Skip to content

Commit f2fa8cb

Browse files
committed
[WIP] x509util: parse inner RKP extension
1 parent 5b245f2 commit f2fa8cb

File tree

3 files changed

+72
-6
lines changed

3 files changed

+72
-6
lines changed

go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ require (
66
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
77
github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
88
github.com/fullstorydev/grpcurl v1.8.6
9+
github.com/fxamacker/cbor/v2 v2.6.0 // indirect
910
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
1011
github.com/golang/mock v1.6.0
1112
github.com/golang/protobuf v1.5.2

go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,8 @@ github.com/fullstorydev/grpcurl v1.8.1/go.mod h1:3BWhvHZwNO7iLXaQlojdg5NA6SxUDeP
253253
github.com/fullstorydev/grpcurl v1.8.2/go.mod h1:YvWNT3xRp2KIRuvCphFodG0fKkMXwaxA9CJgKCcyzUQ=
254254
github.com/fullstorydev/grpcurl v1.8.6 h1:WylAwnPauJIofYSHqqMTC1eEfUIzqzevXyogBxnQquo=
255255
github.com/fullstorydev/grpcurl v1.8.6/go.mod h1:WhP7fRQdhxz2TkL97u+TCb505sxfH78W1usyoB3tepw=
256+
github.com/fxamacker/cbor/v2 v2.6.0 h1:sU6J2usfADwWlYDAFhZBQ6TnLFBHxgesMrQfQgk1tWA=
257+
github.com/fxamacker/cbor/v2 v2.6.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
256258
github.com/getsentry/raven-go v0.2.0 h1:no+xWJRb5ZI7eE8TWgIq1jLulQiIoLG0IfYxv5JYMGs=
257259
github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
258260
github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -761,6 +763,8 @@ github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtX
761763
github.com/urfave/cli v1.22.4/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
762764
github.com/urfave/cli v1.22.7 h1:aXiFAgRugfJ27UFDsGJ9DB2FvTC73hlVXFSqq5bo9eU=
763765
github.com/urfave/cli v1.22.7/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
766+
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
767+
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
764768
github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
765769
github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
766770
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=

x509util/android.go

Lines changed: 67 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ import (
2323

2424
"github.com/google/certificate-transparency-go/asn1"
2525
"github.com/google/certificate-transparency-go/x509"
26+
"github.com/fxamacker/cbor/v2"
2627
)
2728

2829
// OIDExtensionAndroidAttestation is the OID value for an X.509 extension that holds
@@ -68,6 +69,23 @@ type AndroidVmComponent struct {
6869
AuthorityHash []byte
6970
}
7071

72+
// RkpProvisioningInfo describes remotely provisioned key information
73+
type RkpProvisioningInfo struct {
74+
CertsSigned30Days int64 `cbor:"1,keyasint"`
75+
VerifiedFirmware *bool `cbor:"2,keyasint,omitempty"`
76+
SocVendorCertified *bool `cbor:"3,keyasint,omitempty"`
77+
DeviceProperties *RkpDeviceProperties `cbor:"4,keyasint,omitempty"`
78+
}
79+
80+
// RkpDeviceProperties describes the device receiving an RKP key.
81+
type RkpDeviceProperties struct {
82+
Brand *string `cbor:"1,keyasint,omitempty"`
83+
Device *string `cbor:"2,keyasint,omitempty"`
84+
Manufacturer *string `cbor:"3,keyasint,omitempty"`
85+
Model *string `cbor:"4,keyasint,omitempty"`
86+
Product *string `cbor:"5,keyasint,omitempty"`
87+
}
88+
7189
func securityLevelToString(lvl asn1.Enumerated) string {
7290
switch lvl {
7391
case 0:
@@ -189,6 +207,22 @@ func VmInfoFromCert(cert *x509.Certificate) (*AndroidVmAttestationInfo, error) {
189207
return nil, errors.New("no Android VM Attestation extension found")
190208
}
191209

