@super-protocol/addons-tee 0.9.10 → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bindings/nvidia-native/README.md +174 -0
- package/bindings/nvidia-native/package.json +26 -0
- package/bindings/nvidia-native/postinstall.js +40 -0
- package/dist/index.d.ts +1 -1
- package/dist/index.js +1 -28
- package/package.json +4 -2
- package/.editorconfig +0 -15
- package/.eslintrc.json +0 -61
- package/.prettierignore +0 -3
- package/.prettierrc +0 -15
- package/bindings/amd-sev-snp-napi-rs/amd-sev-snp-napi-rs.linux-x64-gnu.node +0 -0
- package/bindings/amd-sev-snp-napi-rs/index.d.ts +0 -51
- package/bindings/amd-sev-snp-napi-rs/index.js +0 -339
- package/bindings/amd-sev-snp-napi-rs/package-lock.json +0 -40
- package/bindings/sgx-native/build/Release/libmbedcrypto_gramine.so.15 +0 -0
- package/bindings/sgx-native/build/Release/libmbedx509_gramine.so.6 +0 -0
- package/bindings/sgx-native/build/Release/libsgx_dcap_quoteverify.so.1 +0 -0
- package/bindings/sgx-native/build/Release/libtdx_attest.so.1 +0 -0
- package/bindings/sgx-native/build/Release/sgx_native.node +0 -0
- package/bindings/sgx-native/package-lock.json +0 -23
- package/bindings/sp-sev/.github/auto_assign-issues.yml +0 -5
- package/bindings/sp-sev/.github/auto_assign.yml +0 -21
- package/bindings/sp-sev/.github/dependabot.yml +0 -6
- package/bindings/sp-sev/.github/workflows/dco.yml +0 -10
- package/bindings/sp-sev/.github/workflows/lint.yml +0 -56
- package/bindings/sp-sev/.github/workflows/test.yml +0 -215
- package/bindings/sp-sev/.rustfmt.toml +0 -2
- package/bindings/sp-sev/CODEOWNERS +0 -1
- package/bindings/sp-sev/Cargo.lock +0 -2461
- package/bindings/sp-sev/Cargo.toml +0 -80
- package/bindings/sp-sev/LICENSE +0 -201
- package/bindings/sp-sev/README.md +0 -82
- package/bindings/sp-sev/build.rs +0 -17
- package/bindings/sp-sev/docs/attestation/README.md +0 -239
- package/bindings/sp-sev/docs/attestation/certchain.dot +0 -14
- package/bindings/sp-sev/docs/attestation/certchain.dot.png +0 -0
- package/bindings/sp-sev/docs/attestation/prerequisites.md +0 -6
- package/bindings/sp-sev/docs/attestation/process.msc +0 -60
- package/bindings/sp-sev/docs/attestation/process.msc.png +0 -0
- package/bindings/sp-sev/docs/attestation/protections.md +0 -53
- package/bindings/sp-sev/package-version.py +0 -11
- package/bindings/sp-sev/tests/api.rs +0 -194
- package/bindings/sp-sev/tests/certs.rs +0 -142
- package/bindings/sp-sev/tests/certs_data/cert_chain_milan +0 -74
- package/bindings/sp-sev/tests/certs_data/cert_chain_turin +0 -74
- package/bindings/sp-sev/tests/certs_data/report_milan.hex +0 -1
- package/bindings/sp-sev/tests/certs_data/vcek_milan.der +0 -0
- package/bindings/sp-sev/tests/certs_data/vcek_turin.der +0 -0
- package/bindings/sp-sev/tests/guest.rs +0 -57
- package/bindings/sp-sev/tests/id-block.rs +0 -172
- package/bindings/sp-sev/tests/measurement/ovmf_AmdSev_suffix.bin +0 -0
- package/bindings/sp-sev/tests/measurement/ovmf_OvmfX64_suffix.bin +0 -0
- package/bindings/sp-sev/tests/measurement/test_auth_block.bin +0 -0
- package/bindings/sp-sev/tests/measurement/test_auth_key.pem +0 -6
- package/bindings/sp-sev/tests/measurement/test_auth_sig.bin +0 -0
- package/bindings/sp-sev/tests/measurement/test_id_key.pem +0 -6
- package/bindings/sp-sev/tests/measurement/test_id_sig.bin +0 -0
- package/bindings/sp-sev/tests/measurement.rs +0 -510
- package/bindings/sp-sev/tests/naples/ark.cert.bad +0 -0
- package/bindings/sp-sev/tests/naples/ark.cert.sig +0 -0
- package/bindings/sp-sev/tests/naples/ark.rs +0 -38
- package/bindings/sp-sev/tests/naples/ask.rs +0 -29
- package/bindings/sp-sev/tests/naples/cek.cert +0 -0
- package/bindings/sp-sev/tests/naples/cek.rs +0 -30
- package/bindings/sp-sev/tests/naples/mod.rs +0 -20
- package/bindings/sp-sev/tests/naples/oca.cert +0 -0
- package/bindings/sp-sev/tests/naples/oca.rs +0 -45
- package/bindings/sp-sev/tests/naples/pdh.cert +0 -0
- package/bindings/sp-sev/tests/naples/pdh.rs +0 -28
