Skip to content

Commit 872082a

Browse files
thomasm-ttdthomasm-ttd
committed
Consolidated attestation exceptions
1 parent a25e6b1 commit 872082a

10 files changed

+40
-40
lines changed

‎pom.xml

+3
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,9 @@
285285
<groupId>org.apache.maven.plugins</groupId>
286286
<artifactId>maven-surefire-plugin</artifactId>
287287
<version>3.2.5</version>
288+
<configuration>
289+
<argLine>-XX:+EnableDynamicAgentLoading</argLine>
290+
</configuration>
288291
</plugin>
289292
<plugin>
290293
<groupId>org.sonatype.plugins</groupId>

‎src/main/java/com/uid2/shared/secure/AttestationClientException.java

+7-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
11
package com.uid2.shared.secure;
22

3-
public class AttestationClientException extends AttestationException
4-
{
3+
import lombok.Getter;
4+
5+
@Getter
6+
public class AttestationClientException extends AttestationException {
7+
// This exception should be used when the error is as a result of invalid or bad data from the caller.
8+
// It will result in a return code in the 400s
9+
510
private final AttestationFailure attestationFailure;
611

712
public AttestationClientException(Throwable cause) {
@@ -14,7 +19,4 @@ public AttestationClientException(String message, AttestationFailure attestation
1419
this.attestationFailure = attestationFailure;
1520
}
1621

17-
public AttestationFailure getAttestationFailure() {
18-
return this.attestationFailure;
19-
}
2022
}

‎src/main/java/com/uid2/shared/secure/AttestationException.java

+4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
package com.uid2.shared.secure;
22

33
public class AttestationException extends Exception {
4+
// Used to indicate an error in the processing of Attestation due to internal server errors
5+
// It will result in a response code of 500.
6+
// If the error is as a result in invalid input from the caller, use the AttestationClientException
7+
48
private final boolean isClientError;
59

610
public boolean IsClientError() {

‎src/main/java/com/uid2/shared/secure/AttestationResult.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ public AttestationResult(AttestationFailure reasonToFail) {
1616
}
1717

1818
public AttestationResult(AttestationClientException exception) {
19-
this.failure = AttestationFailure.UNKNOWN;
19+
this.failure = exception.getAttestationFailure();
2020
this.publicKey = null;
2121
this.enclaveId = "Failed attestation, enclave Id unknown";
2222
this.attestationClientException = exception;

‎src/main/java/com/uid2/shared/secure/BadFormatException.java

-10
This file was deleted.

‎src/main/java/com/uid2/shared/secure/NitroCoreAttestationService.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
public class NitroCoreAttestationService implements ICoreAttestationService {
2121

2222
private final String attestationUrl;
23-
private Set<NitroEnclaveIdentifier> allowedEnclaveIds;
23+
private final Set<NitroEnclaveIdentifier> allowedEnclaveIds;
2424
private final ICertificateProvider certificateProvider;
2525

2626
private static final Logger LOGGER = LoggerFactory.getLogger(NitroCoreAttestationService.class);
@@ -37,6 +37,8 @@ public void attest(byte[] attestationRequest, byte[] publicKey, Handler<AsyncRes
3737
AttestationRequest aReq = AttestationRequest.createFrom(attestationRequest);
3838
AttestationDocument aDoc = aReq.getAttestationDocument();
3939
handler.handle(Future.succeededFuture(attestInternal(publicKey, aReq, aDoc)));
40+
} catch (AttestationClientException ace) {
41+
handler.handle(Future.succeededFuture(new AttestationResult(ace)));
4042
} catch (Exception e) {
4143
handler.handle(Future.failedFuture(new AttestationException(e)));
4244
}
@@ -105,5 +107,4 @@ public void addIdentifier(NitroEnclaveIdentifier id) {
105107
public void removeIdentifier(NitroEnclaveIdentifier id) {
106108
this.allowedEnclaveIds.remove(id);
107109
}
108-
109110
}

‎src/main/java/com/uid2/shared/secure/azurecc/MaaTokenSignatureValidator.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ public MaaTokenPayload validate(String tokenString) throws AttestationException
6969
} catch (TokenVerifier.VerificationException e) {
7070
throw new AttestationClientException("Fail to validate the token signature, error: " + e.getMessage(), AttestationFailure.BAD_PAYLOAD);
7171
} catch (IOException e) {
72-
throw new AttestationException("Fail to parse token, error: " + e.getMessage());
72+
throw new AttestationClientException("Fail to parse token, error: " + e.getMessage(), AttestationFailure.BAD_PAYLOAD);
7373
}
7474

