testing

Documentation

Overview

Package testing defines fakes and mocks for the sev-guest device and AMD-SP.

Index

• func CustomVcekExtensions(tcb kds.TCBParts, hwid [64]byte) []pkix.Extension
• func DefaultArk() (*rsa.PrivateKey, error)
• func DefaultAsk() (*rsa.PrivateKey, error)
• func DefaultVcek() (*ecdsa.PrivateKey, error)
• func DerivedKeyRequestToString(req *labi.SnpDerivedKeyReqABI) string
• func FindChipTcbCerts(database *kpb.Certificates, chipID []byte) map[uint64][]byte
• func GetKDS(t testing.TB) trust.HTTPSGetter
• func Match(got error, want string) bool
• func TestRawReport(reportData [64]byte) [labi.SnpReportRespReportSize]byte
• func TestUseKDS() bool
• type AmdKeys
  • func DefaultAmdKeys() (*AmdKeys, error)
• type AmdSigner
  • func DefaultCertChain(productName string, creationTime time.Time) (*AmdSigner, error)
  • func (s *AmdSigner) CertTableBytes() ([]byte, error)
  • func (s *AmdSigner) Sign(toSign []byte) (*big.Int, *big.Int, error)
• type AmdSignerBuilder
  • func (b *AmdSignerBuilder) CertChain() (*AmdSigner, error)
• type CertOverride
• type Device
  • func TcDevice(tcs []TestCase, opts *DeviceOptions) (*Device, error)
  • func (d *Device) Close() error
  • func (d *Device) Ioctl(command uintptr, req any) (uintptr, error)
  • func (d *Device) Open(_ string) error
  • func (d *Device) Product() *spb.SevProduct
• type DeviceOptions
• type FakeKDS
  • func FakeKDSFromFile(path string) (*FakeKDS, error)
  • func FakeKDSFromSigner(signer *AmdSigner) (*FakeKDS, error)
  • func (f *FakeKDS) Get(url string) ([]byte, error)
• type GetReportResponse
• type GetResponse
• type Getter
  • func SimpleGetter(responses map[string][]byte) *Getter
  • func (g *Getter) Done(t testing.TB)
  • func (g *Getter) Get(url string) ([]byte, error)
• type TestCase
  • func TestCases() []TestCase

Functions

func CustomVcekExtensions

func CustomVcekExtensions(tcb kds.TCBParts, hwid [64]byte) []pkix.Extension

CustomVcekExtensions returns an array of extensions following the KDS specification for the given values.

func DefaultArk

func DefaultArk() (*rsa.PrivateKey, error)

DefaultArk returns a new RSA key with the expected size for an ARK.

func DefaultAsk

func DefaultAsk() (*rsa.PrivateKey, error)

DefaultAsk returns a new RSA key with the expected size for an ASK.

func DefaultVcek

func DefaultVcek() (*ecdsa.PrivateKey, error)

DefaultVcek returns a new ECDSA key on the expected curve for a VCEK.

func DerivedKeyRequestToString

func DerivedKeyRequestToString(req *labi.SnpDerivedKeyReqABI) string

DerivedKeyRequestToString translates a DerivedKeyReqABI into a map key string representation.

func FindChipTcbCerts

func FindChipTcbCerts(database *kpb.Certificates, chipID []byte) map[uint64][]byte

FindChipTcbCerts returns the TcbCerts associated with the given chipID in the database if they exist. If not, returns nil.

func GetKDS

func GetKDS(t testing.TB) trust.HTTPSGetter

GetKDS returns an HTTPSGetter that can produce the expected certificates for a given URL in the test environment.

func Match

func Match(got error, want string) bool

Match returns true iff both errors match expectations closely enough

func TestRawReport

func TestRawReport(reportData [64]byte) [labi.SnpReportRespReportSize]byte

TestRawReport creates simple raw attestation report with the given REPORT_DATA. We can't sign the report with AMD keys, and verification isn't the client's responsibility, so we keep the signature zeros. Similarly, we leave the randomly-generated fields zero.

func TestUseKDS

func TestUseKDS() bool

TestUseKDS returns whether tests should use the network to connect the live AMD Key Distribution service.

Types

type AmdKeys

type AmdKeys struct {
	Ark  *rsa.PrivateKey
	Ask  *rsa.PrivateKey
	Vcek *ecdsa.PrivateKey
}

AmdKeys encapsulates the key chain of ARK through ASK down to VCEK.

func DefaultAmdKeys

func DefaultAmdKeys() (*AmdKeys, error)

DefaultAmdKeys returns a key set for ARK, ASK, and VCEK with the expected key type and size.

type AmdSigner

type AmdSigner struct {
	Ark  *x509.Certificate
	Ask  *x509.Certificate
	Vcek *x509.Certificate
	Keys *AmdKeys
	// This identity does not match AMD's notion of an HWID. It is purely to combine expectations of
	// report data -> KDS URL construction for the fake KDS implementation.
	HWID [abi.ChipIDSize]byte
	TCB  kds.TCBVersion
}

AmdSigner encapsulates a key and certificate chain following the format of AMD-SP's VCEK for signing attestation reports.

func DefaultCertChain

func DefaultCertChain(productName string, creationTime time.Time) (*AmdSigner, error)

DefaultCertChain creates a test-only certificate chain for a fake attestation signer.

func (*AmdSigner) CertTableBytes

func (s *AmdSigner) CertTableBytes() ([]byte, error)