- package/bindings/sp-sev/tests/naples/pek.cert +0 -0
- package/bindings/sp-sev/tests/naples/pek.rs +0 -32
- package/bindings/sp-sev/tests/rome/ark.rs +0 -33
- package/bindings/sp-sev/tests/rome/ask.rs +0 -29
- package/bindings/sp-sev/tests/rome/cek.cert +0 -0
- package/bindings/sp-sev/tests/rome/cek.rs +0 -29
- package/bindings/sp-sev/tests/rome/mod.rs +0 -16
- package/bindings/sp-sev/tests/rome/oca.cert +0 -0
- package/bindings/sp-sev/tests/rome/oca.rs +0 -45
- package/bindings/sp-sev/tests/rome/pdh.cert +0 -0
- package/bindings/sp-sev/tests/rome/pdh.rs +0 -28
- package/bindings/sp-sev/tests/rome/pek.cert +0 -0
- package/bindings/sp-sev/tests/rome/pek.rs +0 -32
- package/bindings/sp-sev/tests/session.rs +0 -39
- package/bindings/sp-sev/tests/sev_launch.rs +0 -120
- package/bindings/sp-sev/tests/snp_launch.rs +0 -108
- package/bindings/utils/virtee/LICENSE +0 -201
- package/bindings/utils/virtee/libsev.so +0 -0
- package/bindings/utils/virtee/snpguest +0 -0
- package/dist/proto/AmdSevSnp.d.ts +0 -194
- package/dist/proto/AmdSevSnp.js +0 -363
- package/dist/sgx-native-module/consts.d.ts +0 -24
- package/dist/sgx-native-module/consts.js +0 -38
- package/dist/sgx-native-module/dcap-quote-verify.service.d.ts +0 -12
- package/dist/sgx-native-module/dcap-quote-verify.service.js +0 -84
- package/dist/sgx-native-module/enclave.service.d.ts +0 -93
- package/dist/sgx-native-module/enclave.service.js +0 -211
- package/dist/sgx-native-module/errors.d.ts +0 -19
- package/dist/sgx-native-module/errors.js +0 -69
- package/dist/sgx-native-module/helpers.d.ts +0 -1
- package/dist/sgx-native-module/helpers.js +0 -50
- package/dist/sgx-native-module/index.d.ts +0 -9
- package/dist/sgx-native-module/index.js +0 -26
- package/dist/sgx-native-module/pki.service.d.ts +0 -52
- package/dist/sgx-native-module/pki.service.js +0 -89
- package/dist/sgx-native-module/sev-snp-mrenclave.d.ts +0 -59
- package/dist/sgx-native-module/sev-snp-mrenclave.js +0 -323
- package/dist/sgx-native-module/sev-snp-schema.d.ts +0 -22
- package/dist/sgx-native-module/sev-snp-schema.js +0 -24
- package/dist/sgx-native-module/sev-snp.d.ts +0 -126
- package/dist/sgx-native-module/sev-snp.js +0 -491
- package/dto/src/AmdSevSnp.proto +0 -31
- package/dto/src/Compression.proto +0 -11
- package/dto/src/Hash.proto +0 -6
- package/dto/src/OrderReport.proto +0 -21
- package/dto/src/TRI.proto +0 -22
- package/dto/src/TeeDeviceInfo.proto +0 -46
|
@@ -1,510 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
-
|
|
3
|
-
#![cfg(feature = "openssl")]
|
|
4
|
-
|
|
5
|
-
#[cfg(all(target_os = "linux", feature = "snp"))]
|
|
6
|
-
mod snp_tests {
|
|
7
|
-
use sev::measurement::{
|
|
8
|
-
snp::*,
|
|
9
|
-
vcpu_types::CpuType,
|
|
10
|
-
vmsa::{GuestFeatures, VMMType},
|
|
11
|
-
};
|
|
12
|
-
|
|
13
|
-
// Test if we can compute a full LD from a pre generated hash using snp only kernel
|
|
14
|
-
#[test]
|
|
15
|
-
fn test_snp_ovmf_hash_gen_snp_only() {
|
|
16
|
-
let ovmf_hash = "086e2e9149ebf45abdc3445fba5b2da8270bdbb04094d7a2c37faaa4b24af3aa16aff8c374c2a55c467a50da6d466b74";
|
|
17
|
-
|
|
18
|
-
let arguments = SnpMeasurementArgs {
|
|
19
|
-
vcpus: 1,
|
|
20
|
-
vcpu_type: CpuType::EpycV4,
|
|
21
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
22
|
-
guest_features: GuestFeatures(0x1),
|
|
23
|
-
kernel_file: Some("/dev/null".into()),
|
|
24
|
-
initrd_file: Some("/dev/null".into()),
|
|
25
|
-
append: None,
|
|
26
|
-
ovmf_hash_str: Some(ovmf_hash),
|
|
27
|
-
vmm_type: Some(VMMType::QEMU),
|
|
28
|
-
};
|
|
29
|
-
|
|
30
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
31
|
-
|
|
32
|
-
let exp_result = "ddc5224521617a536ee7ce9dd6224d1b58a8d4fda1c741f3ac99fc4bfa04ba6e9fc98646d4a07a9079397fa3852819b5";
|
|
33
|
-
|
|
34
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
35
|
-
}
|
|
36
|
-
|
|
37
|
-
// Test if we can compute a full LD from a pre generated hash using the default kernel setting
|
|
38
|
-
#[test]
|
|
39
|
-
fn test_snp_ovmf_hash_gen_default() {
