Skip to content

Commit 337f350

Browse files
pedronispedronis
authored
Expect ModelGrade.Code to be measured
Merge pull request #50 from snapcore/model-grade-code-to-be-measured asserts.ModelGrade is growing a Code method to give us a fixed size bit representation convenient for measuring, expect the use of that drive-by: make the series values in the tests more realistic
2 parents 89c7bad + edff5ef commit 337f350

File tree

3 files changed

+98
-125
lines changed

3 files changed

+98
-125
lines changed

‎snapmodel_policy.go‎

Lines changed: 3 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -23,36 +23,13 @@ import (
2323
"encoding/base64"
2424
"encoding/binary"
2525
"errors"
26-
"fmt"
2726

2827
"github.com/canonical/go-tpm2"
2928
"github.com/snapcore/snapd/asserts"
3029

3130
"golang.org/x/xerrors"
3231
)
3332

34-
const (
35-
modelGradeUnset uint8 = iota
36-
modelGradeSecured
37-
modelGradeSigned
38-
modelGradeDangerous
39-
)
40-
41-
func modelGradeEnum(grade asserts.ModelGrade) (uint8, error) {
42-
switch grade {
43-
case asserts.ModelGradeUnset:
44-
return modelGradeUnset, nil
45-
case asserts.ModelSecured:
46-
return modelGradeSecured, nil
47-
case asserts.ModelSigned:
48-
return modelGradeSigned, nil
49-
case asserts.ModelDangerous:
50-
return modelGradeDangerous, nil
51-
default:
52-
return modelGradeUnset, fmt.Errorf("unknown grade: %v", grade)
53-
}
54-
}
55-
5633
// SnapModelProfileParams provides the parameters to AddSnapModelProfile.
5734
type SnapModelProfileParams struct {
5835
// PCRAlgorithm is the algorithm for which to compute PCR digests for. TPMs compliant with the "TCG PC Client Platform TPM Profile
@@ -80,12 +57,8 @@ type SnapModelProfileParams struct {
8057
// digest2 = H(digest1 || model)
8158
// digestModel = H(digest2 || series || grade)
8259
// The signing key digest algorithm is encoded in little-endian format, and the sign-key-sha3-384 field is hashed in decoded (binary)
83-
// form. The brand-id, model and series fields are hashed without null terminators. The grade field is encoded as a single byte with
84-
// the following conversion:
85-
// "unset": 0
86-
// "secured": 1
87-
// "signed": 2
88-
// "dangerous": 3
60+
// form. The brand-id, model and series fields are hashed without null terminators. The grade field is encoded as the 32 bits from asserts.ModelGrade.Code in little-endian format.
61+
//
8962
// Separate extend operations are used because brand-id, model and series are variable length.
9063
//
9164
// The PCR index that snap-bootstrap measures the model to can be specified via the PCRIndex field of params.
@@ -124,14 +97,10 @@ func AddSnapModelProfile(profile *PCRProtectionProfile, params *SnapModelProfile
12497
h.Write([]byte(model.Model()))
12598
digest = h.Sum(nil)
12699

127-
grade, err := modelGradeEnum(model.Grade())
128-
if err != nil {
129-
return xerrors.Errorf("cannot detemine grade of model: %w", err)
130-
}
131100
h = params.PCRAlgorithm.NewHash()
132101
h.Write(digest)
133102
h.Write([]byte(model.Series()))
134-
h.Write([]byte{grade})
103+
binary.Write(h, binary.LittleEndian, model.Grade().Code())
135104

136105
subProfiles = append(subProfiles, NewPCRProtectionProfile().ExtendPCR(params.PCRAlgorithm, params.PCRIndex, h.Sum(nil)))
137106
}

