Add `tpm` package with Attestation/Validation functionality by strideynet · Pull Request #40351 · gravitational/teleport

strideynet · 2024-04-09T13:04:32Z

As per RFD #38613

This is the foundational package for the new TPM joining functionality. It adds the client side element of attestation and the server side which can verify that attestation.

codingllama · 2024-04-10T15:33:39Z

No backports - I'll backport all of the PRs as one PR when the work is complete.

That is gonna big PR, no? Hard to spot changes and fixes also. Are you sure that's a good idea?

strideynet · 2024-04-10T15:35:55Z

That is gonna big PR, no? Hard to spot changes and fixes also. Are you sure that's a good idea?

Perhaps I'm overly worried about releasing "half complete" changes in v15/14 - there's nothing about them that makes me think it would be inherently bad about only some of the changes being released, it might just be odd for CLI commands etc to start showing up but for the backend implementation to not be complete

codingllama · 2024-04-10T15:52:53Z

Set a feature flag, hide all public facing changes until done, make RPCs return unimplemented when appropriate, then profit?

codingllama · 2024-04-10T15:53:28Z

(I do understand your worries about half complete changes though.)

strideynet · 2024-04-10T16:15:48Z

Set a feature flag, hide all public facing changes until done, make RPCs return unimplemented when appropriate, then profit?

Seems reasonable. I can do that :)

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

public-teleport-github-review-bot · 2024-04-11T16:31:38Z

@strideynet See the table below for backport results.

Branch	Result
branch/v14	Failed
branch/v15	Failed

* Add structure of `tpm` package * Add proto conversion methods * Add tests for proto conversions * Add startup stuff for tpm sim based tests * try and fail to write a fake ekcert to the tpm * Working ability to write to a TPM ekcert index * Tidy up * Add finishing touches to test and add godocs * Go mod tidy * Appease linter * Remove incorrectly copied comment * Tidy up line wrapping * Add license header * Update lib/tpm/tpm.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/validate.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Avoid managing closure in the attestWithTPM func * Use ekCertSerialHex const * Simpler JoinAuditAttributes method Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Add missing err return * Add remark on the nvram rsa ekcert index * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Add subtests * Clarify in hex * Switch to testing exported iface * Use x509.CertPool and switch to testing public APi * Remove overly cautious check * Validate Validate params * Reuse strings builder when handling an odd number of hex digits * Switch to gocmp and struct for ekcert * Use return struct for Attest * Avoid marshalling PKIX key twice * Update lib/tpm/validate.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> --------- Co-authored-by: Alan Parra <alan.parra@goteleport.com>

…40495) * Add structure of `tpm` package * Add proto conversion methods * Add tests for proto conversions * Add startup stuff for tpm sim based tests * try and fail to write a fake ekcert to the tpm * Working ability to write to a TPM ekcert index * Tidy up * Add finishing touches to test and add godocs * Go mod tidy * Appease linter * Remove incorrectly copied comment * Tidy up line wrapping * Add license header * Update lib/tpm/tpm.go * Update lib/tpm/tpm_simulator_test.go * Update lib/tpm/validate.go * Update lib/tpm/tpm.go * Update lib/tpm/tpm_simulator_test.go * Update lib/tpm/tpm_simulator_test.go * Update lib/tpm/tpm_simulator_test.go * Avoid managing closure in the attestWithTPM func * Use ekCertSerialHex const * Simpler JoinAuditAttributes method * Add missing err return * Add remark on the nvram rsa ekcert index * Update lib/tpm/tpm_simulator_test.go * Add subtests * Clarify in hex * Switch to testing exported iface * Use x509.CertPool and switch to testing public APi * Remove overly cautious check * Validate Validate params * Reuse strings builder when handling an odd number of hex digits * Switch to gocmp and struct for ekcert * Use return struct for Attest * Avoid marshalling PKIX key twice * Update lib/tpm/validate.go --------- Co-authored-by: Alan Parra <alan.parra@goteleport.com>

…0351) (#40496) * Add `tpm` package with Attestation/Validation functionality (#40351) * Add structure of `tpm` package * Add proto conversion methods * Add tests for proto conversions * Add startup stuff for tpm sim based tests * try and fail to write a fake ekcert to the tpm * Working ability to write to a TPM ekcert index * Tidy up * Add finishing touches to test and add godocs * Go mod tidy * Appease linter * Remove incorrectly copied comment * Tidy up line wrapping * Add license header * Update lib/tpm/tpm.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/validate.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Avoid managing closure in the attestWithTPM func * Use ekCertSerialHex const * Simpler JoinAuditAttributes method Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Add missing err return * Add remark on the nvram rsa ekcert index * Update lib/tpm/tpm_simulator_test.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Add subtests * Clarify in hex * Switch to testing exported iface * Use x509.CertPool and switch to testing public APi * Remove overly cautious check * Validate Validate params * Reuse strings builder when handling an odd number of hex digits * Switch to gocmp and struct for ekcert * Use return struct for Attest * Avoid marshalling PKIX key twice * Update lib/tpm/validate.go Co-authored-by: Alan Parra <alan.parra@goteleport.com> --------- Co-authored-by: Alan Parra <alan.parra@goteleport.com> * Move indirect to correct block --------- Co-authored-by: Alan Parra <alan.parra@goteleport.com>