|
|
40
|
-
let ovmf_hash = "086e2e9149ebf45abdc3445fba5b2da8270bdbb04094d7a2c37faaa4b24af3aa16aff8c374c2a55c467a50da6d466b74";
|
|
41
|
-
|
|
42
|
-
let arguments = SnpMeasurementArgs {
|
|
43
|
-
vcpus: 1,
|
|
44
|
-
vcpu_type: CpuType::EpycV4,
|
|
45
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
46
|
-
guest_features: GuestFeatures(0x21),
|
|
47
|
-
kernel_file: Some("/dev/null".into()),
|
|
48
|
-
initrd_file: Some("/dev/null".into()),
|
|
49
|
-
append: None,
|
|
50
|
-
ovmf_hash_str: Some(ovmf_hash),
|
|
51
|
-
vmm_type: Some(VMMType::QEMU),
|
|
52
|
-
};
|
|
53
|
-
|
|
54
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
55
|
-
|
|
56
|
-
let exp_result = "329c8ce0972ae52343b64d34a434a86f245dfd74f5ed7aae15d22efc78fb9683632b9b50e4e1d7fa41179ef98a7ef198";
|
|
57
|
-
|
|
58
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
59
|
-
}
|
|
60
|
-
|
|
61
|
-
// Test if we can compute a full LD from the OVMF hash usin snp only kernel
|
|
62
|
-
#[test]
|
|
63
|
-
fn test_snp_ovmf_hash_full_snp_only() {
|
|
64
|
-
let ovmf_hash = calc_snp_ovmf_hash("./tests/measurement/ovmf_AmdSev_suffix.bin".into())
|
|
65
|
-
.unwrap()
|
|
66
|
-
.get_hex_ld();
|
|
67
|
-
|
|
68
|
-
let exp_hash = "086e2e9149ebf45abdc3445fba5b2da8270bdbb04094d7a2c37faaa4b24af3aa16aff8c374c2a55c467a50da6d466b74";
|
|
69
|
-
|
|
70
|
-
assert_eq!(ovmf_hash.as_str(), exp_hash);
|
|
71
|
-
|
|
72
|
-
let arguments = SnpMeasurementArgs {
|
|
73
|
-
vcpus: 1,
|
|
74
|
-
vcpu_type: CpuType::EpycV4,
|
|
75
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
76
|
-
guest_features: GuestFeatures(0x1),
|
|
77
|
-
kernel_file: Some("/dev/null".into()),
|
|
78
|
-
initrd_file: Some("/dev/null".into()),
|
|
79
|
-
append: Some("console=ttyS0 loglevel=7"),
|
|
80
|
-
ovmf_hash_str: Some(ovmf_hash.as_str()),
|
|
81
|
-
vmm_type: None,
|
|
82
|
-
};
|
|
83
|
-
|
|
84
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
85
|
-
|
|
86
|
-
let exp_result = "6d287813eb5222d770f75005c664e34c204f385ce832cc2ce7d0d6f354454362f390ef83a92046c042e706363b4b08fa";
|
|
87
|
-
|
|
88
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
89
|
-
}
|
|
90
|
-
|
|
91
|
-
// Test if we can compute a full LD from the OVMF hash using default kernel
|
|
92
|
-
#[test]
|
|
93
|
-
fn test_snp_ovmf_hash_full_default() {
|
|
94
|
-
let ovmf_hash = calc_snp_ovmf_hash("./tests/measurement/ovmf_AmdSev_suffix.bin".into())
|
|
95
|
-
.unwrap()
|
|
96
|
-
.get_hex_ld();
|
|
97
|
-
|
|
98
|
-
let exp_hash = "086e2e9149ebf45abdc3445fba5b2da8270bdbb04094d7a2c37faaa4b24af3aa16aff8c374c2a55c467a50da6d466b74";
|
|
99
|
-
|
|
100
|
-
assert_eq!(ovmf_hash.as_str(), exp_hash);
|
|
101
|
-
|
|
102
|
-
let arguments = SnpMeasurementArgs {
|
|
103
|
-
vcpus: 1,
|
|
104
|
-
vcpu_type: CpuType::EpycV4,
|
|
105
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
106
|
-
guest_features: GuestFeatures(0x21),
|
|
107
|
-
kernel_file: Some("/dev/null".into()),
|
|
108
|
-
initrd_file: Some("/dev/null".into()),
|
|
109
|
-
append: Some("console=ttyS0 loglevel=7"),
|
|
110
|
-
ovmf_hash_str: Some(ovmf_hash.as_str()),
|
|
111
|
-
vmm_type: None,
|
|
112
|
-
};
|
|
113
|
-
|
|
114
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
115
|
-
|
|
116
|
-
let exp_result = "803f691094946e42068aaa3a8f9e26a5c89f36f7b73ecfb28c653360fe4b3aba7e534442e7e1e17895dfe778d0228977";
|
|
117
|
-
|
|
118
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
119
|
-
}
|
|
120
|
-
|
|
121
|
-
// Test EC2 vmm type with SNP only kernel
|
|
122
|
-
#[test]
|
|
123
|
-
fn test_snp_ec2_snp_only() {
|
|
124
|
-
let arguments = SnpMeasurementArgs {
|
|
125
|
-
vcpus: 1,
|
|
126
|
-
vcpu_type: CpuType::EpycV4,
|
|
127
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
128
|
-
guest_features: GuestFeatures(0x1),
|
|
129
|
-
kernel_file: Some("/dev/null".into()),
|
|
130
|
-
initrd_file: Some("/dev/null".into()),
|
|
131
|
-
append: None,
|
|
132
|
-
ovmf_hash_str: None,
|
|
133
|
-
vmm_type: Some(VMMType::EC2),
|
|
