Package com.suse.coco.module.pvattest.execution

Class PvattestWrapper

java.lang.Object

com.suse.coco.module.pvattest.execution.PvattestWrapper

public class PvattestWrapper
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
private final com.suse.common.io.process.ShellCommandExecutor	commandExecutor
private static final Path	DEFAULT_DIGI_CERT_CA_FILE
static final String	IBM_Z_HOST_KEY_CERTIFICATE_REVOCATION_LISTS
static final String	IBM_Z_HOST_KEY_SIGNING_CERTIFICATE
private static final org.apache.logging.log4j.Logger	LOGGER
protected static final Path	PVATTEST
private static final String	PVATTEST_PACKAGE
private final Path	sourceDigiCertCaCertificateFile
private final FileAttribute<Set<PosixFilePermission>>	tempDirAttributes
private final List<Path>	tempDirs
private final FileAttribute<Set<PosixFilePermission>>	tempFileAttributes
private final List<Path>	tempFiles

Constructor Summary

Constructors

Constructor	Description
PvattestWrapper()	default constructor
PvattestWrapper(com.suse.common.io.process.ShellCommandExecutor commandExecutorIn)	Constructor
PvattestWrapper(com.suse.common.io.process.ShellCommandExecutor commandExecutorIn, Path sourceDigiCertCaCertificateFileIn)

Method Summary

Modifier and Type	Method	Description
private void	checkCommandNotFailed(com.suse.common.io.process.ProcessOutput output)
private AttestationRequest	createAttestationRequest(Path attestationRequestFile, Path attestationProtectionKeyFile)
private AttestationResponse	createAttestationResult(Path attestationResultFile)
private AttestationRequest	createCore(X509Certificate hostKeyDocument, boolean doVerify, X509Certificate digiCertCACertificate, X509Certificate ibmZHostKeySigningCertificateX)
AttestationRequest	createNoVerify(String hostKeyDocumentContent)	Creates an attestation request, with no certificate verification
private Path	createTempBinaryFile(Path tempDir, String prefix, String suffix, byte[] content)
private Path	createTempDir()
private Path	createTempFile(Path tempDir, String prefix, String suffix)
private Path	createTempFile(Path tempDir, String prefix, String suffix, String content)
AttestationRequest	createVerify(String hostKeyDocumentContent, String digiCertCACertificateContent, String ibmZHostKeySigningCertificateContent)	Creates an attestation request, with certificate verification, given the certificate contents
AttestationRequest	createVerifyDownloadCertificates(String hostKeyDocumentContent)	Creates an attestation request, with certificate verification, downloading the certificates from IBM website
X509Certificate	downloadIbmZHostKeySigningCertificate()	Downloads the IBM host key signing certificate
X509CRL	downloadIbmZHostKeySigningRevocationLists()	Downloads the IBM host key signing certificate revocation lists
String	findPackageVersion()	Finds the package version
X509Certificate	getDigiCertCACertificate()	Gets the root CA certificate from the local resources
private String	getFirstLine(String str)
(package private) String	getLastExecutedCommand()
private void	logErrorRunningCommand(Exception e)
private void	removeAllTempDirsFiles()
private void	resetTempDirsFiles()
AttestationResponse	verifyAttestationResponse(byte[] attestationResponseContent, byte[] secureExecutionHeaderContent, byte[] attestationProtectionKeyContent)	Verifies the validity of an attestation response
AttestationResponse	verifyAttestationResponse(String attestationResponseContentBase64, String secureExecutionHeaderContentBase64, String attestationProtectionKeyContentBase64)	Verifies the validity of an attestation response
String	version()	Returns the pvattest tool version

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOGGER

private static final org.apache.logging.log4j.Logger LOGGER

PVATTEST_PACKAGE

private static final String PVATTEST_PACKAGE

See Also:

• Constant Field Values

PVATTEST

protected static final Path PVATTEST

DEFAULT_DIGI_CERT_CA_FILE

private static final Path DEFAULT_DIGI_CERT_CA_FILE

IBM_Z_HOST_KEY_SIGNING_CERTIFICATE

public static final String IBM_Z_HOST_KEY_SIGNING_CERTIFICATE

See Also:

• Constant Field Values

IBM_Z_HOST_KEY_CERTIFICATE_REVOCATION_LISTS

public static final String IBM_Z_HOST_KEY_CERTIFICATE_REVOCATION_LISTS

See Also:

• Constant Field Values

tempDirAttributes

private final FileAttribute<Set<PosixFilePermission>> tempDirAttributes

tempFileAttributes

private final FileAttribute<Set<PosixFilePermission>> tempFileAttributes

tempDirs

private final List<Path> tempDirs

tempFiles

private final List<Path> tempFiles

commandExecutor

private final com.suse.common.io.process.ShellCommandExecutor commandExecutor

sourceDigiCertCaCertificateFile

private final Path sourceDigiCertCaCertificateFile

Constructor Details

PvattestWrapper

public PvattestWrapper()

default constructor

PvattestWrapper

public PvattestWrapper(com.suse.common.io.process.ShellCommandExecutor commandExecutorIn)

Constructor

Parameters:

commandExecutorIn - the command executor object

PvattestWrapper

public PvattestWrapper(com.suse.common.io.process.ShellCommandExecutor commandExecutorIn,
 Path sourceDigiCertCaCertificateFileIn)

