state

package
v0.0.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 29, 2024 License: Apache-2.0 Imports: 6 Imported by: 0

Documentation

Overview

Package state contains the definitions and utilities related to extracting information from an event log.

Index

Constants

This section is empty.

Variables

View Source
var (
	GCEConfidentialTechnology_name = map[int32]string{
		0: "NONE",
		1: "AMD_SEV",
		2: "AMD_SEV_ES",
		3: "INTEL_TDX",
		4: "AMD_SEV_SNP",
	}
	GCEConfidentialTechnology_value = map[string]int32{
		"NONE":        0,
		"AMD_SEV":     1,
		"AMD_SEV_ES":  2,
		"INTEL_TDX":   3,
		"AMD_SEV_SNP": 4,
	}
)

Enum value maps for GCEConfidentialTechnology.

View Source
var (
	WellKnownCertificate_name = map[int32]string{
		0: "UNKNOWN",
		1: "MS_WINDOWS_PROD_PCA_2011",
		2: "MS_THIRD_PARTY_UEFI_CA_2011",
	}
	WellKnownCertificate_value = map[string]int32{
		"UNKNOWN":                     0,
		"MS_WINDOWS_PROD_PCA_2011":    1,
		"MS_THIRD_PARTY_UEFI_CA_2011": 2,
	}
)

Enum value maps for WellKnownCertificate.

View Source
var (
	HashAlgo_name = map[int32]string{
		0:  "HASH_INVALID",
		4:  "SHA1",
		11: "SHA256",
		12: "SHA384",
		13: "SHA512",
	}
	HashAlgo_value = map[string]int32{
		"HASH_INVALID": 0,
		"SHA1":         4,
		"SHA256":       11,
		"SHA384":       12,
		"SHA512":       13,
	}
)

Enum value maps for HashAlgo.

View Source
var File_state_proto protoreflect.FileDescriptor

Functions

This section is empty.

Types

type Certificate

type Certificate struct {

	// The representation of the certificate. If the certificate matches a
	// well-known certificate above, representation should contain the value in
	// the enum. Otherwise, it will contain the raw DER.
	//
	// Types that are assignable to Representation:
	//
	//	*Certificate_Der
	//	*Certificate_WellKnown
	Representation isCertificate_Representation `protobuf_oneof:"representation"`
	// contains filtered or unexported fields
}

func (*Certificate) Descriptor deprecated

func (*Certificate) Descriptor() ([]byte, []int)

Deprecated: Use Certificate.ProtoReflect.Descriptor instead.

func (*Certificate) GetDer

func (x *Certificate) GetDer() []byte

func (*Certificate) GetRepresentation

func (m *Certificate) GetRepresentation() isCertificate_Representation

func (*Certificate) GetWellKnown

func (x *Certificate) GetWellKnown() WellKnownCertificate

func (*Certificate) ProtoMessage

func (*Certificate) ProtoMessage()

func (*Certificate) ProtoReflect

func (x *Certificate) ProtoReflect() protoreflect.Message

func (*Certificate) Reset

func (x *Certificate) Reset()

func (*Certificate) String

func (x *Certificate) String() string

type Certificate_Der

type Certificate_Der struct {
	// DER representation of the certificate.
	Der []byte `protobuf:"bytes,1,opt,name=der,proto3,oneof"`
}

type Certificate_WellKnown

type Certificate_WellKnown struct {
	WellKnown WellKnownCertificate `protobuf:"varint,2,opt,name=well_known,json=wellKnown,proto3,enum=state.WellKnownCertificate,oneof"`
}

type Database

type Database struct {
	Certs  []*Certificate `protobuf:"bytes,1,rep,name=certs,proto3" json:"certs,omitempty"`
	Hashes [][]byte       `protobuf:"bytes,2,rep,name=hashes,proto3" json:"hashes,omitempty"`
	// contains filtered or unexported fields
}

A Secure Boot database containing lists of hashes and certificates, as defined by section 32.4.1 Signature Database in the UEFI spec.

func (*Database) Descriptor deprecated

func (*Database) Descriptor() ([]byte, []int)

Deprecated: Use Database.ProtoReflect.Descriptor instead.