134
|
-
};
|
|
135
|
-
|
|
136
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
137
|
-
|
|
138
|
-
let exp_result = "7d3756157c805bf6adf617064c8552e8c1688fa1c8756f11cbf56ba5d25c9270fb69c0505c1cbe1c5c66c0e34c6ed3be";
|
|
139
|
-
|
|
140
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
141
|
-
}
|
|
142
|
-
|
|
143
|
-
// Test EC2 vmm type with default kernel
|
|
144
|
-
#[test]
|
|
145
|
-
fn test_snp_ec2_default() {
|
|
146
|
-
let arguments = SnpMeasurementArgs {
|
|
147
|
-
vcpus: 1,
|
|
148
|
-
vcpu_type: CpuType::EpycV4,
|
|
149
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
150
|
-
guest_features: GuestFeatures(0x21),
|
|
151
|
-
kernel_file: Some("/dev/null".into()),
|
|
152
|
-
initrd_file: Some("/dev/null".into()),
|
|
153
|
-
append: None,
|
|
154
|
-
ovmf_hash_str: None,
|
|
155
|
-
vmm_type: Some(VMMType::EC2),
|
|
156
|
-
};
|
|
157
|
-
|
|
158
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
159
|
-
|
|
160
|
-
let exp_result = "6ae80856486b1396af8c82a40351d6ed76a20c785e9c7fa4ffa27c22d5d6313b4b3b458cd3c9968e6f89fb5d8450d7a6";
|
|
161
|
-
|
|
162
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
163
|
-
}
|
|
164
|
-
|
|
165
|
-
// Test a regular snp type with snp only kernel
|
|
166
|
-
#[test]
|
|
167
|
-
fn test_sev_snp_only() {
|
|
168
|
-
let arguments = SnpMeasurementArgs {
|
|
169
|
-
vcpus: 1,
|
|
170
|
-
vcpu_type: CpuType::EpycV4,
|
|
171
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
172
|
-
guest_features: GuestFeatures(0x1),
|
|
173
|
-
kernel_file: Some("/dev/null".into()),
|
|
174
|
-
initrd_file: Some("/dev/null".into()),
|
|
175
|
-
append: Some("console=ttyS0 loglevel=7"),
|
|
176
|
-
ovmf_hash_str: None,
|
|
177
|
-
vmm_type: None,
|
|
178
|
-
};
|
|
179
|
-
|
|
180
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
181
|
-
|
|
182
|
-
let exp_result = "6d287813eb5222d770f75005c664e34c204f385ce832cc2ce7d0d6f354454362f390ef83a92046c042e706363b4b08fa";
|
|
183
|
-
|
|
184
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
185
|
-
}
|
|
186
|
-
|
|
187
|
-
// Test a regular snp type with default kernel
|
|
188
|
-
#[test]
|
|
189
|
-
fn test_snp_default() {
|
|
190
|
-
let arguments = SnpMeasurementArgs {
|
|
191
|
-
vcpus: 1,
|
|
192
|
-
vcpu_type: CpuType::EpycV4,
|
|
193
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
194
|
-
guest_features: GuestFeatures(0x21),
|
|
195
|
-
kernel_file: Some("/dev/null".into()),
|
|
196
|
-
initrd_file: Some("/dev/null".into()),
|
|
197
|
-
append: Some("console=ttyS0 loglevel=7"),
|
|
198
|
-
ovmf_hash_str: None,
|
|
199
|
-
vmm_type: None,
|
|
200
|
-
};
|
|
201
|
-
|
|
202
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
203
|
-
|
|
204
|
-
let exp_result = "803f691094946e42068aaa3a8f9e26a5c89f36f7b73ecfb28c653360fe4b3aba7e534442e7e1e17895dfe778d0228977";
|
|
205
|
-
|
|
206
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
207
|
-
}
|
|
208
|
-
|
|
209
|
-
// Test a regular snp without specified kernel using an snp only guest kernel
|
|
210
|
-
#[test]
|
|
211
|
-
fn test_snp_without_kernel_snp_only() {
|
|
212
|
-
let arguments = SnpMeasurementArgs {
|
|
213
|
-
vcpus: 1,
|
|
214
|
-
vcpu_type: CpuType::EpycV4,
|
|
215
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
216
|
-
guest_features: GuestFeatures(0x1),
|
|
217
|
-
kernel_file: None,
|
|
218
|
-
initrd_file: None,
|
|
219
|
-
append: None,
|
|
220
|
-
ovmf_hash_str: None,
|
|
221
|
-
vmm_type: None,
|
|
222
|
-
};
|
|
223
|
-
|
|
224
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
225
|
-
|
|
226
|
-
let exp_result = "19358ba9a7615534a9a1e2f0dfc29384dcd4dcb7062ff9c6013b26869a5fc6ecabe033c48dd6f6db5d6d76e7c5df632d";
|
|
227
|
-
|
|
228
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
229
|
-
}
|
|
230
|
-
|
|
231
|
-
// Test a regular snp without specified kernel using a default guest kernel
|
|
232
|
-
#[test]
|
|
233
|
-
fn test_snp_without_kernel_default() {
|
|
234
|
-
let arguments = SnpMeasurementArgs {
