cli: allow fetching AMD's Certificate Revocation List (CRL)

AMD publishes a Certificate Revocation List (CRL) via their KDS. The CRL
is signed by the ARK, and can be used to revoke ASK certificates.

Add a `fetch-crl` command to fetch the revocation list. A future commit
will add support to use the CRL to verify that an ASK has not been
revoked.

Signed-off-by: Carlos López <clopez@suse.de>

Author: 00xc

README.md

@@ -82,6 +82,15 @@ cvmtool fetch-vcek --certs-dir certs/
 cvmtool fetch-pck --certs-dir certs/
 ```
 
+### Fetch Revocation List (SEV-SNP only, optional)
+
+To fetch the certificate revocation list for verification, use the `fetch-clr` command from within the CVM:
+
+```bash
+# Fetch CLR from AMD KDS
+cvmtool fetch-clr --certs-dir certs/
+```
+
 ## Azure CVM Support
 
 When built with the `azure` feature, cvmtool can retrieve attestation reports from Azure Confidential VMs via the vTPM (Virtual TPM). This works on Azure CVMs using either SNP or TDX isolation.

src/main.rs

@@ -114,6 +114,12 @@ enum Commands {
         #[arg(short, long, default_value = ".")]
         certs_dir: PathBuf,
     },
+    /// Fetch VCEK Certificate Revocation List from AMD KDS (for SEV-SNP)
+    FetchCrl {
+        /// Output directory for the CRL
+        #[arg(short, long, default_value = ".")]
+        certs_dir: PathBuf,
+    },
 }
 
 /// Options for attestation verification beyond cryptographic checks
@@ -291,6 +297,32 @@ fn main() -> Result<()> {
                 println!("Saved certificates to {:?}", certs_dir);
             }
         }
+        Commands::FetchCrl { certs_dir } => {
+            if cli.verbose {
+                println!("Generating SEV attestation report...");
+            }
+
+            let report = report(Some("sev"), [0; 64])?;
+            let report = sev::parse_report(&report)?;
+
+            let processor = vcek::get_processor_model(&report)?;
+            if cli.verbose {
+                println!("Detected processor: {processor}");
+            }
+
+            if cli.verbose {
+                println!("Fetching CRL from AMD KDS...");
+            }
+            let crl_der = vcek::fetch_crl(&processor)?;
+            if cli.verbose {
+                println!("CRL retrieved ({} bytes)", crl_der.len());
+            }
+
+            vcek::save_crl(&crl_der, &certs_dir, cli.verbose)?;
+            if !cli.quiet {
+                println!("Saved CRL to {:?}", certs_dir);
+            }
+        }
     }
 
     Ok(())

src/vcek.rs

@@ -237,3 +237,39 @@ pub fn save_certificates(
 
     Ok(())
 }
+
+pub fn fetch_crl(processor: &ProcType) -> Result<Vec<u8>> {
+    let url = format!("{}/vcek/v1/{}/crl", KDS_BASE_URL, processor.to_kds_url());
+
+    let client = reqwest::blocking::Client::new();
+    let response = client
+        .get(&url)
+        .send()
+        .context("Failed to send request to AMD KDS for CRL")?;
+
+    response
+        .error_for_status_ref()
+        .context("AMD KDS returned error for CRL request")?;
+
+    Ok(response
+        .bytes()
+        .context("Failed to read CRL from response")?
+        .to_vec())
+}
+
+pub fn save_crl(crl_der: &[u8], output_dir: &Path, verbose: bool) -> Result<()> {
+    fs::create_dir_all(output_dir).context(format!(
+        "Failed to create output directory {}",
+        output_dir.display()
+    ))?;
+
+    let crl = openssl::x509::X509Crl::from_der(crl_der).context("Failed to parse CRL DER")?;
+    let pem = crl.to_pem().context("Failed to convert CRL to PEM")?;
+    let path = output_dir.join("crl.pem");
+    fs::write(&path, &pem).context(format!("Failed to write CRL to {}", path.display()))?;
+    if verbose {
+        println!("Saved CRL to {}", path.display());
+    }
+
+    Ok(())
+}