Skip to content

Commit 27d93d5

Browse files
cYKatherinecYKatherine
committed
Add paraent class for AzureCCCoreAttestationService 
1 parent 4c93129 commit 27d93d5

File tree

6 files changed

+135
-67
lines changed

6 files changed

+135
-67
lines changed

‎src/main/java/com/uid2/shared/secure/AzureCCAksCoreAttestationService.java‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package com.uid2.shared.secure;
2+
3+
import com.uid2.shared.Utils;
4+
import com.uid2.shared.secure.azurecc.IMaaTokenSignatureValidator;
5+
import com.uid2.shared.secure.azurecc.IPolicyValidator;
6+
import com.uid2.shared.secure.azurecc.MaaTokenSignatureValidator;
7+
import com.uid2.shared.secure.azurecc.PolicyValidator;
8+
import io.vertx.core.AsyncResult;
9+
import io.vertx.core.Future;
10+
import io.vertx.core.Handler;
11+
import lombok.extern.slf4j.Slf4j;
12+
13+
import java.nio.charset.StandardCharsets;
14+
import java.util.Collection;
15+
import java.util.HashSet;
16+
import java.util.Set;
17+
18+
// CC stands for Confidential Container
19+
@Slf4j
20+
public class AzureCCAksCoreAttestationService extends AzureCCCoreAttestationServiceBase {
21+
private static final String AZURE_CC_PROTOCOL = "azure-cc-aks";
22+
23+
public AzureCCAksCoreAttestationService(String maaServerBaseUrl, String attestationUrl) {
24+
super(new MaaTokenSignatureValidator(maaServerBaseUrl), new PolicyValidator(attestationUrl), AZURE_CC_PROTOCOL);
25+
}
26+
27+
// used in UT
28+
protected AzureCCAksCoreAttestationService(IMaaTokenSignatureValidator tokenSignatureValidator, IPolicyValidator policyValidator) {
29+
super(tokenSignatureValidator, policyValidator, AZURE_CC_PROTOCOL);
30+
}
31+
}

‎src/main/java/com/uid2/shared/secure/AzureCCCoreAttestationService.java‎

Lines changed: 4 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -17,74 +17,15 @@
1717

1818
// CC stands for Confidential Container
1919
@Slf4j
20-
public class AzureCCCoreAttestationService implements ICoreAttestationService {
21-
22-
private final Set<String> allowedEnclaveIds = new HashSet<>();
23-
24-
private final IMaaTokenSignatureValidator tokenSignatureValidator;
25-
26-
private final IPolicyValidator policyValidator;
20+
public class AzureCCCoreAttestationService extends AzureCCCoreAttestationServiceBase {
21+
private static final String AZURE_CC_PROTOCOL = "azure-cc";
2722

2823
public AzureCCCoreAttestationService(String maaServerBaseUrl, String attestationUrl) {
29-
this(new MaaTokenSignatureValidator(maaServerBaseUrl), new PolicyValidator(attestationUrl));
24+
super(new MaaTokenSignatureValidator(maaServerBaseUrl), new PolicyValidator(attestationUrl), AZURE_CC_PROTOCOL);
3025
}
3126