|
|
235
|
-
vcpus: 1,
|
|
236
|
-
vcpu_type: CpuType::EpycV4,
|
|
237
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
238
|
-
guest_features: GuestFeatures(0x21),
|
|
239
|
-
kernel_file: None,
|
|
240
|
-
initrd_file: None,
|
|
241
|
-
append: None,
|
|
242
|
-
ovmf_hash_str: None,
|
|
243
|
-
vmm_type: None,
|
|
244
|
-
};
|
|
245
|
-
|
|
246
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
247
|
-
|
|
248
|
-
let exp_result = "e1e1ca029dd7973ab9513295be68198472dcd4fc834bd9af9b63f6e8a1674dbf281a9278a4a2ebe0eed9f22adbcd0e2b";
|
|
249
|
-
|
|
250
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
251
|
-
}
|
|
252
|
-
|
|
253
|
-
// Test snp with multiple cpus with an snp only guest kernel
|
|
254
|
-
#[test]
|
|
255
|
-
fn test_snp_with_multiple_vcpus_snp_only() {
|
|
256
|
-
let arguments = SnpMeasurementArgs {
|
|
257
|
-
vcpus: 4,
|
|
258
|
-
vcpu_type: CpuType::EpycV4,
|
|
259
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
260
|
-
guest_features: GuestFeatures(0x1),
|
|
261
|
-
kernel_file: Some("/dev/null".into()),
|
|
262
|
-
initrd_file: Some("/dev/null".into()),
|
|
263
|
-
append: None,
|
|
264
|
-
ovmf_hash_str: None,
|
|
265
|
-
vmm_type: None,
|
|
266
|
-
};
|
|
267
|
-
|
|
268
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
269
|
-
|
|
270
|
-
let exp_result = "5061fffb019493a903613d56d54b94912a1a2f9e4502385f5c194616753720a92441310ba6c4933de877c36e23046ad5";
|
|
271
|
-
|
|
272
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
273
|
-
}
|
|
274
|
-
|
|
275
|
-
// Test snp with multiple cpus with a default guest kernel
|
|
276
|
-
#[test]
|
|
277
|
-
fn test_snp_with_multiple_vcpus_default() {
|
|
278
|
-
let arguments = SnpMeasurementArgs {
|
|
279
|
-
vcpus: 4,
|
|
280
|
-
vcpu_type: CpuType::EpycV4,
|
|
281
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
282
|
-
guest_features: GuestFeatures(0x21),
|
|
283
|
-
kernel_file: Some("/dev/null".into()),
|
|
284
|
-
initrd_file: Some("/dev/null".into()),
|
|
285
|
-
append: None,
|
|
286
|
-
ovmf_hash_str: None,
|
|
287
|
-
vmm_type: None,
|
|
288
|
-
};
|
|
289
|
-
|
|
290
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
291
|
-
|
|
292
|
-
let exp_result = "4953b1fb416fa874980e8442b3706d345926d5f38879134e00813c5d7abcbe78eafe7b422907be0b4698e2414a631942";
|
|
293
|
-
|
|
294
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
295
|
-
}
|
|
296
|
-
|
|
297
|
-
// Test snp with with ovmf64 and no kernel using a snp only guest kernel
|
|
298
|
-
#[test]
|
|
299
|
-
fn test_snp_with_ovmfx64_without_kernel_snp_only() {
|
|
300
|
-
let arguments = SnpMeasurementArgs {
|
|
301
|
-
vcpus: 1,
|
|
302
|
-
vcpu_type: CpuType::EpycV4,
|
|
303
|
-
ovmf_file: "./tests/measurement/ovmf_OvmfX64_suffix.bin".into(),
|
|
304
|
-
guest_features: GuestFeatures(0x1),
|
|
305
|
-
kernel_file: None,
|
|
306
|
-
initrd_file: None,
|
|
307
|
-
append: None,
|
|
308
|
-
ovmf_hash_str: None,
|
|
309
|
-
vmm_type: None,
|
|
310
|
-
};
|
|
311
|
-
|
|
312
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
313
|
-
|
|
314
|
-
let exp_result = "da0296de8193586a5512078dcd719eccecbd87e2b825ad4148c44f665dc87df21e5b49e21523a9ad993afdb6a30b4005";
|
|
315
|
-
|
|
316
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
317
|
-
}
|
|
318
|
-
|
|
319
|
-
// Test snp with with ovmf64 and no kernel using a default guest kernel
|
|
320
|
-
#[test]
|
|
321
|
-
fn test_snp_with_ovmfx64_without_kernel_default() {
|
|
322
|
-
let arguments = SnpMeasurementArgs {
|
|
323
|
-
vcpus: 1,
|
|
324
|
-
vcpu_type: CpuType::EpycV4,
|
|
325
|
-
ovmf_file: "./tests/measurement/ovmf_OvmfX64_suffix.bin".into(),
|
|
326
|
-
guest_features: GuestFeatures(0x21),
|
|
327
|
-
kernel_file: None,
|
|
328
|
-
initrd_file: None,
|
|
329
|
-
append: None,
|
|
330
|
-
ovmf_hash_str: None,
|
|
331
|
-
vmm_type: None,
|
|
332
|
-
};
|
|
333
|
-
|
|
334
|
-
let ld = snp_calc_launch_digest(arguments).unwrap();
|
|
335
|
-
|
|
336
|
-