7575
// Parse Payload

‎src/main/java/com/uid2/shared/secure/azurecc/PolicyValidator.java

+5-5
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,15 @@ public PolicyValidator(String attestationUrl) {
1515
this.attestationUrl = attestationUrl;
1616
}
1717
@Override
18-
public String validate(MaaTokenPayload maaTokenPayload, String publicKey) throws AttestationException {
18+
public String validate(MaaTokenPayload maaTokenPayload, String publicKey) throws AttestationClientException {
1919
verifyVM(maaTokenPayload);
2020
verifyLocation(maaTokenPayload);
2121
verifyPublicKey(maaTokenPayload, publicKey);
2222
verifyAttestationUrl(maaTokenPayload);
2323
return maaTokenPayload.getCcePolicyDigest();
2424
}
2525

26-
private void verifyPublicKey(MaaTokenPayload maaTokenPayload, String publicKey) throws AttestationException {
26+
private void verifyPublicKey(MaaTokenPayload maaTokenPayload, String publicKey) throws AttestationClientException {
2727
if(Strings.isNullOrEmpty(publicKey)){
2828
throw new AttestationClientException("public key to check is null or empty", AttestationFailure.BAD_FORMAT);
2929
}
@@ -38,7 +38,7 @@ private void verifyPublicKey(MaaTokenPayload maaTokenPayload, String publicKey)
3838
}
3939
}
4040

41-
private void verifyAttestationUrl(MaaTokenPayload maaTokenPayload) throws AttestationException {
41+
private void verifyAttestationUrl(MaaTokenPayload maaTokenPayload) throws AttestationClientException {
4242
String decodedRuntimeAttestationUrl = maaTokenPayload.getRuntimeData().getDecodedAttestationUrl();
4343
if (decodedRuntimeAttestationUrl == null) {
4444
return;
@@ -47,7 +47,7 @@ private void verifyAttestationUrl(MaaTokenPayload maaTokenPayload) throws Attest
4747
}
4848
}
4949

50-
private void verifyVM(MaaTokenPayload maaTokenPayload) throws AttestationException {
50+
private void verifyVM(MaaTokenPayload maaTokenPayload) throws AttestationClientException {
5151
if(!maaTokenPayload.isSevSnpVM()){
5252
throw new AttestationClientException("Not in SevSnp VM", AttestationFailure.BAD_FORMAT);
5353
}
@@ -59,7 +59,7 @@ private void verifyVM(MaaTokenPayload maaTokenPayload) throws AttestationExcepti
5959
}
6060
}
6161

62-
private void verifyLocation(MaaTokenPayload maaTokenPayload) throws AttestationException {
62+
private void verifyLocation(MaaTokenPayload maaTokenPayload) throws AttestationClientException {
6363
var location = maaTokenPayload.getRuntimeData().getLocation();
6464
if(Strings.isNullOrEmpty(location)){
6565
throw new AttestationClientException("Location is not specified.", AttestationFailure.BAD_PAYLOAD);

‎src/main/java/com/uid2/shared/secure/gcpoidc/TokenSignatureValidator.java

+11-12
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
import com.google.api.client.util.Clock;
66
import com.google.auth.oauth2.TokenVerifier;
77
import com.google.common.base.Strings;
8-
import com.uid2.shared.secure.AttestationException;
8+
import com.uid2.shared.secure.AttestationClientException;
9+
import com.uid2.shared.secure.AttestationFailure;
910

1011
import java.io.IOException;
1112
import java.security.PublicKey;
@@ -51,7 +52,7 @@ protected TokenSignatureValidator(PublicKey publicKeyOverride, Clock clockOverri
5152
}
5253

5354
@Override
54-
public TokenPayload validate(String tokenString) throws AttestationException {
55+
public TokenPayload validate(String tokenString) throws AttestationClientException {
5556
if (Strings.isNullOrEmpty(tokenString)) {
5657
throw new IllegalArgumentException("tokenString can not be null or empty");
5758
}
@@ -65,9 +66,9 @@ public TokenPayload validate(String tokenString) throws AttestationException {
6566
signature = tokenVerifier.verify(tokenString);
6667
}
6768
} catch (TokenVerifier.VerificationException e) {
68-
throw new AttestationException("Fail to validate the token signature, error: " + e.getMessage());
69+
throw new AttestationClientException("Fail to validate the token signature, error: " + e.getMessage(), AttestationFailure.BAD_CERTIFICATE);
6970
} catch (IOException e) {
70-
throw new AttestationException("Fail to parse token, error: " + e.getMessage());
71+
throw new AttestationClientException("Fail to parse token, error: " + e.getMessage(), AttestationFailure.BAD_PAYLOAD);
7172
}
7273

