verifier/tdx: add a TDX quote verification backend with no external DCAP shared library#191
Merged
Merged
Conversation
Extract the ECDSA quote-verification step out of tdx::quote into a new tdx::verify module so that the backend can be selected at compile time. Today there is exactly one backend, tdx-dcap-ffi, which contains the existing Intel DCAP QVL (libsgx_dcap_quoteverify) FFI implementation moved verbatim; behaviour is unchanged. The tdx-verifier feature no longer implies a backend: a backend feature (currently only tdx-dcap-ffi) must be enabled, and enabling tdx-verifier without one is a clear compile_error. all-verifier, az-tdx-vtpm-verifier and the attestation-service passthroughs are wired to tdx-dcap-ffi, so every default build keeps using the DCAP shared library exactly as before. This is groundwork for a second, pure-Rust backend (tdx-dcap-rust). Signed-off-by: Jiale Zhang <zhangjiale@linux.alibaba.com>
Add tdx-dcap-rust, a second TDX quote-verification backend built on the pure-Rust dcap-qvl crate. It removes the dependency on the Intel DCAP shared library (libsgx_dcap_quoteverify) and its dynamically loaded quote provider: the ECDSA signature, PCK certificate chain, TCB info and QE identity are all verified in Rust, and verification collateral is fetched over HTTPS from a PCCS using the verifier's existing reqwest stack (the dcap-qvl 'report' feature, which would pull in reqwest 0.13 / aws-lc-sys, is deliberately left off). The returned TcbVerificationResult is populated to match the FFI backend, including tcb_level_date_tag, which is recovered by reproducing Intel QVL's TCB-level matching over the platform TCB (SGX TCB components + PCE SVN from the PCK certificate, TDX TEE TCB SVN from the TD report). Debug / service TDs are accepted and left to the policy engine, matching the FFI backend; expired collateral remains a hard error (dcap-qvl is stricter than the FFI QVL here) but is still surfaced via collateral_expired. Notes: - Opt-in only. The default build keeps using tdx-dcap-ffi; with this feature disabled, Cargo prunes the whole dcap-qvl subtree, so the default build's toolchain requirement (Rust 1.76) is unchanged. Building this backend itself requires a newer toolchain (Rust >= 1.86) because dcap-qvl's dependency tree uses edition 2024. - Collateral fetch currently supports quotes that embed the PCK chain (PCK cert type 5), i.e. cloud TDX quotes. - Verified end to end against a real TDX quote and PCCS: the backend reproduces the expected TCB status, advisory IDs and tcb_level_date_tag. Signed-off-by: Jiale Zhang <zhangjiale@linux.alibaba.com>
Add attestation-service feature passthroughs for the pure-Rust TDX quote
verification backend:
* tdx-dcap-rust -> verifier/tdx-dcap-rust
* all-verifier-rust -> verifier/all-verifier-rust (all verifiers, TDX on
the pure-Rust backend, SGX dropped)
and document how to build it via the Makefile:
make VERIFIER=all-verifier-rust
The default (VERIFIER=all-verifier) is unchanged and still selects the DCAP
shared-library backend, so the dist/, Docker and RPM builds keep linking
libsgx_dcap_quoteverify exactly as before.
Signed-off-by: Jiale Zhang <zhangjiale@linux.alibaba.com>
Collaborator
|
@jialez0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@jialez0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
Match the FFI (DCAP QVL) backend, which reports expired collateral via a flag and defers the decision to the policy engine, instead of hard-failing. Upstream dcap-qvl always rejects TCB info / QE identity whose nextUpdate is in the past, which diverges from the FFI backend and, in practice, breaks verification whenever the configured PCCS serves stale collateral for a platform's FMSPC (observed on the Alibaba Cloud PCCS mirror). Point the tdx-dcap-rust backend at a small dcap-qvl fork that adds a QuoteVerifier::allow_expired option (signatures and certificate chains are still fully verified; only the freshness check is relaxed) via [patch.crates-io], and enable it. The true expiry is still reported to the policy through the collateral_expired claim. The fork branch is based on Phala-Network/dcap-qvl v0.4.1: https://github.com/jialez0/dcap-qvl/tree/v0.4.1-allow-expired The patch is inert for the default build, which does not enable tdx-dcap-rust and never compiles dcap-qvl. Signed-off-by: Jiale Zhang <zhangjiale@linux.alibaba.com>
Collaborator
|
@jialez0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@jialez0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
The pure-Rust backend previously required a newer toolchain (>= 1.86) than the default (FFI) build's Rust 1.76, because dcap-qvl's dependency tree pulls edition-2024 / high-MSRV crates. Bring it down to 1.76 so both backends and CI share one toolchain: * Use dcap-qvl's `ring` crypto backend instead of `rustcrypto`. `ring` (MSRV 1.66) still links no external shared library, and avoids the RustCrypto stack (ed25519-dalek etc.) whose recent releases need Rust >= 1.81. * The dcap-qvl fork (patched in for allow_expired) additionally: drops an unused wasm-bindgen-futures dep, caps parity-scale-codec to <3.7 and derive_more to <2.1, enables anyhow/std, and avoids a 1.80-only slice API. * The shared Cargo.lock keeps the transitive crypto/x509 crates at their 1.76-compatible versions (base64ct 1.6, zeroize 1.8, indexmap 2.7, parity-scale-codec 3.6, ...). The default (FFI) build is unchanged: with tdx-dcap-rust disabled the whole dcap-qvl subtree is pruned. Also fixes rustfmt import ordering in tdx/mod.rs. Signed-off-by: Jiale Zhang <zhangjiale@linux.alibaba.com>
The pure-Rust backend read the PCCS endpoint only from the PCCS_URL
environment variable, defaulting otherwise to a built-in URL. That diverges
from the FFI backend, whose quote provider reads /etc/sgx_default_qcnl.conf,
so on a host configured for FFI the two backends would talk to different
PCCS servers unless PCCS_URL was also set.