func (*Database) GetCerts

func (x *Database) GetCerts() []*Certificate

func (*Database) GetHashes

func (x *Database) GetHashes() [][]byte

func (*Database) ProtoMessage

func (*Database) ProtoMessage()

func (*Database) ProtoReflect

func (x *Database) ProtoReflect() protoreflect.Message

func (*Database) Reset

func (x *Database) Reset()

func (*Database) String

func (x *Database) String() string

type EfiApp

type EfiApp struct {

	// The PE/COFF digest of the EFI application (pulled from the raw event digest).
	Digest []byte `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
	// contains filtered or unexported fields
}

func (*EfiApp) Descriptor deprecated

func (*EfiApp) Descriptor() ([]byte, []int)

Deprecated: Use EfiApp.ProtoReflect.Descriptor instead.

func (*EfiApp) GetDigest

func (x *EfiApp) GetDigest() []byte

func (*EfiApp) ProtoMessage

func (*EfiApp) ProtoMessage()

func (*EfiApp) ProtoReflect

func (x *EfiApp) ProtoReflect() protoreflect.Message

func (*EfiApp) Reset

func (x *EfiApp) Reset()

func (*EfiApp) String

func (x *EfiApp) String() string

type EfiState

type EfiState struct {

	// UEFI's OS Loader code is required to measure attempts to load and execute
	// UEFI applications.
	// UEFI applications are typically bootloaders such as shim and GRUB.
	// These run and are measured using the UEFI LoadImage() service.
	Apps []*EfiApp `protobuf:"bytes,1,rep,name=apps,proto3" json:"apps,omitempty"`
	// contains filtered or unexported fields
}

The verified state of EFI Applications. Policy usage on this machine state should check the entire set of EFI App digests matches, not a subset.

func (*EfiState) Descriptor deprecated

func (*EfiState) Descriptor() ([]byte, []int)

Deprecated: Use EfiState.ProtoReflect.Descriptor instead.

func (*EfiState) GetApps

func (x *EfiState) GetApps() []*EfiApp

func (*EfiState) ProtoMessage

func (*EfiState) ProtoMessage()

func (*EfiState) ProtoReflect

func (x *EfiState) ProtoReflect() protoreflect.Message

func (*EfiState) Reset

func (x *EfiState) Reset()

func (*EfiState) String

func (x *EfiState) String() string

type Event

type Event struct {

	// The register this event was extended into. Can be PCR, RTMR, etc.
	// Named pcr_index for backcompat reasons.
	PcrIndex uint32 `protobuf:"varint,1,opt,name=pcr_index,json=pcrIndex,proto3" json:"pcr_index,omitempty"`
	// The type of this event. Note that this value is not verified, so it should
	// only be used as a hint during event parsing.
	UntrustedType uint32 `protobuf:"varint,2,opt,name=untrusted_type,json=untrustedType,proto3" json:"untrusted_type,omitempty"`
	// The raw data associated to this event. The meaning of this data is
	// specific to the type of the event.
	Data []byte `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
	// The event digest actually extended into the TPM. This is often the hash of
	// the data field, but in some cases it may have a type-specific calculation.
	Digest []byte `protobuf:"bytes,4,opt,name=digest,proto3" json:"digest,omitempty"`
	// This is true if hash(data) == digest.
	DigestVerified bool `protobuf:"varint,5,opt,name=digest_verified,json=digestVerified,proto3" json:"digest_verified,omitempty"`
	// contains filtered or unexported fields
}

A parsed event from the source firmware event log. This can be from either the firmware TPM event log, the Confidential Computing event log, or any other TCG-like event log used by firmware to record its measurements.

func (*Event) Descriptor deprecated

func (*Event) Descriptor() ([]byte, []int)

Deprecated: Use Event.ProtoReflect.Descriptor instead.