let exp_result = "28797ae0afaba4005a81e629acebfb59e6687949d6be44007cd5506823b0dd66f146aaae26ff291eed7b493d8a64c385";
|
|
337
|
-
|
|
338
|
-
assert_eq!(ld.get_hex_ld().as_str(), exp_result);
|
|
339
|
-
}
|
|
340
|
-
|
|
341
|
-
// Test non-SNP OVMF and SNP measure should fail
|
|
342
|
-
#[test]
|
|
343
|
-
#[should_panic(
|
|
344
|
-
expected = "Kernel specified but OVMF metadata doesn't include SNP_KERNEL_HASHES section"
|
|
345
|
-
)]
|
|
346
|
-
fn test_snp_with_ovmfx64_and_kernel_should_fail() {
|
|
347
|
-
let arguments = SnpMeasurementArgs {
|
|
348
|
-
vcpus: 1,
|
|
349
|
-
vcpu_type: CpuType::EpycV4,
|
|
350
|
-
ovmf_file: "./tests/measurement/ovmf_OvmfX64_suffix.bin".into(),
|
|
351
|
-
guest_features: GuestFeatures(0x21),
|
|
352
|
-
kernel_file: Some("/dev/null".into()),
|
|
353
|
-
initrd_file: Some("/dev/null".into()),
|
|
354
|
-
append: None,
|
|
355
|
-
ovmf_hash_str: None,
|
|
356
|
-
vmm_type: None,
|
|
357
|
-
};
|
|
358
|
-
|
|
359
|
-
panic!(
|
|
360
|
-
"{}",
|
|
361
|
-
snp_calc_launch_digest(arguments).unwrap_err().to_string()
|
|
362
|
-
);
|
|
363
|
-
}
|
|
364
|
-
}
|
|
365
|
-
|
|
366
|
-
#[cfg(all(target_os = "linux", feature = "sev"))]
|
|
367
|
-
mod sev_tests {
|
|
368
|
-
use sev::measurement::{sev::*, vcpu_types::CpuType};
|
|
369
|
-
// test regular sev-es
|
|
370
|
-
#[test]
|
|
371
|
-
fn test_seves() {
|
|
372
|
-
let arguments = SevEsMeasurementArgs {
|
|
373
|
-
vcpus: 1,
|
|
374
|
-
vcpu_type: CpuType::EpycV4,
|
|
375
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
376
|
-
kernel_file: Some("/dev/null".into()),
|
|
377
|
-
initrd_file: Some("/dev/null".into()),
|
|
378
|
-
append: None,
|
|
379
|
-
vmm_type: None,
|
|
380
|
-
};
|
|
381
|
-
|
|
382
|
-
let ld = seves_calc_launch_digest(arguments).unwrap();
|
|
383
|
-
|
|
384
|
-
let ld_hex = hex::encode(ld);
|
|
385
|
-
|
|
386
|
-
let exp_result = "13810ae661ea11e2bb205621f582fee268f0367c8f97bc297b7fadef3e12002c";
|
|
387
|
-
|
|
388
|
-
assert_eq!(ld_hex.as_str(), exp_result);
|
|
389
|
-
}
|
|
390
|
-
|
|
391
|
-
// test sev-es with multiple vcpus
|
|
392
|
-
#[test]
|
|
393
|
-
fn test_seves_with_multiple_vcpus() {
|
|
394
|
-
let arguments = SevEsMeasurementArgs {
|
|
395
|
-
vcpus: 4,
|
|
396
|
-
vcpu_type: CpuType::EpycV4,
|
|
397
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
398
|
-
kernel_file: Some("/dev/null".into()),
|
|
399
|
-
initrd_file: Some("/dev/null".into()),
|
|
400
|
-
append: None,
|
|
401
|
-
vmm_type: None,
|
|
402
|
-
};
|
|
403
|
-
|
|
404
|
-
let ld = seves_calc_launch_digest(arguments).unwrap();
|
|
405
|
-
|
|
406
|
-
let ld_hex = hex::encode(ld);
|
|
407
|
-
|
|
408
|
-
let exp_result = "0dccbcaba8e90b261bd0d2e1863a2f9da714768b7b2a19363cd6ae35aa90de91";
|
|
409
|
-
|
|
410
|
-
assert_eq!(ld_hex.as_str(), exp_result);
|
|
411
|
-
}
|
|
412
|
-
|
|
413
|
-
// Test that kernel specified doesn't work with OVMF
|
|
414
|
-
#[test]
|
|
415
|
-
#[should_panic(
|
|
416
|
-
expected = "Kernel specified but OVMF doesn't support kernel/initrd/cmdline measurement"
|
|
417
|
-
)]
|
|
418
|
-
fn test_seves_with_ovmfx64_and_kernel_should_fail() {
|
|
419
|
-
let arguments = SevEsMeasurementArgs {
|
|
420
|
-
vcpus: 1,
|
|
421
|
-
vcpu_type: CpuType::EpycV4,
|
|
422
|
-
ovmf_file: "./tests/measurement/ovmf_OvmfX64_suffix.bin".into(),
|
|
423
|
-
kernel_file: Some("/dev/null".into()),
|
|
424
|
-
initrd_file: Some("/dev/null".into()),
|
|
425
|
-
append: None,
|
|
426
|
-
vmm_type: None,
|
|
427
|
-
};
|
|
428
|
-
|
|
429
|
-
panic!(
|
|
430
|
-
"{}",
|
|
431
|
-
seves_calc_launch_digest(arguments).unwrap_err().to_string()
|
|
432
|
-
);
|
|
433
|
-
}
|
|
434
|
-
|
|
435
|
-
// test regular sev
|
|
436
|
-
#[test]
|
|
437
|
-
fn test_sev() {
|
|
438
|
-
let arguments = SevMeasurementArgs {
|
|
439
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
440
|
-
kernel_file: Some("/dev/null".into()),
|
|
441
|
-
initrd_file: Some("/dev/null".into()),
|
|
442
|
-
append: Some("console=ttyS0 loglevel=7"),
|
|
443
|
-
};
|
|
