|
| 1 | +pub use nitro_attestation_verify::{AttestationDocument, Unverified, NitroError as AttestationError}; |
| 2 | +use nsm_io::{ErrorCode, Response, Request}; |
| 3 | +pub use serde_bytes::ByteBuf; |
| 4 | + |
| 5 | +pub struct Nsm(i32); |
| 6 | + |
| 7 | +#[derive(Debug)] |
| 8 | +pub enum Error { |
| 9 | + AttestationError(AttestationError), |
| 10 | + BufferTooSmall, |
| 11 | + CannotOpenDriver, |
| 12 | + InputTooLarge, |
| 13 | + InternalError, |
| 14 | + InvalidArgument, |
| 15 | + InvalidOperation, |
| 16 | + InvalidPcrIndex, |
| 17 | + InvalidResponse, |
| 18 | + ReadOnlyPcrIndex, |
| 19 | +} |
| 20 | + |
| 21 | +impl std::fmt::Display for Error { |
| 22 | + fn fmt(&self, fmt: &mut std::fmt::Formatter) -> std::fmt::Result { |
| 23 | + match self { |
| 24 | + Error::AttestationError(ref msg) => write!(fmt, "Attestation error: {}", msg), |
| 25 | + Error::BufferTooSmall => write!(fmt, "Buffer too small"), |
| 26 | + Error::CannotOpenDriver => write!(fmt, "CannotOpenDriver"), |
| 27 | + Error::InputTooLarge => write!(fmt, "InputTooLarge"), |
| 28 | + Error::InternalError => write!(fmt, "InternalError"), |
| 29 | + Error::InvalidArgument => write!(fmt, "InvalidArgument"), |
| 30 | + Error::InvalidOperation => write!(fmt, "InvalidOperation"), |
| 31 | + Error::InvalidPcrIndex => write!(fmt, "InvalidPcrIndex"), |
| 32 | + Error::InvalidResponse => write!(fmt, "InvalidResponse"), |
| 33 | + Error::ReadOnlyPcrIndex => write!(fmt, "ReadOnlyPcrIndex"), |
| 34 | + } |
| 35 | + } |
| 36 | +} |
| 37 | + |
| 38 | +impl std::error::Error for Error { |
| 39 | + fn description(&self) -> &str { |
| 40 | + match self { |
| 41 | + Error::AttestationError(_e) => "Attestation error", |
| 42 | + Error::BufferTooSmall => "Provided output buffer too small", |
| 43 | + Error::CannotOpenDriver => "Failed to open driver", |
| 44 | + Error::InputTooLarge => "User-provided input is too large", |
| 45 | + Error::InternalError => "NitroSecureModule cannot fulfill request due to internal error", |
| 46 | + Error::InvalidArgument => "Invalid input argument", |
| 47 | + Error::InvalidOperation => "Request cannot be fulfilled due to missing capabilities", |
| 48 | + Error::InvalidPcrIndex => "Platform Configuration Register index out of bounds", |
| 49 | + Error::InvalidResponse => "The received response does not correspond to the earlier request", |
| 50 | + Error::ReadOnlyPcrIndex => "Platform Configuration Register is in read-only mode and the operation attempted to modify it", |
| 51 | + } |
| 52 | + } |
| 53 | +} |
| 54 | + |
| 55 | +impl From<AttestationError> for Error { |
| 56 | + fn from(e: AttestationError) -> Self { |
| 57 | + Error::AttestationError(e) |
| 58 | + } |
| 59 | +} |
| 60 | + |
| 61 | +impl From<ErrorCode> for Error { |
| 62 | + fn from(e: ErrorCode) -> Self { |
| 63 | + match e { |
| 64 | + ErrorCode::InvalidArgument => Error::InvalidArgument, |
| 65 | + ErrorCode::InvalidIndex => Error::InvalidPcrIndex, |
| 66 | + ErrorCode::InvalidResponse => Error::InvalidResponse, |
| 67 | + ErrorCode::ReadOnlyIndex => Error::ReadOnlyPcrIndex, |
| 68 | + ErrorCode::InvalidOperation => Error::InvalidOperation, |
| 69 | + ErrorCode::BufferTooSmall => Error::BufferTooSmall, |
| 70 | + ErrorCode::InputTooLarge => Error::InputTooLarge, |
| 71 | + ErrorCode::InternalError => Error::InternalError, |
| 72 | + ErrorCode::Success => Error::InvalidResponse, |
| 73 | + } |
| 74 | + } |
| 75 | +} |
| 76 | + |
| 77 | +impl Nsm { |
| 78 | + pub fn new() -> Result<Self, Error> { |
| 79 | + let fd = nsm_driver::nsm_init(); |
| 80 | + |
| 81 | + if fd < 0 { |
| 82 | + Err(Error::CannotOpenDriver) |
| 83 | + } else { |
| 84 | + Ok(Nsm(fd)) |
| 85 | + } |
| 86 | + } |
| 87 | + |
| 88 | + pub fn attest(&mut self, user_data: Option<ByteBuf>, nonce: Option<ByteBuf>, public_key: Option<ByteBuf>) -> Result<AttestationDocument<Unverified>, Error> { |
| 89 | + let req = Request::Attestation { |
| 90 | + user_data, |
| 91 | + nonce, |
| 92 | + public_key, |
| 93 | + }; |
| 94 | + match nsm_driver::nsm_process_request(self.0, req) { |
| 95 | + Response::Attestation { document } => Ok(AttestationDocument::from_slice(document.as_slice())?), |
| 96 | + Response::Error(code) => Err(code.into()), |
| 97 | + _ => Err(Error::InvalidResponse), |
| 98 | + } |
| 99 | + } |
| 100 | +} |
| 101 | + |
| 102 | +impl Drop for Nsm { |
| 103 | + fn drop(&mut self) { |
| 104 | + nsm_driver::nsm_exit(self.0); |
| 105 | + } |
| 106 | +} |
0 commit comments