210+
// RkpInfoFromCert retrieves and parses an Android VM attestation information extension
211+
// from a certificate, if present.
212+
func RkpInfoFromCert(cert *x509.Certificate) (*RkpProvisioningInfo, error) {
213+
for _, ext := range cert.Extensions {
214+
if ext.Id.Equal(OIDExtensionAndroidRkpInfo) {
215+
var rkpInfo RkpProvisioningInfo
216+
err := cbor.Unmarshal(ext.Value, &rkpInfo)
217+
if err != nil {
218+
return nil, fmt.Errorf("failed to unmarshal RKP CBOR info: %v", err)
219+
}
220+
return &rkpInfo, nil
221+
}
222+
}
223+
return nil, errors.New("no Android RKP Attestation extension found")
224+
}
225+
192226
func showAndroidVmAttestation(result *bytes.Buffer, cert *x509.Certificate) {
193227
count, critical := OIDInExtensions(OIDExtensionAndroidVmAttestation, cert.Extensions)
194228
if count == 0 {
@@ -214,12 +248,39 @@ func showAndroidVmAttestation(result *bytes.Buffer, cert *x509.Certificate) {
214248
}
215249

216250
func showAndroidRkpInfo(result *bytes.Buffer, cert *x509.Certificate) {
217-
for _, ext := range cert.Extensions {
218-
if ext.Id.Equal(OIDExtensionAndroidRkpInfo) {
219-
result.WriteString(fmt.Sprintf(" Android RKP Information:"))
220-
showCritical(result, ext.Critical)
221-
appendHexData(result, ext.Value, 16, " ")
222-
result.WriteString("\n")
251+
count, critical := OIDInExtensions(OIDExtensionAndroidRkpInfo, cert.Extensions)
252+
if count == 0 {
253+
return
254+
}
255+
result.WriteString(fmt.Sprintf(" Android RKP Information:"))
256+
showCritical(result, critical)
257+
rkpInfo, err := RkpInfoFromCert(cert)
258+
if err != nil {
259+
result.WriteString(fmt.Sprintf(" Failed to CBOR-decode RKP info: (%s)\n", err))
260+
return
261+
}
262+
result.WriteString(fmt.Sprintf(" Certs Signed Last 30d: %d\n", rkpInfo.CertsSigned30Days))
263+
if rkpInfo.VerifiedFirmware != nil {
264+
result.WriteString(fmt.Sprintf(" Verified Firmware: %t\n", *rkpInfo.VerifiedFirmware))
265+
}
266+
if rkpInfo.SocVendorCertified != nil {
267+
result.WriteString(fmt.Sprintf(" Verified Firmware: %t\n", *rkpInfo.SocVendorCertified))
268+
}
269+
if rkpInfo.DeviceProperties != nil {
270+
if rkpInfo.DeviceProperties.Brand != nil {
271+
result.WriteString(fmt.Sprintf(" Brand: %s\n", *rkpInfo.DeviceProperties.Brand))
272+
}
273+
if rkpInfo.DeviceProperties.Device != nil {
274+
result.WriteString(fmt.Sprintf(" Device: %s\n", *rkpInfo.DeviceProperties.Device))
275+
}
276+
if rkpInfo.DeviceProperties.Manufacturer != nil {
277+
result.WriteString(fmt.Sprintf(" Manufacturer: %s\n", *rkpInfo.DeviceProperties.Manufacturer))
278+
}
279+
if rkpInfo.DeviceProperties.Model != nil {
280+
result.WriteString(fmt.Sprintf(" Model: %s\n", *rkpInfo.DeviceProperties.Model))
281+
}
282+
if rkpInfo.DeviceProperties.Product != nil {
283+
result.WriteString(fmt.Sprintf(" Product: %s\n", *rkpInfo.DeviceProperties.Product))
223284
}
224285
}
225286
}

0 commit comments

Comments
 (0)