444
|
-
|
|
445
|
-
let ld = sev_calc_launch_digest(arguments).unwrap();
|
|
446
|
-
|
|
447
|
-
let ld_hex = hex::encode(ld);
|
|
448
|
-
|
|
449
|
-
let exp_result = "82a3ee5d537c3620628270c292ae30cb40c3c878666a7890ee7ef2a08fb535ff";
|
|
450
|
-
|
|
451
|
-
assert_eq!(ld_hex.as_str(), exp_result);
|
|
452
|
-
}
|
|
453
|
-
|
|
454
|
-
// test sev kernel with no initrd or append
|
|
455
|
-
#[test]
|
|
456
|
-
fn test_sev_with_kernel_without_initrd_and_append() {
|
|
457
|
-
let arguments = SevMeasurementArgs {
|
|
458
|
-
ovmf_file: "./tests/measurement/ovmf_AmdSev_suffix.bin".into(),
|
|
459
|
-
kernel_file: Some("/dev/null".into()),
|
|
460
|
-
initrd_file: None,
|
|
461
|
-
append: None,
|
|
462
|
-
};
|
|
463
|
-
|
|
464
|
-
let ld = sev_calc_launch_digest(arguments).unwrap();
|
|
465
|
-
|
|
466
|
-
let ld_hex = hex::encode(ld);
|
|
467
|
-
|
|
468
|
-
let exp_result = "77f613d7bbcdf12a73782ea9e88b0172aeda50d1a54201cb903594ff52846898";
|
|
469
|
-
|
|
470
|
-
assert_eq!(ld_hex.as_str(), exp_result);
|
|
471
|
-
}
|
|
472
|
-
|
|
473
|
-
// test sev with ovmfx64
|
|
474
|
-
#[test]
|
|
475
|
-
fn test_sev_with_ovmfx64_without_kernel() {
|
|
476
|
-
let arguments = SevMeasurementArgs {
|
|
477
|
-
ovmf_file: "./tests/measurement/ovmf_OvmfX64_suffix.bin".into(),
|
|
478
|
-
kernel_file: None,
|
|
479
|
-
initrd_file: None,
|
|
480
|
-
append: None,
|
|
481
|
-
};
|
|
482
|
-
|
|
483
|
-
let ld = sev_calc_launch_digest(arguments).unwrap();
|
|
484
|
-
|
|
485
|
-
let ld_hex = hex::encode(ld);
|
|
486
|
-
|
|
487
|
-
let exp_result = "b4c021e085fb83ceffe6571a3d357b4a98773c83c474e47f76c876708fe316da";
|
|
488
|
-
|
|
489
|
-
assert_eq!(ld_hex.as_str(), exp_result);
|
|
490
|
-
}
|
|
491
|
-
|
|
492
|
-
// Test that kernel specified doesn't work with OVMF
|
|
493
|
-
#[test]
|
|
494
|
-
#[should_panic(
|
|
495
|
-
expected = "Kernel specified but OVMF doesn't support kernel/initrd/cmdline measurement"
|
|
496
|
-
)]
|
|
497
|
-
fn test_sev_with_ovmfx64_and_kernel_should_fail() {
|
|
498
|
-
let arguments = SevMeasurementArgs {
|
|
499
|
-
ovmf_file: "./tests/measurement/ovmf_OvmfX64_suffix.bin".into(),
|
|
500
|
-
kernel_file: Some("/dev/null".into()),
|
|
501
|
-
initrd_file: Some("/dev/null".into()),
|
|
502
|
-
append: None,
|
|
503
|
-
};
|
|
504
|
-
|
|
505
|
-
panic!(
|
|
506
|
-
"{}",
|
|
507
|
-
sev_calc_launch_digest(arguments).unwrap_err().to_string()
|
|
508
|
-
);
|
|
509
|
-
}
|
|
510
|
-
}
|
|
Binary file
|
|
Binary file
|
|
@@ -1,38 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
-
|
|
3
|
-
use super::*;
|
|
4
|
-
use ::sev::certs::sev::builtin::naples::*;
|
|
5
|
-
|
|
6
|
-
#[test]
|
|
7
|
-
fn decode() {
|
|
8
|
-
let bad = ca::Certificate::decode(&mut &ARK_BAD[..], ()).unwrap();
|
|
9
|
-
let ark = ca::Certificate::decode(&mut &ARK[..], ()).unwrap();
|
|
10
|
-
assert_eq!(ark, bad);
|
|
11
|
-
}
|
|
12
|
-
|
|
13
|
-
#[test]
|
|
14
|
-
fn encode() {
|
|
15
|
-
let ark = ca::Certificate::decode(&mut &ARK_BAD[..], ()).unwrap();
|
|
16
|
-
|
|
17
|
-
let mut output = Vec::new();
|
|
18
|
-
ark.encode(&mut output, ()).unwrap();
|
|
19
|
-
assert_eq!(ARK.len(), output.len());
|
|
20
|
-
assert_eq!(ARK.to_vec(), output);
|
|
21
|
-
|
|
22
|
-
let ark = ca::Certificate::decode(&mut &ARK[..], ()).unwrap();
|
|
23
|
-
|
|
24
|
-
let mut output = Vec::new();
|
|
25
|
-
ark.encode(&mut output, ()).unwrap();
|
|
26
|
-
assert_eq!(ARK.len(), output.len());
|
|
27
|
-
assert_eq!(ARK.to_vec(), output);
|
|
28
|
-
}
|
|
29
|
-
|
|
30
|
-
#[cfg(feature = "openssl")]
|
|
31
|
-
#[test]
|
|
32
|
-
fn verify() {
|
|
33
|
-
let ark = ca::Certificate::decode(&mut &ARK_BAD[..], ()).unwrap();
|
|
34
|
-
(&ark, &ark).verify().unwrap();
|
|
35
|
-
|
|
36
|
-
let ark = ca::Certificate::decode(&mut &ARK[..], ()).unwrap();
|
|
37
|
-
(&ark, &ark).verify().unwrap();
|
|
38
|
-
}
|
|
@@ -1,29 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
-
|
|
3
|
-
use super::*;
|
|
4
|
-
use ::sev::certs::sev::builtin::naples::*;