func (*Event) GetData

func (x *Event) GetData() []byte

func (*Event) GetDigest

func (x *Event) GetDigest() []byte

func (*Event) GetDigestVerified

func (x *Event) GetDigestVerified() bool

func (*Event) GetPcrIndex

func (x *Event) GetPcrIndex() uint32

func (*Event) GetUntrustedType

func (x *Event) GetUntrustedType() uint32

func (*Event) ProtoMessage

func (*Event) ProtoMessage()

func (*Event) ProtoReflect

func (x *Event) ProtoReflect() protoreflect.Message

func (*Event) Reset

func (x *Event) Reset()

func (*Event) String

func (x *Event) String() string

type FirmwareLogState

type FirmwareLogState struct {
	Platform   *PlatformState   `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
	SecureBoot *SecureBootState `protobuf:"bytes,2,opt,name=secure_boot,json=secureBoot,proto3" json:"secure_boot,omitempty"`
	// The complete parsed Firmware Event Log, including those events used to
	// create this MachineState.
	RawEvents []*Event `protobuf:"bytes,3,rep,name=raw_events,json=rawEvents,proto3" json:"raw_events,omitempty"`
	// The hash algorithm used to calculate event digests to verify a log entry.
	Hash        HashAlgo          `protobuf:"varint,4,opt,name=hash,proto3,enum=state.HashAlgo" json:"hash,omitempty"`
	Grub        *GrubState        `protobuf:"bytes,5,opt,name=grub,proto3" json:"grub,omitempty"`
	LinuxKernel *LinuxKernelState `protobuf:"bytes,6,opt,name=linux_kernel,json=linuxKernel,proto3" json:"linux_kernel,omitempty"`
	Efi         *EfiState         `protobuf:"bytes,8,opt,name=efi,proto3" json:"efi,omitempty"`
	// contains filtered or unexported fields
}

The verified state of a booted machine, obtained from a UEFI event log. The state is extracted from either EFI_TCG2_PROTOCOL or EFI_CC_MEASUREMENT_PROTOCOL. Both of these follow the TCG-defined format in https://trustedcomputinggroup.org/resource/tcg-efi-protocol-specification/ The TCG2-related (TPM) logs are structured using TCG_PCR_EVENT (SHA1 format) or TCG_PCR_EVENT2 (Crypto Agile format). The CC logs are structured using CC_EVENT.

func (*FirmwareLogState) Descriptor deprecated

func (*FirmwareLogState) Descriptor() ([]byte, []int)

Deprecated: Use FirmwareLogState.ProtoReflect.Descriptor instead.

func (*FirmwareLogState) GetEfi

func (x *FirmwareLogState) GetEfi() *EfiState

func (*FirmwareLogState) GetGrub

func (x *FirmwareLogState) GetGrub() *GrubState

func (*FirmwareLogState) GetHash

func (x *FirmwareLogState) GetHash() HashAlgo

func (*FirmwareLogState) GetLinuxKernel

func (x *FirmwareLogState) GetLinuxKernel() *LinuxKernelState

func (*FirmwareLogState) GetPlatform

func (x *FirmwareLogState) GetPlatform() *PlatformState

func (*FirmwareLogState) GetRawEvents

func (x *FirmwareLogState) GetRawEvents() []*Event

func (*FirmwareLogState) GetSecureBoot

func (x *FirmwareLogState) GetSecureBoot() *SecureBootState

func (*FirmwareLogState) ProtoMessage

func (*FirmwareLogState) ProtoMessage()

func (*FirmwareLogState) ProtoReflect

func (x *FirmwareLogState) ProtoReflect() protoreflect.Message

func (*FirmwareLogState) Reset

func (x *FirmwareLogState) Reset()

func (*FirmwareLogState) String

func (x *FirmwareLogState) String() string

type GCEConfidentialTechnology

type GCEConfidentialTechnology int32

Type of hardware technology used to protect this instance

const (
	GCEConfidentialTechnology_NONE        GCEConfidentialTechnology = 0
	GCEConfidentialTechnology_AMD_SEV     GCEConfidentialTechnology = 1
	GCEConfidentialTechnology_AMD_SEV_ES  GCEConfidentialTechnology = 2
	GCEConfidentialTechnology_INTEL_TDX   GCEConfidentialTechnology = 3
	GCEConfidentialTechnology_AMD_SEV_SNP GCEConfidentialTechnology = 4
)

func (GCEConfidentialTechnology) Descriptor

func (GCEConfidentialTechnology) Enum

func (GCEConfidentialTechnology) EnumDescriptor deprecated

func (GCEConfidentialTechnology) EnumDescriptor() ([]byte, []int)

