@super-protocol/addons-tee 0.9.2 → 0.9.4

package/dist/sgx-native-module/sev-snp-schema.d.ts

@@ -0,0 +1,22 @@
+import { Static, TLiteral } from "@sinclair/typebox";
+import { ImportantSecurityFields } from "../../bindings/amd-sev-snp-napi-rs";
+export declare const CommonPolicyKeyName = "Common";
+export declare const importantFieldNames: (keyof ImportantSecurityFields)[];
+export declare enum RuleOperator {
+    Le = "le",
+    Eq = "eq",
+    Ge = "ge"
+}
+declare const PolicyRuleSchema: import("@sinclair/typebox").TObject<{
+    name: import("@sinclair/typebox").TUnion<[TLiteral<string>, ...TLiteral<string>[]]>;
+    operator: import("@sinclair/typebox").TUnion<TLiteral<RuleOperator>[]>;
+    value: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TNumber, import("@sinclair/typebox").TBoolean]>;
+}>;
+export declare const PolicySetSchema: import("@sinclair/typebox").TObject<{
+    [x: string]: any;
+}>;
+export type PolicySet = Static<typeof PolicySetSchema>;
+export type PolicyRule = Static<typeof PolicyRuleSchema> & {
+    name: keyof ImportantSecurityFields;
+};
+export {};

package/dist/sgx-native-module/sev-snp-schema.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicySetSchema = exports.RuleOperator = exports.importantFieldNames = exports.CommonPolicyKeyName = void 0;
+const typebox_1 = require("@sinclair/typebox");
+const amd_sev_snp_napi_rs_1 = require("../../bindings/amd-sev-snp-napi-rs");
+exports.CommonPolicyKeyName = "Common";
+exports.importantFieldNames = Object.keys(amd_sev_snp_napi_rs_1.IMPORTANT_SECURITY_FIELDS_DUMMY);
+const importantFieldLiterals = exports.importantFieldNames.map((k) => typebox_1.Type.Literal(k));
+var RuleOperator;
+(function (RuleOperator) {
+    RuleOperator["Le"] = "le";
+    RuleOperator["Eq"] = "eq";
+    RuleOperator["Ge"] = "ge";
+})(RuleOperator || (exports.RuleOperator = RuleOperator = {}));
+const PolicyRuleSchema = typebox_1.Type.Object({
+    name: typebox_1.Type.Union(importantFieldLiterals),
+    operator: typebox_1.Type.Union(Object.values(RuleOperator).map((op) => typebox_1.Type.Literal(op))),
+    value: typebox_1.Type.Union([typebox_1.Type.Number(), typebox_1.Type.Boolean()]),
+});
+exports.PolicySetSchema = typebox_1.Type.Partial(typebox_1.Type.Object(Object.fromEntries([
+    ...Object.values(amd_sev_snp_napi_rs_1.WellKnownSnpCodeNames).map((key) => [key, typebox_1.Type.Array(PolicyRuleSchema)]),
+    [exports.CommonPolicyKeyName, typebox_1.Type.Array(PolicyRuleSchema)],
+])), { additionalProperties: false });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2V2LXNucC1zY2hlbWEuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2d4LW5hdGl2ZS1tb2R1bGUvc2V2LXNucC1zY2hlbWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsK0NBQTJEO0FBQzNELDRFQUk0QztBQUUvQixRQUFBLG1CQUFtQixHQUFHLFFBQVEsQ0FBQztBQUUvQixRQUFBLG1CQUFtQixHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMscURBQStCLENBQXNDLENBQUM7QUFFckgsTUFBTSxzQkFBc0IsR0FBRywyQkFBbUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLGNBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBRzVFLENBQUM7QUFFRixJQUFZLFlBSVg7QUFKRCxXQUFZLFlBQVk7SUFDcEIseUJBQVMsQ0FBQTtJQUNULHlCQUFTLENBQUE7SUFDVCx5QkFBUyxDQUFBO0FBQ2IsQ0FBQyxFQUpXLFlBQVksNEJBQVosWUFBWSxRQUl2QjtBQUVELE1BQU0sZ0JBQWdCLEdBQUcsY0FBSSxDQUFDLE1BQU0sQ0FBQztJQUNqQyxJQUFJLEVBQUUsY0FBSSxDQUFDLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQztJQUN4QyxRQUFRLEVBQUUsY0FBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsY0FBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQy9FLEtBQUssRUFBRSxjQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsY0FBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLGNBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0NBQ3JELENBQUMsQ0FBQztBQUVVLFFBQUEsZUFBZSxHQUFHLGNBQUksQ0FBQyxPQUFPLENBQ3ZDLGNBQUksQ0FBQyxNQUFNLENBQ1AsTUFBTSxDQUFDLFdBQVcsQ0FBQztJQUNmLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQywyQ0FBcUIsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxHQUFHLEVBQUUsY0FBSSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDekYsQ0FBQywyQkFBbUIsRUFBRSxjQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUM7Q0FDdEQsQ0FBQyxDQUNMLEVBQ0QsRUFBRSxvQkFBb0IsRUFBRSxLQUFLLEVBQUUsQ0FDbEMsQ0FBQyJ9

package/dist/sgx-native-module/sev-snp.d.ts

@@ -1,30 +1,7 @@
 /// <reference types="node" />
-import { CpuInfo } from "../../bindings/amd-sev-snp-napi-rs/";
-import { CertificateFormat } from "./pki.service";
-export declare enum SupportedAmdSevSnpGenerations {
-    Milan = "Milan",
-    Genoa = "Genoa"
-}
-export declare enum SevSNPCertType {
-    ARK = "ARK",
-    ASK = "ASK",
-    VCEK = "VCEK"
-}
-export interface SnpCert {
-    type: SevSNPCertType;
-    cert: Buffer | string;
-    format: CertificateFormat;
-}
-export interface SNPReport {
-    report: Buffer;
-    cpuSig: number;
-    cores: number;
-    cmdLineHash: Buffer;
-    build: string;
-}
-export interface SNPReportWithChain extends SNPReport {
-    certs: SnpCert[];
-}
+import { CpuInfo, ImportantSecurityFields, WellKnownSnpCodeNames } from "../../bindings/amd-sev-snp-napi-rs/";
+import { SnpCert, SevSnpCertificateFormat, SNPReport, SNPReportWithChain } from "../proto/AmdSevSnp";
+import { PolicySet } from "./sev-snp-schema";
 export interface CalcSnpMrEnclaveParams {
     ovmfPath: string;
     kernelHash: Buffer;
@@ -40,8 +17,6 @@ export declare const EMPTY_INITRD_SHA256_HASH: Buffer;
 export type ArkHashes = {
     [key: string]: Buffer;
 };
-export declare const ARK_MILAN = "-----BEGIN CERTIFICATE-----\nMIIGYzCCBBKgAwIBAgIDAQAAMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC\nBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS\nBgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg\nQ2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp\nY2VzMRIwEAYDVQQDDAlBUkstTWlsYW4wHhcNMjAxMDIyMTcyMzA1WhcNNDUxMDIy\nMTcyMzA1WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS\nBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j\nZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJQVJLLU1pbGFuMIICIjANBgkqhkiG\n9w0BAQEFAAOCAg8AMIICCgKCAgEA0Ld52RJOdeiJlqK2JdsVmD7FktuotWwX1fNg\nW41XY9Xz1HEhSUmhLz9Cu9DHRlvgJSNxbeYYsnJfvyjx1MfU0V5tkKiU1EesNFta\n1kTA0szNisdYc9isqk7mXT5+KfGRbfc4V/9zRIcE8jlHN61S1ju8X93+6dxDUrG2\nSzxqJ4BhqyYmUDruPXJSX4vUc01P7j98MpqOS95rORdGHeI52Naz5m2B+O+vjsC0\n60d37jY9LFeuOP4Meri8qgfi2S5kKqg/aF6aPtuAZQVR7u3KFYXP59XmJgtcog05\ngmI0T/OitLhuzVvpZcLph0odh/1IPXqx3+MnjD97A7fXpqGd/y8KxX7jksTEzAOg\nbKAeam3lm+3yKIcTYMlsRMXPcjNbIvmsBykD//xSniusuHBkgnlENEWx1UcbQQrs\n+gVDkuVPhsnzIRNgYvM48Y+7LGiJYnrmE8xcrexekBxrva2V9TJQqnN3Q53kt5vi\nQi3+gCfmkwC0F0tirIZbLkXPrPwzZ0M9eNxhIySb2npJfgnqz55I0u33wh4r0ZNQ\neTGfw03MBUtyuzGesGkcw+loqMaq1qR4tjGbPYxCvpCq7+OgpCCoMNit2uLo9M18\nfHz10lOMT8nWAUvRZFzteXCm+7PHdYPlmQwUw3LvenJ/ILXoQPHfbkH0CyPfhl1j\nWhJFZasCAwEAAaN+MHwwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSFrBrRQ/fI\nrFXUxR1BSKvVeErUUzAPBgNVHRMBAf8EBTADAQH/MDoGA1UdHwQzMDEwL6AtoCuG\nKWh0dHBzOi8va2RzaW50Zi5hbWQuY29tL3ZjZWsvdjEvTWlsYW4vY3JsMEYGCSqG\nSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZI\nAWUDBAICBQCiAwIBMKMDAgEBA4ICAQC6m0kDp6zv4Ojfgy+zleehsx6ol0ocgVel\nETobpx+EuCsqVFRPK1jZ1sp/lyd9+0fQ0r66n7kagRk4Ca39g66WGTJMeJdqYriw\nSTjjDCKVPSesWXYPVAyDhmP5n2v+BYipZWhpvqpaiO+EGK5IBP+578QeW/sSokrK\ndHaLAxG2LhZxj9aF73fqC7OAJZ5aPonw4RE299FVarh1Tx2eT3wSgkDgutCTB1Yq\nzT5DuwvAe+co2CIVIzMDamYuSFjPN0BCgojl7V+bTou7dMsqIu/TW/rPCX9/EUcp\nKGKqPQ3P+N9r1hjEFY1plBg93t53OOo49GNI+V1zvXPLI6xIFVsh+mto2RtgEX/e\npmMKTNN6psW88qg7c1hTWtN6MbRuQ0vm+O+/2tKBF2h8THb94OvvHHoFDpbCELlq\nHnIYhxy0YKXGyaW1NjfULxrrmxVW4wcn5E8GddmvNa6yYm8scJagEi13mhGu4Jqh\n3QU3sf8iUSUr09xQDwHtOQUVIqx4maBZPBtSMf+qUDtjXSSq8lfWcd8bLr9mdsUn\nJZJ0+tuPMKmBnSH860llKk+VpVQsgqbzDIvOLvD6W1Umq25boxCYJ+TuBoa4s+HH\nCViAvgT9kf/rBq1d+ivj6skkHxuzcxbk1xv6ZGxrteJxVH7KlX7YRdZ6eARKwLe4\nAFZEAwoKCQ==\n-----END CERTIFICATE-----";
-export declare const ARK_GENOA = "-----BEGIN CERTIFICATE-----\nMIIGYzCCBBKgAwIBAgIDAgAAMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC\nBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS\nBgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg\nQ2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp\nY2VzMRIwEAYDVQQDDAlBUkstR2Vub2EwHhcNMjIwMTI2MTUzNDM3WhcNNDcwMTI2\nMTUzNDM3WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS\nBgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j\nZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJQVJLLUdlbm9hMIICIjANBgkqhkiG\n9w0BAQEFAAOCAg8AMIICCgKCAgEA3Cd95S/uFOuRIskW9vz9VDBF69NDQF79oRhL\n/L2PVQGhK3YdfEBgpF/JiwWFBsT/fXDhzA01p3LkcT/7LdjcRfKXjHl+0Qq/M4dZ\nkh6QDoUeKzNBLDcBKDDGWo3v35NyrxbA1DnkYwUKU5AAk4P94tKXLp80oxt84ahy\nHoLmc/LqsGsp+oq1Bz4PPsYLwTG4iMKVaaT90/oZ4I8oibSru92vJhlqWO27d/Rx\nc3iUMyhNeGToOvgx/iUo4gGpG61NDpkEUvIzuKcaMx8IdTpWg2DF6SwF0IgVMffn\nvtJmA68BwJNWo1E4PLJdaPfBifcJpuBFwNVQIPQEVX3aP89HJSp8YbY9lySS6PlV\nEqTBBtaQmi4ATGmMR+n2K/e+JAhU2Gj7jIpJhOkdH9firQDnmlA2SFfJ/Cc0mGNz\nW9RmIhyOUnNFoclmkRhl3/AQU5Ys9Qsan1jT/EiyT+pCpmnA+y9edvhDCbOG8F2o\nxHGRdTBkylungrkXJGYiwGrR8kaiqv7NN8QhOBMqYjcbrkEr0f8QMKklIS5ruOfq\nlLMCBw8JLB3LkjpWgtD7OpxkzSsohN47Uom86RY6lp72g8eXHP1qYrnvhzaG1S70\nvw6OkbaaC9EjiH/uHgAJQGxon7u0Q7xgoREWA/e7JcBQwLg80Hq/sbRuqesxz7wB\nWSY254cCAwEAAaN+MHwwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSfXfn+Ddjz\nWtAzGiXvgSlPvjGoWzAPBgNVHRMBAf8EBTADAQH/MDoGA1UdHwQzMDEwL6AtoCuG\nKWh0dHBzOi8va2RzaW50Zi5hbWQuY29tL3ZjZWsvdjEvR2Vub2EvY3JsMEYGCSqG\nSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZI\nAWUDBAICBQCiAwIBMKMDAgEBA4ICAQAdIlPBC7DQmvH7kjlOznFx3i21SzOPDs5L\n7SgFjMC9rR07292GQCA7Z7Ulq97JQaWeD2ofGGse5swj4OQfKfVv/zaJUFjvosZO\nnfZ63epu8MjWgBSXJg5QE/Al0zRsZsp53DBTdA+Uv/s33fexdenT1mpKYzhIg/cK\ntz4oMxq8JKWJ8Po1CXLzKcfrTphjlbkh8AVKMXeBd2SpM33