3227
// used in UT
3328
protected AzureCCCoreAttestationService(IMaaTokenSignatureValidator tokenSignatureValidator, IPolicyValidator policyValidator) {
34-
this.tokenSignatureValidator = tokenSignatureValidator;
35-
this.policyValidator = policyValidator;
36-
}
37-
38-
@Override
39-
public void attest(byte[] attestationRequest, byte[] publicKey, Handler<AsyncResult<AttestationResult>> handler) {
40-
try {
41-
var tokenString = new String(attestationRequest, StandardCharsets.US_ASCII);
42-
43-
log.debug("Validating signature...");
44-
var tokenPayload = tokenSignatureValidator.validate(tokenString);
45-
46-
log.debug("Validating policy...");
47-
var encodedPublicKey = Utils.toBase64String(publicKey);
48-
49-
var enclaveId = policyValidator.validate(tokenPayload, encodedPublicKey);
50-
51-
if (allowedEnclaveIds.contains(enclaveId)) {
52-
log.info("Successfully attested azure-cc against registered enclaves, enclave id: " + enclaveId);
53-
handler.handle(Future.succeededFuture(new AttestationResult(publicKey, enclaveId)));
54-
} else {
55-
log.warn("Got unsupported azure-cc enclave id: " + enclaveId);
56-
handler.handle(Future.succeededFuture(new AttestationResult(AttestationFailure.FORBIDDEN_ENCLAVE)));
57-
}
58-
}
59-
catch (AttestationClientException ace){
60-
handler.handle(Future.succeededFuture(new AttestationResult(ace)));
61-
} catch (AttestationException ae) {
62-
handler.handle(Future.failedFuture(ae));
63-
} catch (Exception ex) {
64-
handler.handle(Future.failedFuture(new AttestationException(ex)));
65-
}
66-
}
67-
68-
@Override
69-
public void registerEnclave(String encodedIdentifier) throws AttestationException {
70-
try {
71-
allowedEnclaveIds.add(encodedIdentifier);
72-
} catch (Exception e) {
73-
throw new AttestationException(e);
74-
}
75-
}
76-
77-
@Override
78-
public void unregisterEnclave(String encodedIdentifier) throws AttestationException {
79-
try {
80-
allowedEnclaveIds.remove(encodedIdentifier);
81-
} catch (Exception e) {
82-
throw new AttestationException(e);
83-
}
84-
}
85-
86-
@Override
87-
public Collection<String> getEnclaveAllowlist() {
88-
return allowedEnclaveIds;
29+
super(tokenSignatureValidator, policyValidator, AZURE_CC_PROTOCOL);
8930
}
9031
}

‎src/main/java/com/uid2/shared/secure/AzureCCCoreAttestationServiceBase.java‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
package com.uid2.shared.secure;
2+
3+
import com.uid2.shared.Utils;
4+
import com.uid2.shared.secure.azurecc.IMaaTokenSignatureValidator;
5+
import com.uid2.shared.secure.azurecc.IPolicyValidator;
6+
import com.uid2.shared.secure.azurecc.MaaTokenSignatureValidator;
7+
import com.uid2.shared.secure.azurecc.PolicyValidator;
8+
import io.vertx.core.AsyncResult;
9+
import io.vertx.core.Future;
10+
import io.vertx.core.Handler;
11+
import lombok.extern.slf4j.Slf4j;
12+
13+
import java.nio.charset.StandardCharsets;
14+
import java.util.Collection;
15+
import java.util.HashSet;
16+
import java.util.Set;
17+
18+
// CC stands for Confidential Container
19+
@Slf4j
20+
public abstract class AzureCCCoreAttestationServiceBase implements ICoreAttestationService {
21+
22+
protected final Set<String> allowedEnclaveIds = new HashSet<>();
23+
24+
protected final IMaaTokenSignatureValidator tokenSignatureValidator;
25+
26+
protected final IPolicyValidator policyValidator;
27+
28+
protected final String azureCcProtocol;
29+
30+
// used in UT
31+
protected AzureCCCoreAttestationServiceBase(IMaaTokenSignatureValidator tokenSignatureValidator, IPolicyValidator policyValidator, String azureCcProtocol) {
32+
this.tokenSignatureValidator = tokenSignatureValidator;
33+
this.policyValidator = policyValidator;
34+
this.azureCcProtocol = azureCcProtocol;
35+
}
36+
37+
public void attest(byte[] attestationRequest, byte[] publicKey, Handler<AsyncResult<AttestationResult>> handler) {
38+
try {
39+
var tokenString = new String(attestationRequest, StandardCharsets.US_ASCII);
40+
41+
log.debug("Validating signature...");
42+
var tokenPayload = tokenSignatureValidator.validate(tokenString, azureCcProtocol);
43+
44+
log.debug("Validating policy...");
45+
var encodedPublicKey = Utils.toBase64String(publicKey);
46+
47+
var enclaveId = policyValidator.validate(tokenPayload, encodedPublicKey);
48+
49+
if (allowedEnclaveIds.contains(enclaveId)) {
50+
log.info("Successfully attested azure-cc against registered enclaves, enclave id: " + enclaveId);
51+
handler.handle(Future.succeededFuture(new AttestationResult(publicKey, enclaveId)));
52+
} else {
53+
log.warn("Got unsupported azure-cc enclave id: " + enclaveId);
54+
handler.handle(Future.succeededFuture(new AttestationResult(AttestationFailure.FORBIDDEN_ENCLAVE)));
55+
}
56+
}
57+
catch (AttestationClientException ace){
58+
handler.handle(Future.succeededFuture(new AttestationResult(ace)));
59+
} catch (AttestationException ae) {
60+
handler.handle(Future.failedFuture(ae));
61+
} catch (Exception ex) {
62+
handler.handle(Future.failedFuture(new AttestationException(ex)));
63+
}
64+
};
65+
66+
public void registerEnclave(String encodedIdentifier) throws AttestationException {
67+
try {
68+
allowedEnclaveIds.add(encodedIdentifier);
69+
} catch (Exception e) {
70+
throw new AttestationException(e);
71+
}
72+
}
73+
74+
public void unregisterEnclave(String encodedIdentifier) throws AttestationException {
75+
try {
76+
allowedEnclaveIds.remove(encodedIdentifier);
77+
} catch (Exception e) {
78+
throw new AttestationException(e);
79+
}
80+
}
81+
82+
public Collection<String> getEnclaveAllowlist() {
83+
return allowedEnclaveIds;
84+
}
85+
}