Deprecated: Use GCEConfidentialTechnology.Descriptor instead.

func (GCEConfidentialTechnology) Number

func (GCEConfidentialTechnology) String

func (x GCEConfidentialTechnology) String() string

func (GCEConfidentialTechnology) Type

type GCEInstanceInfo

type GCEInstanceInfo struct {
	Zone          string `protobuf:"bytes,1,opt,name=zone,proto3" json:"zone,omitempty"`
	ProjectId     string `protobuf:"bytes,2,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
	ProjectNumber uint64 `protobuf:"varint,3,opt,name=project_number,json=projectNumber,proto3" json:"project_number,omitempty"`
	InstanceName  string `protobuf:"bytes,4,opt,name=instance_name,json=instanceName,proto3" json:"instance_name,omitempty"`
	InstanceId    uint64 `protobuf:"varint,5,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
	// contains filtered or unexported fields
}

Information uniquely identifying a GCE instance. Can be used to create an instance URL, which can then be used with GCE APIs. Formatted like:

https://www.googleapis.com/compute/v1/projects/{project_id}/zones/{zone}/instances/{instance_name}

func (*GCEInstanceInfo) Descriptor deprecated

func (*GCEInstanceInfo) Descriptor() ([]byte, []int)

Deprecated: Use GCEInstanceInfo.ProtoReflect.Descriptor instead.

func (*GCEInstanceInfo) GetInstanceId

func (x *GCEInstanceInfo) GetInstanceId() uint64

func (*GCEInstanceInfo) GetInstanceName

func (x *GCEInstanceInfo) GetInstanceName() string

func (*GCEInstanceInfo) GetProjectId

func (x *GCEInstanceInfo) GetProjectId() string

func (*GCEInstanceInfo) GetProjectNumber

func (x *GCEInstanceInfo) GetProjectNumber() uint64

func (*GCEInstanceInfo) GetZone

func (x *GCEInstanceInfo) GetZone() string

func (*GCEInstanceInfo) ProtoMessage

func (*GCEInstanceInfo) ProtoMessage()

func (*GCEInstanceInfo) ProtoReflect

func (x *GCEInstanceInfo) ProtoReflect() protoreflect.Message

func (*GCEInstanceInfo) Reset

func (x *GCEInstanceInfo) Reset()

func (*GCEInstanceInfo) String

func (x *GCEInstanceInfo) String() string

type GrubFile

type GrubFile struct {

	// The digest of the file (pulled from the raw event digest).
	Digest []byte `protobuf:"bytes,1,opt,name=digest,proto3" json:"digest,omitempty"`
	// The event data. This is not measured, so it is untrusted.
	UntrustedFilename []byte `protobuf:"bytes,2,opt,name=untrusted_filename,json=untrustedFilename,proto3" json:"untrusted_filename,omitempty"`
	// contains filtered or unexported fields
}

func (*GrubFile) Descriptor deprecated

func (*GrubFile) Descriptor() ([]byte, []int)

Deprecated: Use GrubFile.ProtoReflect.Descriptor instead.

func (*GrubFile) GetDigest

func (x *GrubFile) GetDigest() []byte

func (*GrubFile) GetUntrustedFilename

func (x *GrubFile) GetUntrustedFilename() []byte

func (*GrubFile) ProtoMessage

func (*GrubFile) ProtoMessage()

func (*GrubFile) ProtoReflect

func (x *GrubFile) ProtoReflect() protoreflect.Message

func (*GrubFile) Reset

func (x *GrubFile) Reset()

func (*GrubFile) String

func (x *GrubFile) String() string

type GrubState

type GrubState struct {

	// All GRUB-read and measured files, including grub.cfg.
	Files []*GrubFile `protobuf:"bytes,1,rep,name=files,proto3" json:"files,omitempty"`
	// A list of executed GRUB commands and command lines passed to the kernel
	// and kernel modules.
	Commands []string `protobuf:"bytes,2,rep,name=commands,proto3" json:"commands,omitempty"`
	// contains filtered or unexported fields
}

func (*GrubState) Descriptor deprecated

func (*GrubState) Descriptor() ([]byte, []int)