CertTableBytes outputs the certificates in AMD's ABI format.

func (*AmdSigner) Sign

func (s *AmdSigner) Sign(toSign []byte) (*big.Int, *big.Int, error)

Sign takes a chunk of bytes, signs it with VcekPriv, and returns the R, S pair for the signature in little endian format.

type AmdSignerBuilder

type AmdSignerBuilder struct {
	// Keys contains the private keys that will get a certificate chain structure.
	Keys             *AmdKeys
	Product          string
	ArkCreationTime  time.Time
	AskCreationTime  time.Time
	VcekCreationTime time.Time
	ArkCustom        CertOverride
	AskCustom        CertOverride
	VcekCustom       CertOverride
	HWID             [abi.ChipIDSize]byte
	TCB              kds.TCBVersion
	// Intermediate built certificates
	Ark  *x509.Certificate
	Ask  *x509.Certificate
	Vcek *x509.Certificate
}

AmdSignerBuilder represents toggleable configurations of the VCEK certificate chain.

func (*AmdSignerBuilder) CertChain

func (b *AmdSignerBuilder) CertChain() (*AmdSigner, error)

CertChain creates a test-only certificate chain from the keys and configurables in b.

type CertOverride

type CertOverride struct {
	// If 0, interpreted as Version, otherwise the ARK cert version number.
	Version            int
	SerialNumber       *big.Int
	Issuer             *pkix.Name
	Subject            *pkix.Name
	SignatureAlgorithm x509.SignatureAlgorithm
	PublicKeyAlgorithm x509.PublicKeyAlgorithm
	KeyUsage           x509.KeyUsage
	// If nil, interpreted as default, otherwise the CRLDistributionPoints for the cert.
	CRLDistributionPoints []string
	// If nil, interpreted as default list.
	Extensions []pkix.Extension
}

CertOverride encapsulates certificate aspects that can be overridden when creating a certificate chain.

type Device

type Device struct {
	ReportDataRsp map[string]any
	Keys          map[string][]byte
	Certs         []byte
	Signer        *AmdSigner
	SevProduct    *spb.SevProduct
	// contains filtered or unexported fields
}

Device represents a sev-guest driver implementation with pre-programmed responses to commands.

func TcDevice

func TcDevice(tcs []TestCase, opts *DeviceOptions) (*Device, error)

TcDevice returns a mock device populated from test cases' inputs and expected outputs.

func (*Device) Close

func (d *Device) Close() error

Close changes the mock device's state to closed.

func (*Device) Ioctl

func (d *Device) Ioctl(command uintptr, req any) (uintptr, error)

Ioctl mocks commands with pre-specified responses for a finite number of requests.

func (*Device) Open

func (d *Device) Open(_ string) error

Open changes the mock device's state to open.

func (*Device) Product

func (d *Device) Product() *spb.SevProduct

Product returns the mocked product info or the default.

type DeviceOptions

type DeviceOptions struct {
	Keys   map[string][]byte
	Now    time.Time
	Signer *AmdSigner
}

DeviceOptions specifies customizations for a fake sev-guest device.

type FakeKDS

type FakeKDS struct {
	Certs *kpb.Certificates
	// Two CERTIFICATE PEMs for ASK, then ARK, per product
	RootBundles map[string]string
}

FakeKDS implements the verify.HTTPSGetter interface to provide certificates like AMD KDS, but with certificates cached in a protobuf.

func FakeKDSFromFile

func FakeKDSFromFile(path string) (*FakeKDS, error)

FakeKDSFromFile returns a FakeKDS from a path to a serialized fakekds.Certificates message.

func FakeKDSFromSigner

func FakeKDSFromSigner(signer *AmdSigner) (*FakeKDS, error)

FakeKDSFromSigner returns a FakeKDS that produces the fake signer's certificates following the AMD KDS REST API expectations.

func (*FakeKDS) Get

func (f *FakeKDS) Get(url string) ([]byte, error)

Get translates a KDS url into the expected certificate as represented in the fake's certificate database.

type GetReportResponse

type GetReportResponse struct {
	Resp     labi.SnpReportRespABI
	EsResult labi.EsResult
	FwErr    abi.SevFirmwareStatus
}

GetReportResponse represents a mocked response to a command request.

type GetResponse

type GetResponse struct {
	Occurrences uint
	Body        []byte
	Error       error
}

GetResponse controls how often (Occurrences) a certain response should be provided.

type Getter

type Getter struct {
	Responses map[string][]GetResponse
}

Getter is a mock for HTTPSGetter interface that sequentially returns the configured responses for the provided URL. Responses are returned as a queue, i.e., always serving from index 0.

func SimpleGetter

func SimpleGetter(responses map[string][]byte) *Getter

SimpleGetter constructs a static server from url -> body responses. For more elaborate tests, construct a custom Getter.

func (*Getter) Done

func (g *Getter) Done(t testing.TB)

Done checks that all configured responses have been consumed, and errors otherwise.

func (*Getter) Get

func (g *Getter) Get(url string) ([]byte, error)

Get the next response body and error. The response is also removed, if it has been requested the configured number of times.

type TestCase

type TestCase struct {
	Name        string
	Input       [64]byte
	Output      [labi.SnpReportRespReportSize]byte
	OutputProto string
	FwErr       abi.SevFirmwareStatus
	EsResult    labi.EsResult
	WantErr     string
}

TestCase represents a get_report input/output test case.

func TestCases

func TestCases() []TestCase

TestCases returns common test cases for get_report.