Parameters:

commandExecutorIn - dummy

sourceDigiCertCaCertificateFileIn - dummy

Method Details

getLastExecutedCommand

String getLastExecutedCommand()

findPackageVersion

public String findPackageVersion()
                          throws ExecutionException

Finds the package version

Returns:

the package version as string

Throws:

ExecutionException - if something goes wrong

version

public String version()
               throws ExecutionException

Returns the pvattest tool version

Returns:

the version as string

Throws:

ExecutionException - if something goes wrong

createNoVerify

public AttestationRequest createNoVerify(String hostKeyDocumentContent)
                                  throws ExecutionException,
CertificateException

Creates an attestation request, with no certificate verification

Parameters:

hostKeyDocumentContent - the IBM host key document

Returns:

the attestation request

Throws:

ExecutionException - if something goes wrong

CertificateException - if some certificate could not be parsed or is invalid

createVerifyDownloadCertificates

public AttestationRequest createVerifyDownloadCertificates(String hostKeyDocumentContent)
                                                    throws ExecutionException,
CertificateException,
IOException

Creates an attestation request, with certificate verification, downloading the certificates from IBM website

Parameters:

hostKeyDocumentContent - the IBM host key document

Returns:

the attestation request

Throws:

ExecutionException - if something goes wrong

CertificateException - if some certificate could not be parsed or is invalid

IOException - if something goes wrong

createVerify

public AttestationRequest createVerify(String hostKeyDocumentContent,
 String digiCertCACertificateContent,
 String ibmZHostKeySigningCertificateContent)
                                throws ExecutionException,
CertificateException

Creates an attestation request, with certificate verification, given the certificate contents

Parameters:

hostKeyDocumentContent - the IBM host key document

digiCertCACertificateContent - the root CA certificate

ibmZHostKeySigningCertificateContent - the IBM host key signing certificate

Returns:

the attestation request

Throws:

ExecutionException - if something goes wrong

CertificateException - if some certificate could not be parsed or is invalid

createCore

private AttestationRequest createCore(X509Certificate hostKeyDocument,
 boolean doVerify,
 X509Certificate digiCertCACertificate,
 X509Certificate ibmZHostKeySigningCertificateX)
                               throws ExecutionException

Throws:

ExecutionException

getDigiCertCACertificate

public X509Certificate getDigiCertCACertificate()
                                         throws IOException

Gets the root CA certificate from the local resources

Returns:

the root CA certificate

Throws:

IOException - if something goes wrong

downloadIbmZHostKeySigningCertificate

public X509Certificate downloadIbmZHostKeySigningCertificate()
                                                      throws IOException

Downloads the IBM host key signing certificate

Returns:

the IBM host key signing certificate

Throws:

IOException - if something goes wrong

downloadIbmZHostKeySigningRevocationLists

public X509CRL downloadIbmZHostKeySigningRevocationLists()
                                                  throws IOException

Downloads the IBM host key signing certificate revocation lists

Returns:

the IBM host key signing certificate revocation lists

Throws:

IOException - if something goes wrong

createAttestationRequest

private AttestationRequest createAttestationRequest(Path attestationRequestFile,
 Path attestationProtectionKeyFile)
                                             throws IOException

Throws:

IOException

createAttestationResult

private AttestationResponse createAttestationResult(Path attestationResultFile)
                                             throws IOException

Throws:

IOException

checkCommandNotFailed

private void checkCommandNotFailed(com.suse.common.io.process.ProcessOutput output)

logErrorRunningCommand

private void logErrorRunningCommand(Exception e)

resetTempDirsFiles

private void resetTempDirsFiles()

removeAllTempDirsFiles

private void removeAllTempDirsFiles()

createTempDir

private Path createTempDir()
                    throws IOException

Throws:

IOException

createTempFile

private Path createTempFile(Path tempDir,
 String prefix,
 String suffix)
                     throws IOException

Throws:

IOException

createTempFile

private Path createTempFile(Path tempDir,
 String prefix,
 String suffix,
 String content)
                     throws IOException

Throws:

IOException

createTempBinaryFile

private Path createTempBinaryFile(Path tempDir,
 String prefix,
 String suffix,
 byte[] content)
                           throws IOException

Throws:

IOException

getFirstLine

private String getFirstLine(String str)

verifyAttestationResponse

public AttestationResponse verifyAttestationResponse(String attestationResponseContentBase64,
 String secureExecutionHeaderContentBase64,
 String attestationProtectionKeyContentBase64)
                                              throws ExecutionException

Verifies the validity of an attestation response

Parameters:

attestationResponseContentBase64 - the attestation response in base64

secureExecutionHeaderContentBase64 - the secure execution header in base64

attestationProtectionKeyContentBase64 - the attestation protection key in base64

Returns:

the attestation response

Throws:

ExecutionException - if something goes wrong

verifyAttestationResponse

public AttestationResponse verifyAttestationResponse(byte[] attestationResponseContent,
 byte[] secureExecutionHeaderContent,
 byte[] attestationProtectionKeyContent)
                                              throws ExecutionException

Verifies the validity of an attestation response

Parameters:

attestationResponseContent - the attestation response as byte array

secureExecutionHeaderContent - the secure execution header as byte array

attestationProtectionKeyContent - the attestation protection key as byte array

Returns:

the attestation response

Throws:

ExecutionException - if something goes wrong