Deprecated: Use GrubState.ProtoReflect.Descriptor instead.

func (*GrubState) GetCommands

func (x *GrubState) GetCommands() []string

func (*GrubState) GetFiles

func (x *GrubState) GetFiles() []*GrubFile

func (*GrubState) ProtoMessage

func (*GrubState) ProtoMessage()

func (*GrubState) ProtoReflect

func (x *GrubState) ProtoReflect() protoreflect.Message

func (*GrubState) Reset

func (x *GrubState) Reset()

func (*GrubState) String

func (x *GrubState) String() string

type HashAlgo

type HashAlgo int32

Enum values come from the TCG Algorithm Registry - v1.27 - Table 3.

const (
	HashAlgo_HASH_INVALID HashAlgo = 0
	HashAlgo_SHA1         HashAlgo = 4
	HashAlgo_SHA256       HashAlgo = 11
	HashAlgo_SHA384       HashAlgo = 12
	HashAlgo_SHA512       HashAlgo = 13
)

func (HashAlgo) CryptoHash

func (ha HashAlgo) CryptoHash() (crypto.Hash, error)

CryptoHash converts the TCG registry hash identifier to a crypto.Hash.

func (HashAlgo) Descriptor

func (HashAlgo) Descriptor() protoreflect.EnumDescriptor

func (HashAlgo) Enum

func (x HashAlgo) Enum() *HashAlgo

func (HashAlgo) EnumDescriptor deprecated

func (HashAlgo) EnumDescriptor() ([]byte, []int)

Deprecated: Use HashAlgo.Descriptor instead.

func (HashAlgo) Number

func (x HashAlgo) Number() protoreflect.EnumNumber

func (HashAlgo) String

func (x HashAlgo) String() string

func (HashAlgo) Type

type LinuxKernelState

type LinuxKernelState struct {

	// The kernel command line.
	CommandLine string `protobuf:"bytes,1,opt,name=command_line,json=commandLine,proto3" json:"command_line,omitempty"`
	// contains filtered or unexported fields
}

The state of the Linux kernel. At the moment, parsing LinuxKernelState relies on parsing the GrubState. To do so, use ExtractOpts{Loader: GRUB} when calling ParseMachineState.

func (*LinuxKernelState) Descriptor deprecated

func (*LinuxKernelState) Descriptor() ([]byte, []int)

Deprecated: Use LinuxKernelState.ProtoReflect.Descriptor instead.

func (*LinuxKernelState) GetCommandLine

func (x *LinuxKernelState) GetCommandLine() string

func (*LinuxKernelState) ProtoMessage

func (*LinuxKernelState) ProtoMessage()

func (*LinuxKernelState) ProtoReflect

func (x *LinuxKernelState) ProtoReflect() protoreflect.Message

func (*LinuxKernelState) Reset

func (x *LinuxKernelState) Reset()

func (*LinuxKernelState) String

func (x *LinuxKernelState) String() string

type PlatformState

type PlatformState struct {

	// Types that are assignable to Firmware:
	//
	//	*PlatformState_ScrtmVersionId
	//	*PlatformState_GceVersion
	Firmware isPlatformState_Firmware `protobuf_oneof:"firmware"`
	// Set to NONE on non-GCE instances or non-Confidential Shielded GCE instances
	Technology GCEConfidentialTechnology `protobuf:"varint,3,opt,name=technology,proto3,enum=state.GCEConfidentialTechnology" json:"technology,omitempty"`
	// Only set for GCE instances.
	// Included for backcompat. go-eventlog should NOT set this field.
	InstanceInfo *GCEInstanceInfo `protobuf:"bytes,4,opt,name=instance_info,json=instanceInfo,proto3" json:"instance_info,omitempty"`
	// contains filtered or unexported fields
}

The platform/firmware state for this instance

func (*PlatformState) Descriptor deprecated

func (*PlatformState) Descriptor() ([]byte, []int)

Deprecated: Use PlatformState.ProtoReflect.Descriptor instead.