|
|
5
|
-
|
|
6
|
-
#[test]
|
|
7
|
-
fn decode() {
|
|
8
|
-
ca::Certificate::decode(&mut &ASK[..], ()).unwrap();
|
|
9
|
-
}
|
|
10
|
-
|
|
11
|
-
#[test]
|
|
12
|
-
fn encode() {
|
|
13
|
-
let ask = ca::Certificate::decode(&mut &ASK[..], ()).unwrap();
|
|
14
|
-
|
|
15
|
-
let mut output = Vec::new();
|
|
16
|
-
ask.encode(&mut output, ()).unwrap();
|
|
17
|
-
assert_eq!(ASK.len(), output.len());
|
|
18
|
-
assert_eq!(ASK.to_vec(), output);
|
|
19
|
-
}
|
|
20
|
-
|
|
21
|
-
#[cfg(feature = "openssl")]
|
|
22
|
-
#[test]
|
|
23
|
-
fn verify() {
|
|
24
|
-
let ark = ca::Certificate::decode(ARK, ()).unwrap();
|
|
25
|
-
let ask = ca::Certificate::decode(ASK, ()).unwrap();
|
|
26
|
-
|
|
27
|
-
(&ark, &ask).verify().unwrap();
|
|
28
|
-
assert!((&ask, &ark).verify().is_err());
|
|
29
|
-
}
|
|
Binary file
|
|
@@ -1,30 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
-
|
|
3
|
-
use super::*;
|
|
4
|
-
|
|
5
|
-
#[test]
|
|
6
|
-
fn decode() {
|
|
7
|
-
sev::Certificate::decode(&mut &CEK[..], ()).unwrap();
|
|
8
|
-
}
|
|
9
|
-
|
|
10
|
-
#[test]
|
|
11
|
-
fn encode() {
|
|
12
|
-
let cek = sev::Certificate::decode(&mut &CEK[..], ()).unwrap();
|
|
13
|
-
|
|
14
|
-
let mut output = Vec::new();
|
|
15
|
-
cek.encode(&mut output, ()).unwrap();
|
|
16
|
-
assert_eq!(CEK.len(), output.len());
|
|
17
|
-
assert_eq!(CEK.to_vec(), output);
|
|
18
|
-
}
|
|
19
|
-
|
|
20
|
-
#[cfg(feature = "openssl")]
|
|
21
|
-
#[test]
|
|
22
|
-
fn verify() {
|
|
23
|
-
use ::sev::certs::sev::builtin::naples::ASK;
|
|
24
|
-
|
|
25
|
-
let ask = ca::Certificate::decode(ASK, ()).unwrap();
|
|
26
|
-
let cek = sev::Certificate::decode(CEK, ()).unwrap();
|
|
27
|
-
|
|
28
|
-
(&ask, &cek).verify().unwrap();
|
|
29
|
-
//assert!((&cek, &ask).verify().is_err());
|
|
30
|
-
}
|
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
-
|
|
3
|
-
mod ark;
|
|
4
|
-
mod ask;
|
|
5
|
-
mod cek;
|
|
6
|
-
mod oca;
|
|
7
|
-
mod pdh;
|
|
8
|
-
mod pek;
|
|
9
|
-
|
|
10
|
-
const ARK_BAD: &[u8] = include_bytes!("ark.cert.bad");
|
|
11
|
-
|
|
12
|
-
const OCA: &[u8] = include_bytes!("oca.cert");
|
|
13
|
-
pub const CEK: &[u8] = include_bytes!("cek.cert");
|
|
14
|
-
const PEK: &[u8] = include_bytes!("pek.cert");
|
|
15
|
-
const PDH: &[u8] = include_bytes!("pdh.cert");
|
|
16
|
-
|
|
17
|
-
use ::sev::certs::sev::*;
|
|
18
|
-
|
|
19
|
-
#[allow(unused_imports)]
|
|
20
|
-
use codicon::*;
|
|
Binary file
|
|
@@ -1,45 +0,0 @@
|
|
|
1
|
-
// SPDX-License-Identifier: Apache-2.0
|
|
2
|
-
|
|
3
|
-
use super::*;
|
|
4
|
-
|
|
5
|
-
#[test]
|
|
6
|
-
fn decode() {
|
|
7
|
-
sev::Certificate::decode(&mut &OCA[..], ()).unwrap();
|
|
8
|
-
}
|
|
9
|
-
|
|
10
|
-
#[test]
|
|
11
|
-
fn encode() {
|
|
12
|
-
let oca = sev::Certificate::decode(&mut &OCA[..], ()).unwrap();
|
|
13
|
-
|
|
14
|
-
let mut output = Vec::new();
|
|
15
|
-
oca.encode(&mut output, ()).unwrap();
|
|
16
|
-
assert_eq!(OCA.len(), output.len());
|
|
17
|
-
assert_eq!(OCA.to_vec(), output);
|
|
18
|
-
}
|
|
19
|
-
|
|
20
|
-
#[cfg(feature = "openssl")]
|
|
21
|
-
#[test]
|
|
22
|
-
fn verify() {
|
|
23
|
-
let oca = sev::Certificate::decode(OCA, ()).unwrap();
|
|
24
|
-
(&oca, &oca).verify().unwrap();
|
|
25
|
-
}
|
|
26
|
-
|
|
27
|
-
#[cfg(feature = "openssl")]
|
|
28
|
-
#[test]
|
|
29
|
-
fn create() {
|
|
30
|
-
let mut pdh = sev::Certificate::decode(&mut &PDH[..], ()).unwrap();
|
|
31
|
-
let (mut oca, key) = sev::Certificate::generate(sev::Usage::OCA).unwrap();
|
|
32
|
-
|
|
33
|
-
assert!((&pdh, &pdh).verify().is_err());
|
|
34
|
-
assert!((&oca, &pdh).verify().is_err());
|
|
35
|
-
assert!((&oca, &oca).verify().is_err());
|
|
36
|
-
|
|
37
|
-
key.sign(&mut oca).unwrap();
|
|
38
|
-
|
|
39
|
-
assert!((&pdh, &pdh).verify().is_err());
|
|
40
|
-
assert!((&oca, &pdh).verify().is_err());
|
|
41
|
-
(&oca, &oca).verify().unwrap();
|
|
42
|
-
|
|
43
|
-
key.sign(&mut pdh).unwrap();
|
|
44
|
-
(&oca, &pdh).verify().unwrap();
|
|
45
|
-
}
|
|
Binary file
|