COCOS-326 - Cocos vTPM support by danko-miladinovic · Pull Request #376 · ultravioletrs/cocos

danko-miladinovic · 2025-02-14T17:54:43Z

What type of PR is this?

This is a feature that introduces vTPM support to Cocos. vTPM will allow Cocos to measure:

Kernel
Initial RAM file system
Kernel command line
Much more, as vTPM has multiple PCR registers that can be extended with arbitrary

What does this do?

This PR introduces vTPM support for:

Manager so it can boot CVMs with vTPM.
Agent so it can communicate and fetch the vTPM and SNP attestation report.
CLI so the CLI can fetch the vTPM and SNP attestation report.

Also:

Rust script has been changed to include default PCR values.
aTLS has been changed to include vTPM quotes.
verification has been changed to include vTPM verification.

Which issue(s) does this PR fix/relate to?

Resolves Explore vTPM and how we can use it with remote attestations #326

Have you included tests for your changes?

Tests are in progress.

Did you document any new/modified feature?

Documentation is in progress.

Notes

…ctly

codecov · 2025-02-28T19:17:01Z

Codecov Report

Attention: Patch coverage is 30.54187% with 282 lines in your changes missing coverage. Please review.

Project coverage is 56.66%. Comparing base (7d063aa) to head (e4e5c0e).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/attestation/vtpm/vtpm.go	0.00%	204 Missing ⚠️
pkg/atls/atlsListener.go	0.00%	21 Missing ⚠️
cli/attestation.go	77.46%	16 Missing ⚠️
agent/service.go	41.66%	14 Missing ⚠️
internal/server/grpc/grpc.go	25.00%	6 Missing and 3 partials ⚠️
pkg/attestation/quoteprovider/sev.go	46.15%	6 Missing and 1 partial ⚠️
agent/api/grpc/server.go	54.54%	3 Missing and 2 partials ⚠️
agent/api/grpc/requests.go	60.00%	2 Missing ⚠️
manager/attestation_policy.go	0.00%	2 Missing ⚠️
agent/cvms/server/cvm.go	0.00%	1 Missing ⚠️
... and 1 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #376      +/-   ##
==========================================
- Coverage   58.89%   56.66%   -2.23%     
==========================================
  Files          56       58       +2     
  Lines        4695     4998     +303     
==========================================
+ Hits         2765     2832      +67     
- Misses       1635     1868     +233     
- Partials      295      298       +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

dborovcanin

Can you add some more tests to increase coverage?

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

NOISSUE - Add mock for LeveledQuoteProvider when SEV-SNP device is not found

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

NOISSUE - PCR15 bug

dborovcanin · 2025-03-07T11:58:41Z

 }

-func prepareForTestVerifyAttestationReport(t *testing.T) ([]byte, []byte) {
+func prepareForTestVerifyAttestationReport(t *testing.T) (*sevsnp.Attestation, []byte) {


Rename to something shorter like prepVerifyAttReport.

dborovcanin · 2025-03-07T12:11:41Z

@@ -0,0 +1,26 @@
+// Copyright (c) Ultraviolet


If this is only used in gRPC test, you can move it to the gRPC test file.

Yes. Done. Thank you.

dborovcanin · 2025-03-07T12:15:43Z

+	return derBytes, nil
+}
+
+func createTEEAttestationReportNonce(pubKeyTLS []byte, ak []byte, nonce []byte) ([]byte, error) {


Rename to teeAttestReportNonce. Let's use attest as the abbreviation for attestations all over the codebase for the sake of simplicity.

Done. The rest of the renaming will be done in a separate PR.

dborovcanin · 2025-03-07T12:16:58Z

+    }
+  }
+}
+


Please add an empty line (that is, if it does not mess up unmarshalling).

dborovcanin · 2025-03-07T12:17:10Z

    "product_line": "Milan"
  }
-}
+}


Ad the empty line.

danko-miladinovic force-pushed the vtpm branch from adfe58e to 7134ffc Compare February 21, 2025 17:55

danko-miladinovic marked this pull request as ready for review February 28, 2025 18:17

danko-miladinovic added 13 commits February 28, 2025 18:24

manager, cli and agent vtpm support

97e39e4

rebase and changed atls for vtpm

1614530

deleted unused code

44e2674

changed chekproto.yaml script so it find the manager proto file corre…

538501d

…ctly

fixe manager proto version

777f351

fix agent tests

9491597

fix server agent test

39eb74a

fix attestation test

92037b1

fix attestation test gofumpt

1bc3b05

created dummy RWC for TPM

734fe1c

fix comment

c0464ca

add default PCR values

8e988d5

rebase main

900ff13

danko-miladinovic force-pushed the vtpm branch from f5ef5de to 900ff13 Compare February 28, 2025 18:32

danko-miladinovic added 4 commits February 28, 2025 18:38

fix rust ci and missing header

55e39ee

changed embedded attestation to VMPL 2

07e295c

fix unused impot

a41699d

fix pkg test

fa86568

danko-miladinovic requested review from SammyOina and dborovcanin February 28, 2025 19:17

dborovcanin requested changes Mar 3, 2025

View reviewed changes

Comment thread agent/api/grpc/requests.go Outdated

SammyOina requested changes Mar 3, 2025

View reviewed changes

Comment thread agent/api/grpc/endpoint_test.go Outdated

danko-miladinovic added 2 commits March 3, 2025 16:54

address attestation type

d1770f7

fix agent attestation test

81e763a

SammyOina requested changes Mar 5, 2025

View reviewed changes

danko-miladinovic added 2 commits March 5, 2025 11:58

add prc15 check

40577c2

fix comments

7b541f3

danko-miladinovic and others added 7 commits March 5, 2025 12:57

fix cli tests

a65d0a0

add doc

23da730

add mock for LeveledQuoteProvider when SEV-SNP device is not found

1c3fdc2

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

Merge pull request #1 from SammyOina/regular-vm-qp

c655abb

NOISSUE - Add mock for LeveledQuoteProvider when SEV-SNP device is not found

fix manager reading attestation policy

776dcc2

refactor PCR value checks and update attestation policy values

468c771

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

Merge pull request #2 from SammyOina/pcr-bug

5a5cf62

NOISSUE - PCR15 bug

SammyOina approved these changes Mar 6, 2025

View reviewed changes

dborovcanin requested changes Mar 7, 2025

View reviewed changes

fix tests for sev and grpc

e4e5c0e

dborovcanin approved these changes Mar 7, 2025

View reviewed changes

dborovcanin merged commit 67f939f into ultravioletrs:main Mar 7, 2025

danko-miladinovic deleted the vtpm branch August 8, 2025 15:31

+                  }
+                }
+              }
+                    No newline at end of file

Uh oh!

Conversation

danko-miladinovic commented Feb 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What does this do?

Which issue(s) does this PR fix/relate to?

Have you included tests for your changes?

Did you document any new/modified feature?

Notes

Uh oh!

codecov Bot commented Feb 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dborovcanin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

danko-miladinovic commented Feb 14, 2025 •

edited

Loading

codecov Bot commented Feb 28, 2025 •

edited

Loading