‎snapmodel_policy_test.go‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile1(c *C) {
9595
Models: []*asserts.Model{
9696
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
9797
"authority-id": "fake-brand",
98-
"series": "20",
98+
"series": "16",
9999
"brand-id": "fake-brand",
100100
"model": "fake-model",
101101
"grade": "secured",
@@ -105,7 +105,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile1(c *C) {
105105
values: []tpm2.PCRValues{
106106
{
107107
tpm2.HashAlgorithmSHA256: {
108-
12: decodeHexString(c, "c97cc440a039c990927565d6818f6f23734bbeed2951ed5d7bf1bd5ec5b04e8c"),
108+
12: decodeHexString(c, "bd7851fd994a7f899364dbc96a95dffeaa250cd7ea33b4b6c313866169e779bc"),
109109
},
110110
},
111111
},
@@ -121,7 +121,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile2(c *C) {
121121
Models: []*asserts.Model{
122122
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
123123
"authority-id": "fake-brand",
124-
"series": "20",
124+
"series": "16",
125125
"brand-id": "fake-brand",
126126
"model": "fake-model",
127127
"grade": "secured",
@@ -131,7 +131,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile2(c *C) {
131131
values: []tpm2.PCRValues{
132132
{
133133
tpm2.HashAlgorithmSHA256: {
134-
12: decodeHexString(c, "7712e7ef0dfff33588e0157d88c0400d5029e1293d05d4975ab88279f4ce6266"),
134+
12: decodeHexString(c, "df0c79fd31951f47b547a2914427159d52a870ed368a9dfd29fc08f28c341b6d"),
135135
},
136136
},
137137
},
@@ -147,7 +147,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile3(c *C) {
147147
Models: []*asserts.Model{
148148
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
149149
"authority-id": "other-brand",
150-
"series": "20",
150+
"series": "16",
151151
"brand-id": "other-brand",
152152
"model": "fake-model",
153153
"grade": "secured",
@@ -157,7 +157,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile3(c *C) {
157157
values: []tpm2.PCRValues{
158158
{
159159
tpm2.HashAlgorithmSHA256: {
160-
12: decodeHexString(c, "bdf8ad6741193f3e99cfb4cf0588d06f57a095746b7844a9245857c83829ab08"),
160+
12: decodeHexString(c, "d2fd13d3097d7cf75c8f14f790f6a41e27e8925664b2324e73a749aa30971594"),
161161
},
162162
},
163163
},
@@ -173,7 +173,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile4(c *C) {
173173
Models: []*asserts.Model{
174174
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
175175
"authority-id": "fake-brand",
176-
"series": "20",
176+
"series": "16",
177177
"brand-id": "fake-brand",
178178
"model": "other-model",
179179
"grade": "secured",
@@ -183,7 +183,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile4(c *C) {
183183
values: []tpm2.PCRValues{
184184
{
185185
tpm2.HashAlgorithmSHA256: {
186-
12: decodeHexString(c, "cd497d89f48ae1329f8a4b1fe7ddedaaf52f370c4f1dc8e631efd73be2663f41"),
186+
12: decodeHexString(c, "7135fd41c92f097075cc21eefd6797498544fd329b3bf996654885ebf83bb2de"),
187187
},
188188
},
189189
},
@@ -199,7 +199,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile5(c *C) {
199199
Models: []*asserts.Model{
200200
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
201201
"authority-id": "fake-brand",
202-
"series": "18",
202+
"series": "28",
203203
"brand-id": "fake-brand",
204204
"model": "fake-model",
205205
"grade": "secured",
@@ -209,7 +209,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile5(c *C) {
209209
values: []tpm2.PCRValues{
210210
{
211211
tpm2.HashAlgorithmSHA256: {
212-
12: decodeHexString(c, "6ab237c7d0855618765533137849477a759453e9a89c39f90ad23f5604aef601"),
212+
12: decodeHexString(c, "62242d713e406f862ca35be37777b6932bfdcd8b766a99ce408c8c3bce68b2fe"),
213213
},
214214
},
215215
},
@@ -225,7 +225,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile6(c *C) {
225225
Models: []*asserts.Model{
226226
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
227227
"authority-id": "fake-brand",
228-
"series": "20",
228+
"series": "16",
229229
"brand-id": "fake-brand",
230230
"model": "fake-model",
231231
"grade": "secured",
@@ -235,7 +235,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile6(c *C) {
235235
values: []tpm2.PCRValues{
236236
{
237237
tpm2.HashAlgorithmSHA1: {
238-
12: decodeHexString(c, "cbb043790386b031b5e40c3aa46b65479159f0a1"),
238+
12: decodeHexString(c, "aa6839aca24500a572aea54bf5b23912abf8ed42"),
239239
},
240240
},
241241
},
@@ -251,7 +251,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile7(c *C) {
251251
Models: []*asserts.Model{
252252
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
253253
"authority-id": "fake-brand",
254-
"series": "20",
254+
"series": "16",
255255
"brand-id": "fake-brand",
256256
"model": "fake-model",
257257
"grade": "secured",
@@ -261,7 +261,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile7(c *C) {
261261
values: []tpm2.PCRValues{
262262
{
263263
tpm2.HashAlgorithmSHA256: {
264-
14: decodeHexString(c, "c97cc440a039c990927565d6818f6f23734bbeed2951ed5d7bf1bd5ec5b04e8c"),
264+
14: decodeHexString(c, "bd7851fd994a7f899364dbc96a95dffeaa250cd7ea33b4b6c313866169e779bc"),
265265
},
266266
},
267267
},
@@ -277,14 +277,14 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile8(c *C) {
277277
Models: []*asserts.Model{
278278
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
279279
"authority-id": "fake-brand",
280-
"series": "20",
280+
"series": "16",
281281
"brand-id": "fake-brand",
282282
"model": "fake-model",
283283
"grade": "secured",
284284
}, "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij"),
285285
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
286286
"authority-id": "fake-brand",
287-
"series": "20",
287+
"series": "16",
288288
"brand-id": "fake-brand",
289289
"model": "other-model",
290290
"grade": "secured",
@@ -294,12 +294,12 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile8(c *C) {
294294
values: []tpm2.PCRValues{
295295
{
296296
tpm2.HashAlgorithmSHA256: {
297-
12: decodeHexString(c, "c97cc440a039c990927565d6818f6f23734bbeed2951ed5d7bf1bd5ec5b04e8c"),
297+
12: decodeHexString(c, "bd7851fd994a7f899364dbc96a95dffeaa250cd7ea33b4b6c313866169e779bc"),
298298
},
299299
},
300300
{
301301
tpm2.HashAlgorithmSHA256: {
302-
12: decodeHexString(c, "cd497d89f48ae1329f8a4b1fe7ddedaaf52f370c4f1dc8e631efd73be2663f41"),
302+
12: decodeHexString(c, "7135fd41c92f097075cc21eefd6797498544fd329b3bf996654885ebf83bb2de"),
303303
},
304304
},
305305
},
@@ -318,14 +318,14 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile9(c *C) {
318318
Models: []*asserts.Model{
319319
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
320320
"authority-id": "fake-brand",
321-
"series": "20",
321+
"series": "16",
322322
"brand-id": "fake-brand",
323323
"model": "fake-model",
324324
"grade": "secured",
325325
}, "Jv8_JiHiIzJVcO9M55pPdqSDWUvuhfDIBJUS-3VW7F_idjix7Ffn5qMxB21ZQuij"),
326326
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
327327
"authority-id": "fake-brand",
328-
"series": "20",
328+
"series": "16",
329329
"brand-id": "fake-brand",
330330
"model": "other-model",
331331
"grade": "secured",
@@ -336,30 +336,30 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile9(c *C) {
336336
{
337337
tpm2.HashAlgorithmSHA256: {
338338
7: makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "foo"),
339-
12: decodeHexString(c, "5d49397e8137997214ec3b32fb0632c207b76b30e8b2595aaca7006ddb49ab65"),
339+
12: decodeHexString(c, "3089d679b1cda31c76fe57e6cf0c3eb35c221acde76a678c3c4771ee9b99a8c9"),
340340
},
341341
},
342342
{
343343
tpm2.HashAlgorithmSHA256: {
344344
7: makePCRDigestFromEvents(tpm2.HashAlgorithmSHA256, "foo"),
345-
12: decodeHexString(c, "81723abe417d707e308dab720ecb00ae543931993175851d7356d46cecd46fef"),
345+
12: decodeHexString(c, "cb7a1cf1afbc73e0e4348f771cf7475e7ec278549af042e2617e717ca38d3416"),
346346
},
347347
},
348348
},
349349
})
350350
}
351351

