complianceStatus("fake-compliance")
136-
.build();
137-
Throwable t = assertThrows(AttestationException.class, ()-> validator.validate(aksPayload, PUBLIC_KEY));
138-
assertEquals("Not run in Azure Compliance Utility VM", t.getMessage());
139-
assertEquals(AttestationFailure.BAD_FORMAT, ((AttestationClientException)t).getAttestationFailure());
140-
}
141-
142-
@Test
143-
public void testValidationSuccess_AksWithAzureSignedKataccUvm() throws AttestationClientException {
144-
var validator = new PolicyValidator(ATTESTATION_URL);
145-
var aksPayload = generateBasicPayload()
146-
.toBuilder()
147-
.complianceStatus("azure-signed-katacc-uvm")
148-
.azureProtocol(MaaTokenPayload.AZURE_CC_AKS_PROTOCOL)
149-
.build();
150-
var enclaveId = validator.validate(aksPayload, PUBLIC_KEY);
151-
assertEquals(CCE_POLICY_DIGEST, enclaveId);
152-
}
153-
154-
@Test
155-
public void testValidationFailure_AksWithOtherUvm() {
156-
var validator = new PolicyValidator(ATTESTATION_URL);
157-
var aksPayload = generateBasicPayload()
158-
.toBuilder()
159-
.complianceStatus("fake-compliance")
160-
.azureProtocol(MaaTokenPayload.AZURE_CC_AKS_PROTOCOL)
161-
.build();
162-
Throwable t = assertThrows(AttestationException.class, ()-> validator.validate(aksPayload, PUBLIC_KEY));
163-
assertEquals("Not run in Azure Compliance Utility VM", t.getMessage());
164-
assertEquals(AttestationFailure.BAD_FORMAT, ((AttestationClientException)t).getAttestationFailure());
165-
}
166-
167-
@Test
168-
public void testValidationFailure_InvalidProtocol() {
169-
var validator = new PolicyValidator(ATTESTATION_URL);
170-
var aksPayload = generateBasicPayload()
171-
.toBuilder()
172-
.azureProtocol("fake-protocol")
173-
.build();
174-
Throwable t = assertThrows(AttestationException.class, ()-> validator.validate(aksPayload, PUBLIC_KEY));
175-
assertEquals("Azure protocol: fake-protocol not supported", t.getMessage());
176-
assertEquals(AttestationFailure.INVALID_PROTOCOL, ((AttestationClientException)t).getAttestationFailure());
177-
}
178128
}

src/test/resources/com.uid2.shared/test/secure/azurecc/jwt_payload_aci.json renamed to src/test/resources/com.uid2.shared/test/secure/azurecc/jwt_payload.json

File renamed without changes.

0 commit comments

Comments
 (0)