7374
// Parse Payload
@@ -78,20 +79,20 @@ public TokenPayload validate(String tokenString) throws AttestationException {
7879
tokenPayloadBuilder.dbgStat(tryGetField(rawPayload, "dbgstat", String.class));
7980
tokenPayloadBuilder.swName(tryGetField(rawPayload, "swname", String.class));
8081
var swVersion = tryGetField(rawPayload, "swversion", List.class);
81-
if(swVersion != null && !swVersion.isEmpty()){
82+
if (swVersion != null && !swVersion.isEmpty()) {
8283
tokenPayloadBuilder.swVersion(tryConvert(swVersion.get(0), String.class));
8384
}
8485

85-
var subModsDetails = tryGetField(rawPayload,"submods", Map.class);
86+
var subModsDetails = tryGetField(rawPayload, "submods", Map.class);
8687

87-
if(subModsDetails != null){
88+
if (subModsDetails != null) {
8889
var confidential_space = tryGetField(subModsDetails, "confidential_space", Map.class);
89-
if(confidential_space != null){
90+
if (confidential_space != null) {
9091
tokenPayloadBuilder.csSupportedAttributes(tryGetField(confidential_space, "support_attributes", List.class));
9192
}
9293

9394
var container = tryGetField(subModsDetails, "container", Map.class);
94-
if(container != null){
95+
if (container != null) {
9596
tokenPayloadBuilder.workloadImageReference(tryGetField(container, "image_reference", String.class));
9697
tokenPayloadBuilder.workloadImageDigest(tryGetField(container, "image_digest", String.class));
9798
tokenPayloadBuilder.restartPolicy(tryGetField(container, "restart_policy", String.class));
@@ -101,14 +102,12 @@ public TokenPayload validate(String tokenString) throws AttestationException {
101102
}
102103

103104
var gce = tryGetField(subModsDetails, "gce", Map.class);
104-
if(gce != null){
105+
if (gce != null) {
105106
var gceZone = tryGetField(gce, "zone", String.class);
106107
tokenPayloadBuilder.gceZone(gceZone);
107108
}
108109
}
109110

110111
return tokenPayloadBuilder.build();
111112
}
112-
113-
114113
}

‎src/main/java/com/uid2/shared/secure/nitro/AttestationRequest.java

+5-4
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@
77
import co.nstant.in.cbor.model.ByteString;
88
import co.nstant.in.cbor.model.DataItem;
99
import co.nstant.in.cbor.model.UnicodeString;
10-
import com.uid2.shared.secure.BadFormatException;
10+
import com.uid2.shared.secure.AttestationClientException;
11+
import com.uid2.shared.secure.AttestationFailure;
1112

1213
import java.io.ByteArrayInputStream;
1314
import java.io.ByteArrayOutputStream;
@@ -22,7 +23,7 @@ public class AttestationRequest {
2223
private byte[] protectedHeader;
2324
private byte[] signature;
2425

25-
public static AttestationRequest createFrom(byte[] data) throws BadFormatException {
26+
public static AttestationRequest createFrom(byte[] data) throws AttestationClientException {
2627
try {
2728
AttestationRequest aReq = new AttestationRequest();
2829
ByteArrayInputStream stream = new ByteArrayInputStream(data);
@@ -34,11 +35,11 @@ public static AttestationRequest createFrom(byte[] data) throws BadFormatExcepti
3435
aReq.signature = ((ByteString) dataItems.get(3)).getBytes();
3536
return aReq;
3637
} catch (CborException ce) {
37-
throw new BadFormatException(ce.getMessage(), ce);
38+
throw new AttestationClientException(ce.getMessage(), AttestationFailure.BAD_FORMAT);
3839
}
3940
}
4041

41-
public static AttestationRequest createFrom(String base64data) throws BadFormatException {
42+
public static AttestationRequest createFrom(String base64data) throws AttestationClientException {
4243
return createFrom(Base64.getDecoder().decode(base64data));
4344
}
4445

0 commit comments

Comments
 (0)