B1YP4g1BOdk013kqb\n7bRHZ1iB2JHG5cMKKbwRCSAAGHLTzASgDcXr9Fp7Z3liDhGu/ci1opGmkp12QNiJ\nuBbkTU+xDZHm5X8Jm99BX7NEpzlOwIVR8ClgBDyuBkBC2ljtr3ZSaUIYj2xuyWN9\n5KFY49nWxcz90CFa3Hzmy4zMQmBe9dVyls5eL5p9bkXcgRMDTbgmVZiAf4afe8DL\ndmQcYcMFQbHhgVzMiyZHGJgcCrQmA7MkTwEIds1wx/HzMcwU4qqNBAoZV7oeIIPx\ndqFXfPqHqiRlEbRDfX1TG5NFVaeByX0GyH6jzYVuezETzruaky6fp2bl2bczxPE8\nHdS38ijiJmm9vl50RGUeOAXjSuInGR4bsRufeGPB9peTa9BcBOeTWzstqTUB/F/q\naZCIZKr4X6TyfUuSDz/1JDAGl+lxdM0P9+lLaP9NahQjHCVf0zf1c1salVuGFk2w\n/wMz1R1BHg==\n-----END CERTIFICATE-----";
 export declare function getDefaultArkHashes(): ArkHashes;
 export declare class SevSNP {
     static serializeSNPReport(report: SNPReportWithChain): Buffer;
@@ -53,8 +28,9 @@ export declare class SevSNP {
     /**
      * Method for generation AMD SEV-SNP Report
      * @param userData - The data that will be included in the report and will be signed
+     * @param vmpl - Optional VMPL value to pass to the firmware when requesting a report (default: 0)
      */
-    static generateSNPReport(userData: Buffer): Promise<SNPReport>;
+    static generateSNPReport(userData: Buffer, vmpl?: number): Promise<SNPReport>;
     /**
      * Method for fetch certificates from AMD KDS
      * @param report - report generated by the `generateSNPReport` method
@@ -64,7 +40,7 @@ export declare class SevSNP {
     static getReportChain(report: SNPReport, options?: {
         retryMax?: number;
         retryInterval?: number;
-        certFormat?: CertificateFormat;
+        certFormat?: SevSnpCertificateFormat;
     }): Promise<SnpCert[]>;
     /**
      * Method for generation AMD SEV-SNP Report and fetching certificates
@@ -74,7 +50,7 @@ export declare class SevSNP {
     static generateSNPReportWithChain(userData: Buffer, options?: {
         retryMax?: number;
         retryInterval?: number;
-        certFormat?: CertificateFormat;
+        certFormat?: SevSnpCertificateFormat;
     }): Promise<SNPReportWithChain>;
     protected static runSubProcess(binaryPath: string, args?: string[], options?: {
         cwd?: string;
@@ -84,7 +60,7 @@ export declare class SevSNP {
         stdout: string;
         stderr: string;
     }>;
-    static getCertHash(cert: SnpCert): Buffer;
+    static getCertHash(cert: Omit<SnpCert, "type">): Buffer;
     protected static isValidArk(ARK: SnpCert, trustedHashes: ArkHashes): boolean;
     /**
      * AMD SEV-SNP verification method
@@ -131,4 +107,16 @@ export declare class SevSNP {
      * @param cpuInfo - Structure containing family, model and stepping @see CpuInfo
      */
     static getCpuSig(cpuInfo: CpuInfo): number;
+    static getReportImportantSecurityFields(report: Buffer): Promise<ImportantSecurityFields>;
+    static getReportCpuInfo(report: Buffer): Promise<CpuInfo>;
+    static getCpuGeneration(cpuInfo: CpuInfo): Promise<WellKnownSnpCodeNames>;
+    static parsePolicySet(jsonText: string): PolicySet;
+    private static checkRule;
+    /**
+     * Verify SNP report against a PolicySet.
+     * Throws an error if any rule fails.
+     * @param report - SNPReport
+     * @param policySet - PolicySet containing rules
+     */
+    static verifyPolicy(report: Buffer, policySet?: PolicySet): Promise<void>;
 }