func (*PlatformState) GetFirmware

func (m *PlatformState) GetFirmware() isPlatformState_Firmware

func (*PlatformState) GetGceVersion

func (x *PlatformState) GetGceVersion() uint32

func (*PlatformState) GetInstanceInfo

func (x *PlatformState) GetInstanceInfo() *GCEInstanceInfo

func (*PlatformState) GetScrtmVersionId

func (x *PlatformState) GetScrtmVersionId() []byte

func (*PlatformState) GetTechnology

func (x *PlatformState) GetTechnology() GCEConfidentialTechnology

func (*PlatformState) ProtoMessage

func (*PlatformState) ProtoMessage()

func (*PlatformState) ProtoReflect

func (x *PlatformState) ProtoReflect() protoreflect.Message

func (*PlatformState) Reset

func (x *PlatformState) Reset()

func (*PlatformState) String

func (x *PlatformState) String() string

type PlatformState_GceVersion

type PlatformState_GceVersion struct {
	// Virtual GCE firmware version (parsed from S-CRTM version id)
	GceVersion uint32 `protobuf:"varint,2,opt,name=gce_version,json=gceVersion,proto3,oneof"`
}

type PlatformState_ScrtmVersionId

type PlatformState_ScrtmVersionId struct {
	// Raw S-CRTM version identifier (EV_S_CRTM_VERSION)
	ScrtmVersionId []byte `protobuf:"bytes,1,opt,name=scrtm_version_id,json=scrtmVersionId,proto3,oneof"`
}

type SecureBootState

type SecureBootState struct {

	// Whether Secure Boot is enabled.
	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// The Secure Boot signature (allowed) database.
	Db *Database `protobuf:"bytes,2,opt,name=db,proto3" json:"db,omitempty"`
	// The Secure Boot revoked signature (forbidden) database.
	Dbx *Database `protobuf:"bytes,3,opt,name=dbx,proto3" json:"dbx,omitempty"`
	// Authority events post-separator. Pre-separator authorities
	// are currently not supported.
	Authority *Database `protobuf:"bytes,4,opt,name=authority,proto3" json:"authority,omitempty"`
	// contains filtered or unexported fields
}

The Secure Boot state for this instance.

func (*SecureBootState) Descriptor deprecated

func (*SecureBootState) Descriptor() ([]byte, []int)

Deprecated: Use SecureBootState.ProtoReflect.Descriptor instead.

func (*SecureBootState) GetAuthority

func (x *SecureBootState) GetAuthority() *Database

func (*SecureBootState) GetDb

func (x *SecureBootState) GetDb() *Database

func (*SecureBootState) GetDbx

func (x *SecureBootState) GetDbx() *Database

func (*SecureBootState) GetEnabled

func (x *SecureBootState) GetEnabled() bool

func (*SecureBootState) ProtoMessage

func (*SecureBootState) ProtoMessage()

func (*SecureBootState) ProtoReflect

func (x *SecureBootState) ProtoReflect() protoreflect.Message

func (*SecureBootState) Reset

func (x *SecureBootState) Reset()

func (*SecureBootState) String

func (x *SecureBootState) String() string

type WellKnownCertificate

type WellKnownCertificate int32

Common, publicly-listed certificates by different vendors.

const (
	WellKnownCertificate_UNKNOWN WellKnownCertificate = 0
	// Microsoft certs:
	// https://go.microsoft.com/fwlink/p/?linkid=321192
	WellKnownCertificate_MS_WINDOWS_PROD_PCA_2011 WellKnownCertificate = 1
	// https://go.microsoft.com/fwlink/p/?linkid=321194
	WellKnownCertificate_MS_THIRD_PARTY_UEFI_CA_2011 WellKnownCertificate = 2
)

func (WellKnownCertificate) Descriptor

func (WellKnownCertificate) Enum

func (WellKnownCertificate) EnumDescriptor deprecated

func (WellKnownCertificate) EnumDescriptor() ([]byte, []int)

Deprecated: Use WellKnownCertificate.Descriptor instead.

func (WellKnownCertificate) Number

func (WellKnownCertificate) String

func (x WellKnownCertificate) String() string

func (WellKnownCertificate) Type

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL