Merge pull request #11 from boxboat/feature/upstream-pub-hash

Trust based on EKPub

.gitignore

@@ -3,5 +3,8 @@
 /tpm_attestor_agent
 /get_tpm_pubhash
 
+# releases
+/spire-tpm-plugin-*.tar.gz
+
 # jetbrains
 .idea

README.md

@@ -41,26 +41,48 @@ NodeAttestor "tpm" {
 	plugin_checksum = "sha256 of the plugin binary"
 	plugin_data {
 		ca_path = "/opt/spire/.data/certs"
+		hash_path = "/opt/spire/.data/hashes"
 	}
 }
 ```
 
 | key | type | required | description | default |
 |:----|:-----|:---------|:------------|:--------|
-| ca_path  | string |   | the path to the CA directory | /opt/spire/.data/certs |
+| ca_path | string |   | the path to the CA directory | /opt/spire/.data/certs |
+| hash_path | string |   | the path to the Hash directory | /opt/spire/.data/hashes |
 
-### Certificate Directory Configuration
+### Directory Configuration
 
-For this plugin to work, you need to have the certificate for the CA that signed your TPM's EK certificate. Drop all CA certs in the directory `ca_path`.
+For this plugin to work, either `ca_path`, `hash_path`, or both must be configured.
+
+#### Certificate Directory
+
+Contains the manufacturer CA cert that signed the TPM's EK certificate in PEM or DER format. Drop all manufacturer CA certs in the directory `ca_path`.
+
+*Note: not all TPM's have an EK certificate, if yours does not then use `hash_path`*
+
+#### Hash Directory
+
+Contains empty files named after the EK public key hash.  Use the `get_tpm_pubhash` command to print out the TPM's EK public key hash.  Example:
+
+```bash
+agent  $ ./get_tpm_pubhash
+1b5bbe2e96054f7bc34ebe7ba9a4a9eac5611c6879285ceff6094fa556af485c 
+
+server $ mkdir -p /opt/spire/.data/hashes
+server $ touch /opt/spire/.data/hashes/1b5bbe2e96054f7bc34ebe7ba9a4a9eac5611c6879285ceff6094fa556af485c
+```
 
 ## How it Works
 
 The plugin uses TPM credential activation as the method of attestation. The plugin operates as follows:
 
 1. Agent generates AK (attestation key) using TPM
-1. Agent sends the AK attestation parameters and EK certificate to the server
-1. Server inspects EK certificate and checks if it is signed by any chain in the directory specified by `ca_path`
-1. If the EK certificate is signed by one of the CAs, the server generates a credential activation challenge using
+1. Agent sends the AK attestation parameters and EK certificate or public key to the server
+1. Server inspects EK certificate or public key
+    1. If `hash_path` exists, and the public key hash matches filename in `hash_path`, validation passes
+    1. If `ca_path` exists, and the EK certificate was signed by any chain in `ca_path`, validation passes
+1. If validation passed, the server generates a credential activation challenge using
     1. The EK public key
     1. The AK attestation parameters
 1. Server sends challenge to agent

ci/pack.sh

@@ -0,0 +1,27 @@
+#!/bin/bash -e
+
+cd "$(dirname "$0")/../"
+
+display_usage() {
+  echo -e "Usage:\n$0 [version]"
+}
+
+# check whether user had supplied -h or --help . If yes display usage
+if [ $# = "--help" ] || [ $# = "-h" ]; then
+  display_usage
+  exit 0
+fi
+
+# check number of arguments
+if [ $# -ne 1 ]; then
+  display_usage
+  exit 1
+fi
+
+binaries=("get_tpm_pubhash" "tpm_attestor_agent" "tpm_attestor_server")
+
+rm -f spire-tpm-plugin-*.tar.gz
+user="$(id -u):$(id -g)"
+sudo chown root:root "${binaries[@]}"
+tar -cvzf "spire-tpm-plugin-$1-linux-amd64.tar.gz" "${binaries[@]}"
+sudo chown "$user" "${binaries[@]}"

ci/test.sh

@@ -13,6 +13,7 @@ fi
 test_dirs=()
 if [ "$option" = "plugin" ] || [ "$option" = "all" ]; then
   test_dirs+=("pkg/agent")
+  test_dirs+=("pkg/common")
 fi
 if [ "$option" = "tools" ] || [ "$option" = "all" ]; then
   test_dirs+=("tools/get_tpm_pubhash")

cmd/agent/tpm_attestor/tpm_attestor.go

@@ -19,8 +19,8 @@ package main
 import (
 	"github.com/bloomberg/spire-tpm-plugin/pkg/agent"
 	"github.com/bloomberg/spire-tpm-plugin/pkg/common"
+	"github.com/spiffe/spire/pkg/agent/plugin/nodeattestor"
 	"github.com/spiffe/spire/pkg/common/catalog"
-	"github.com/spiffe/spire/proto/spire/agent/nodeattestor"
 )
 
 func main() {

cmd/server/tpm_attestor/tpm_attestor.go

@@ -20,7 +20,7 @@ import (
 	"github.com/bloomberg/spire-tpm-plugin/pkg/common"
 	"github.com/bloomberg/spire-tpm-plugin/pkg/server"
 	"github.com/spiffe/spire/pkg/common/catalog"
-	"github.com/spiffe/spire/proto/spire/server/nodeattestor"
+	"github.com/spiffe/spire/pkg/server/plugin/nodeattestor"
 )
 
 func main() {

go.mod

@@ -3,27 +3,27 @@ module github.com/bloomberg/spire-tpm-plugin
 go 1.12
 
 require (
+	github.com/gogo/googleapis v1.2.0 // indirect
 	github.com/google/certificate-transparency-go v1.0.22-0.20190605205155-41fc2ef3a2a8
 	github.com/google/go-attestation v0.2.0
-	github.com/google/go-cmp v0.3.1 // indirect
 	github.com/google/go-tpm-tools v0.1.1
-	github.com/google/go-tspi v0.2.1-0.20190423175329-115dea689aad
+	github.com/gorilla/mux v1.7.2 // indirect
 	github.com/hashicorp/go-immutable-radix v1.1.0 // indirect
 	github.com/hashicorp/go-uuid v1.0.1 // indirect
 	github.com/hashicorp/golang-lru v0.5.3 // indirect
-	github.com/hashicorp/hcl v1.0.0
+	github.com/hashicorp/hcl v1.0.1-0.20190430135223-99e2f22d1c94
 	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
 	github.com/konsorten/go-windows-terminal-sequences v1.0.2 // indirect
 	github.com/mitchellh/go-testing-interface v1.0.0 // indirect
-	github.com/prometheus/client_golang v1.1.0 // indirect
-	github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4 // indirect
-	github.com/prometheus/procfs v0.0.4 // indirect
+	github.com/onsi/ginkgo v1.8.0 // indirect
+	github.com/onsi/gomega v1.5.0 // indirect
 	github.com/sirupsen/logrus v1.4.2
-	github.com/spiffe/spire v0.0.0-20190822230128-9a454825770e
-	github.com/spiffe/spire/proto/spire v0.0.0-20190822230128-9a454825770e
+	github.com/spiffe/spire v0.10.0
+	github.com/spiffe/spire/proto/spire v0.10.0
 	github.com/stretchr/testify v1.4.0
 	github.com/zeebo/errs v1.2.2 // indirect
 	golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297 // indirect
 	google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 // indirect
-	google.golang.org/grpc v1.23.0
+	google.golang.org/grpc v1.24.0
+	istio.io/gogo-genproto v0.0.0-20190124151557-6d926a6e6feb // indirect
 )