strideynet added 2 commits April 9, 2024 14:00

Add structure of tpm package

b3a2e17

Add proto conversion methods

e7bc5c9

strideynet added the no-changelog Indicates that a PR does not require a changelog entry label Apr 9, 2024

strideynet self-assigned this Apr 9, 2024

strideynet added 8 commits April 9, 2024 14:42

Add tests for proto conversions

fa66c8c

Add startup stuff for tpm sim based tests

b1df57d

try and fail to write a fake ekcert to the tpm

861f82c

Working ability to write to a TPM ekcert index

2cede39

Tidy up

8642262

Add finishing touches to test and add godocs

60d344e

Go mod tidy

28c70e2

Appease linter

d7776a8

strideynet marked this pull request as ready for review April 10, 2024 11:35

github-actions Bot added the size/lg label Apr 10, 2024

github-actions Bot requested review from atburke and avatus April 10, 2024 11:36

strideynet added 2 commits April 10, 2024 12:37

Remove incorrectly copied comment

0b63cce

Tidy up line wrapping

ebcd519

strideynet requested a review from codingllama April 10, 2024 11:53

Add license header

5493ada

strideynet added backport/branch/v14 labels Apr 10, 2024

codingllama reviewed Apr 10, 2024

View reviewed changes

strideynet and others added 2 commits April 10, 2024 23:39

Update lib/tpm/tpm.go

283b450

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

Update lib/tpm/tpm_simulator_test.go

f0bf32a

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

strideynet and others added 12 commits April 11, 2024 11:31

Add remark on the nvram rsa ekcert index

e996c1e

Update lib/tpm/tpm_simulator_test.go

dc9bace

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

Add subtests

018d4e0

Clarify in hex

6ba1881

Switch to testing exported iface

0eab104

Use x509.CertPool and switch to testing public APi

e3ae0a2

Remove overly cautious check

5641b58

Validate Validate params

45889aa

Reuse strings builder when handling an odd number of hex digits

4e77afd

Switch to gocmp and struct for ekcert

45e598c

Use return struct for Attest

7bf262b

Avoid marshalling PKIX key twice

2f196f7

strideynet requested a review from codingllama April 11, 2024 11:52

strideynet mentioned this pull request Apr 11, 2024

Add teleport tpm identify and tbot tpm identify commands #40418

Merged

codingllama approved these changes Apr 11, 2024

View reviewed changes

Comment thread lib/tpm/validate.go Outdated

Update lib/tpm/validate.go

158ab14

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

avatus approved these changes Apr 11, 2024

View reviewed changes

public-teleport-github-review-bot Bot removed the request for review from atburke April 11, 2024 16:09

strideynet added this pull request to the merge queue Apr 11, 2024

Merged via the queue into master with commit 521f692 Apr 11, 2024

strideynet deleted the strideynet/add-tpm-joining-package branch April 11, 2024 16:28

This was referenced Apr 11, 2024

[v15] Add tpm package with Attestation/Validation functionality (#40351) #40495

Merged

[v14] Add tpm package with Attestation/Validation functionality (#40351) #40496

Merged

strideynet mentioned this pull request Apr 12, 2024

Add server-side tpm joining implementation #40512

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `tpm` package with Attestation/Validation functionality#40351

Add `tpm` package with Attestation/Validation functionality#40351
strideynet merged 37 commits intomasterfrom
strideynet/add-tpm-joining-package

strideynet commented Apr 9, 2024 •

edited

Loading

Uh oh!

codingllama commented Apr 10, 2024

Uh oh!

strideynet commented Apr 10, 2024

Uh oh!

codingllama commented Apr 10, 2024

Uh oh!

codingllama commented Apr 10, 2024

Uh oh!

strideynet commented Apr 10, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented Apr 11, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

strideynet commented Apr 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codingllama commented Apr 10, 2024

Uh oh!

strideynet commented Apr 10, 2024

Uh oh!

codingllama commented Apr 10, 2024

Uh oh!

codingllama commented Apr 10, 2024

Uh oh!

strideynet commented Apr 10, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented Apr 11, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

strideynet commented Apr 9, 2024 •

edited

Loading