Fall back to the qcnl.conf 'pccs_url' when PCCS_URL is unset, so both
backends share one configuration. Both the JSON ({"pccs_url": "..."}) and
legacy INI (PCCS_URL=...) forms are supported; unit-tested.
Signed-off-by: Jiale Zhang <zhangjiale@linux.alibaba.com>
Collaborator
|
@jialez0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@jialez0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
jialez0
changed the title
Collaborator
|
@jialez0 ，您好，您的请求已接收，请耐心等待结果。 |
Collaborator
|
@jialez0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
TDX quote verification depends on the Intel DCAP shared library
(
libsgx_dcap_quoteverify), reached through theintel-tee-quote-verification-rsFFI bindings plus its dynamically loaded quote provider for PCCS collateral.
This PR makes the TDX quote-verification backend selectable at compile time
and adds a second backend that needs no external DCAP shared library. The
default build is unchanged and still links
libsgx_dcap_quoteverifyexactly asbefore.
Backends
tdx-dcap-ffi(default)libsgx_dcap_quoteverify+ quote providertdx-dcap-rust(opt-in)dcap-qvl(ringcrypto backend)tdx-verifieris now an umbrella that no longer implies a backend; a backendfeature must be selected, and enabling it without one is a clear
compile_error!.all-verifier,az-tdx-vtpm-verifierand theattestation-service passthroughs all resolve to
tdx-dcap-ffi, so everyexisting build path (
dist/, Dockerfiles, RPM) keeps using the DCAP sharedlibrary. A new
all-verifier-rust/make VERIFIER=all-verifier-rustbuildsthe shared-library-free variant.
The
tdx-dcap-rustbackenddcap-qvl's offlineverify(thereportfeature, which would pullin
reqwest0.13 /aws-lc-sys, is left off); collateral is fetched overHTTPS with the verifier's existing
reqwest.TcbVerificationResultas the FFI backend, includingtcb_level_date_tag, recovered by reproducing Intel QVL's TCB-level matching(SGX TCB components + PCE SVN from the PCK certificate, TDX TEE TCB SVN from
the TD report).
expired collateral are non-fatal (expiry is still reported via
collateral_expired). Expiry tolerance uses a smallallow_expiredoptionadded in the dcap-qvl fork — this matters because the Alibaba Cloud PCCS
mirror serves stale TCB info for some FMSPCs.
PCCS_URL, then/etc/sgx_default_qcnl.conf(the same file the DCAP quote provider reads, so both backends share one
configuration), then a built-in default.
cloud TDX quotes.
Same toolchain as the default build (Rust 1.76)
dcap-qvl's dependency tree otherwise pulls edition-2024 / high-MSRV crates. Thebackend is brought down to Rust 1.76 (matching the default build and CI) by
using
ring(MSRV 1.66, still no external shared library) instead of theRustCrypto stack, plus a few MSRV fixes in the dcap-qvl fork (drop an unused
wasm-bindgen-futuresdep, capparity-scale-codec/derive_more, enableanyhow/std, avoid a 1.80-only slice API) and keeping the transitivecrypto/x509 crates pinned in
Cargo.lock.The
dcap-qvlfork (based on Phala-Network/dcap-qvl v0.4.1) is patched in via[patch.crates-io], consistent with the repo's other git dependencies:https://github.com/jialez0/dcap-qvl/tree/v0.4.1-allow-expired
Validation
cargo +1.76 check --features tdx-dcap-ffi --locked— default build compiles,behaviour unchanged,
dcap-qvlsubtree pruned.cargo +1.76 test --features tdx-dcap-rustandrestful-as/grpc-as --features all-verifier-rust— the shared-library-freepath builds and its unit tests pass on Rust 1.76.
tdx-dcap-rustbackend reproduces theexpected TCB status, advisory IDs and
tcb_level_date_tag, and tolerates astale-collateral FMSPC.
grpc-asinto a live Trustee stack and running
attestation-agent-client get-token --token-type coco_asyields an EAR tokenwhose verdict (status + trustworthiness vector) is identical to the DCAP FFI
backend's.