optionally verify TcbEvaluationDataNumber

Signed-off-by: Markus Rudy <mr@edgeless.systems>

Author: burgerdev

pcs/pcs.go

@@ -521,6 +521,11 @@ func TcbInfoURL(fmspc string) string {
 	return fmt.Sprintf("%s/tcb?fmspc=%s", TdxBaseURL, fmspc)
 }
 
+// TcbInfoURLWithEvaluationDataNumber returns the Intel PCS URL for retrieving TCB Info at a specific evaluationDataNumber.
+func TcbInfoURLWithEvaluationDataNumber(fmspc string, evaluationDataNumber int) string {
+	return fmt.Sprintf("%s/tcb?fmspc=%s&tcbEvaluationDataNumber=%d", TdxBaseURL, fmspc, evaluationDataNumber)
+}
+
 // QeIdentityURL returns the Intel PCS URL for retrieving QE identity
 func QeIdentityURL() string {
 	return fmt.Sprintf("%s/qe/identity", TdxBaseURL)

testing/test_cases.go

@@ -58,6 +58,10 @@ var TestGetter = &Getter{
 			Header: TcbInfoHeader,
 			Body:   testdata.TcbInfoBody,
 		},
+		"https://api.trustedservices.intel.com/tdx/certification/v4/tcb?fmspc=50806f000000&tcbEvaluationDataNumber=255": {
+			Header: TcbInfoHeader,
+			Body:   testdata.TcbInfoBody,
+		},
 		"https://api.trustedservices.intel.com/sgx/certification/v4/pckcrl?ca=platform&encoding=der": {
 			Header: PckCrlHeader,
 			Body:   testdata.PckCrlBody,

verify/verify.go

@@ -191,6 +191,11 @@ type Options struct {
 	// If nil, embedded certificate will be used
 	TrustedRoots *x509.CertPool
 
+	// EvaluationDataNumber for TCB info that should be requested from PCS.
+	// If this is non-zero and verification succeeds, the TCB info was at EvaluationDataNumber or newer.
+	// If GetCollateral is false, the TCBInfo will not be fetched and thus the number is not checked.
+	EvaluationDataNumber int
+
 	chain             *PCKCertificateChain
 	collateral        *Collateral
 	pckCertExtensions *pcs.PckExtensions
@@ -391,11 +396,15 @@ func getPckCrl(ctx context.Context, ca string, getter trust.HTTPSGetter, collate
 	return nil
 }
 
-func getTcbInfo(ctx context.Context, fmspc string, getter trust.HTTPSGetter, collateral *Collateral) error {
+func getTcbInfo(ctx context.Context, fmspc string, getter trust.HTTPSGetter, collateral *Collateral, evaluationDataNumber int) error {
 	tcbInfoURL := pcs.TcbInfoURL(fmspc)
+	if evaluationDataNumber > 0 {
+		tcbInfoURL = pcs.TcbInfoURLTcbInfoURLWithEvaluationDataNumber(fmspc, evaluationDataNumber)
+	}
 	logger.V(2).Info("Getting TCB Info: ", tcbInfoURL)
 	header, body, err := trust.GetWith(ctx, getter, tcbInfoURL)
 	if err != nil {
+		// TODO(burgerdev): 410 means evaluationDataNumber is too old, but the HTTPSGetter interface does not allow inspection of the return code.
 		return &trust.AttestationRecreationErr{
 			Msg: fmt.Sprintf("could not receive tcbInfo response: %v", err),
 		}
@@ -417,6 +426,17 @@ func getTcbInfo(ctx context.Context, fmspc string, getter trust.HTTPSGetter, col
 		}
 	}
 
+	// According to the docs [1], if we explicitly requested an evaluation number and the request
+	// succeeded, the response should contain exactly that number. If there's a mismatch, we're
+	// either dealing with a non-compliant PCS or being MITM'd.
+	//
+	// [1]: https://api.portal.trustedservices.intel.com/content/documentation.html#pcs-tcb-info-tdx-v4
+	if evaluationDataNumber > 0 && collateral.TdxTcbInfo.TcbInfo.TcbEvaluationDataNumber < evaluationDataNumber {
+		return &trust.AttestationRecreationErr{
+			Msg: fmt.Sprintf("PCS responded with an outdated TcbEvaluationDataNumber (got %d, requested %d)", collateral.TdxTcbInfo.TcbInfo.TcbEvaluationDataNumber, evaluationDataNumber),
+		}
+	}
+
 	tcbInfoRawBody, err := bodyToRawMessage(tcbInfoPhrase, body)
 	if err != nil {
 		return &trust.AttestationRecreationErr{
@@ -494,7 +514,7 @@ func obtainCollateral(ctx context.Context, fmspc string, ca string, options *Opt
 	}
 	collateral := &Collateral{}
 	logger.V(1).Info("Getting TCB Info API response from the Intel PCS")
-	if err := getTcbInfo(ctx, fmspc, getter, collateral); err != nil {
+	if err := getTcbInfo(ctx, fmspc, getter, collateral, options.EvaluationDataNumber); err != nil {
 		return nil, fmt.Errorf("unable to receive tcbInfo: %v", err)
 	}
 	logger.V(1).Info("Successfully received TCB Info API response from the Intel PCS")

verify/verify_test.go

@@ -397,11 +397,27 @@ func TestGetTcbInfo(t *testing.T) {
 	fmspc := hex.EncodeToString(fmspcBytes)
 
 	collateral := &Collateral{}
-	if err := getTcbInfo(context.Background(), fmspc, getter, collateral); err != nil {
+	if err := getTcbInfo(context.Background(), fmspc, getter, collateral, 0); err != nil {
 		t.Error(err)
 	}
 }
 
+func TestGetTcbInfoOutdatedTcbEvalutationDataNumber(t *testing.T) {
+	getter := testcases.TestGetter
+	fmspcBytes := []byte{80, 128, 111, 0, 0, 0}
+	fmspc := hex.EncodeToString(fmspcBytes)
+
+	collateral := &Collateral{}
+
+	err := getTcbInfo(context.Background(), fmspc, getter, collateral, 255)
+	if err == nil {
+		t.Fatal("expected an error when PCS returns outdated TcbEvalutationDataNumber")
+	}
+	if !strings.Contains(err.Error(), "outdated TcbEvaluationDataNumber") {
+		t.Fatalf("unexpected error when PCS returns outdated TcbEvalutationDataNumber: %v", err)
+	}
+}
+
 func TestGetQeIdentity(t *testing.T) {
 	getter := testcases.TestGetter
 	collateral := &Collateral{}
@@ -492,7 +508,7 @@ func TestVerifyUsingTcbInfoV4(t *testing.T) {
 	fmspc := hex.EncodeToString(fmspcBytes)
 
 	collateral := &Collateral{}
-	if err := getTcbInfo(context.Background(), fmspc, getter, collateral); err != nil {
+	if err := getTcbInfo(context.Background(), fmspc, getter, collateral, 0); err != nil {
 		t.Fatal(err)
 	}
 	anyQuote, err := abi.QuoteToProto(testdata.RawQuote)
@@ -542,7 +558,7 @@ func TestNegativeVerifyUsingTcbInfoV4(t *testing.T) {
 	fmspc := hex.EncodeToString(fmspcBytes)
 
 	collateral := &Collateral{}
-	if err := getTcbInfo(context.Background(), fmspc, getter, collateral); err != nil {
+	if err := getTcbInfo(context.Background(), fmspc, getter, collateral, 0); err != nil {
 		t.Fatal(err)
 	}
 	anyQuote, err := abi.QuoteToProto(testdata.RawQuote)
@@ -675,7 +691,7 @@ func TestNegativeTcbInfoTcbStatusV4(t *testing.T) {
 	fmspc := hex.EncodeToString(fmspcBytes)
 
 	collateral := &Collateral{}
-	if err := getTcbInfo(context.Background(), fmspc, getter, collateral); err != nil {
+	if err := getTcbInfo(context.Background(), fmspc, getter, collateral, 0); err != nil {
 		t.Fatal(err)
 	}
 	anyQuote, err := abi.QuoteToProto(testdata.RawQuote)