352352
func (s *snapModelProfileTest) TestAddSnapModelProfile10(c *C) {
353-
// Test that there aren't contatenation issues with brand-id/model/series - ie, "fake-brand,fake-model,20" should
354-
// be different to "fake-bran,dfake-mode,l20".
353+
// Test that there aren't contatenation issues with brand-id/model/series - ie, "fake-brand,fake-model,16" should
354+
// be different to "fake-bran,dfake-mode,l16".
355355
s.testAddSnapModelProfile(c, &testAddSnapModelProfileData{
356356
params: &SnapModelProfileParams{
357357
PCRAlgorithm: tpm2.HashAlgorithmSHA256,
358358
PCRIndex: 12,
359359
Models: []*asserts.Model{
360360
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
361361
"authority-id": "fake-bran",
362-
"series": "l20",
362+
"series": "l16",
363363
"brand-id": "fake-bran",
364364
"model": "dfake-model",
365365
"grade": "secured",
@@ -369,7 +369,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile10(c *C) {
369369
values: []tpm2.PCRValues{
370370
{
371371
tpm2.HashAlgorithmSHA256: {
372-
12: decodeHexString(c, "28f90b2f338afc3064cc5a06af4ebf61f6f6f2e181057a5ea4350b90b3f417bd"),
372+
12: decodeHexString(c, "b6dfa17679ea768de6430c531da07e2f926320a1ec577c2edd97d4757dc6e45f"),
373373
},
374374
},
375375
},
@@ -385,7 +385,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile11(c *C) {
385385
Models: []*asserts.Model{
386386
s.makeMockCore20ModelAssertion(c, map[string]interface{}{
387387
"authority-id": "fake-brand",
388-
"series": "20",
388+
"series": "16",
389389
"brand-id": "fake-brand",
390390
"model": "fake-model",
391391
"grade": "dangerous",
@@ -395,7 +395,7 @@ func (s *snapModelProfileTest) TestAddSnapModelProfile11(c *C) {
395395
values: []tpm2.PCRValues{
396396
{
397397
tpm2.HashAlgorithmSHA256: {
398-
12: decodeHexString(c, "e644cdf6668fa8c675dddc21bdfdd0887381d9719faf1e44e882c3d34cc2bb5a"),
398+
12: decodeHexString(c, "27db1fa15c2fd09361f6812bca72c3285e889dd20fcfbbe509e153b302046820"),
399399
},
400400
},
401401
},

0 commit comments

Comments
 (0)