‎src/main/java/com/uid2/shared/secure/azurecc/IMaaTokenSignatureValidator.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ public interface IMaaTokenSignatureValidator {
1010
* @return Parsed token payload.
1111
* @throws AttestationException
1212
*/
13-
MaaTokenPayload validate(String tokenString) throws AttestationException;
13+
MaaTokenPayload validate(String tokenString, String protocol) throws AttestationException;
1414
}

‎src/main/java/com/uid2/shared/secure/azurecc/MaaTokenPayload.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
@Builder(toBuilder = true)
88
public class MaaTokenPayload {
99
public static final String SEV_SNP_VM_TYPE = "sevsnpvm";
10-
public static final String AZURE_COMPLIANT_UVM = "azure-compliant-uvm";
1110

11+
private String azure_compliant_uvm;
1212
private String attestationType;
1313
private String complianceStatus;
1414
private boolean vmDebuggable;
@@ -21,6 +21,6 @@ public boolean isSevSnpVM(){
2121
}
2222

2323
public boolean isUtilityVMCompliant(){
24-
return AZURE_COMPLIANT_UVM.equalsIgnoreCase(complianceStatus);
24+
return azure_compliant_uvm.equalsIgnoreCase(complianceStatus);
2525
}
2626
}

‎src/main/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidator.java‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@
1515
import static com.uid2.shared.secure.JwtUtils.tryGetField;
1616

1717
public class MaaTokenSignatureValidator implements IMaaTokenSignatureValidator {
18+
// the `x-ms-compliance-status` value for ACI CC
19+
public static final String AZURE_COMPLIANT_UVM = "azure-compliant-uvm";
20+
21+
// the `x-ms-compliance-status` value for AKS CC
22+
public static final String AZURE_COMPLIANT_UVM_AKS = "azure-signed-katacc-uvm";
1823

1924
// set to true to facilitate local test.
2025
public static final boolean BYPASS_SIGNATURE_CHECK = false;
@@ -52,7 +57,7 @@ private TokenVerifier buildTokenVerifier(String kid) throws AttestationException
5257
}
5358

5459
@Override
55-
public MaaTokenPayload validate(String tokenString) throws AttestationException {
60+
public MaaTokenPayload validate(String tokenString, String protocol) throws AttestationException {
5661
if (Strings.isNullOrEmpty(tokenString)) {
5762
throw new IllegalArgumentException("tokenString can not be null or empty");
5863
}
@@ -77,6 +82,12 @@ public MaaTokenPayload validate(String tokenString) throws AttestationException
7782

7883
var tokenPayloadBuilder = MaaTokenPayload.builder();
7984

85+
if (protocol == "azure-cc") {
86+
tokenPayloadBuilder.azure_compliant_uvm(AZURE_COMPLIANT_UVM);
87+
} else if(protocol == "azure-cc-aks") {
88+
tokenPayloadBuilder.azure_compliant_uvm(AZURE_COMPLIANT_UVM_AKS);
89+
}
90+
8091
tokenPayloadBuilder.attestationType(tryGetField(rawPayload, "x-ms-attestation-type", String.class));
8192
tokenPayloadBuilder.complianceStatus(tryGetField(rawPayload, "x-ms-compliance-status", String.class));
8293
tokenPayloadBuilder.vmDebuggable(tryGetField(rawPayload, "x-ms-sevsnpvm-is-debuggable", Boolean.class));

0 commit comments

Comments
 (0)