Skip to content

Commit 68f4a42

Browse files
cjen1-msftcjen1-msft
committed
bump tav
1 parent 60e1d4b commit 68f4a42

10 files changed

Lines changed: 115 additions & 42 deletions

File tree

‎3rdparty/internal/tee-attestation-verification/CHANGELOG.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,29 @@
11
# Changelog
22

3+
## [1.0.7]
4+
5+
[1.0.7]: https://github.com/microsoft/TEE-Attestation-Verification/releases/tag/tav-1.0.7
6+
7+
### Added
8+
9+
- C and .NET FFI constructors for decoding SNP reports without verification. (#101)
10+
11+
## [1.0.6]
12+
13+
[1.0.6]: https://github.com/microsoft/TEE-Attestation-Verification/releases/tag/tav-1.0.6
14+
15+
### Changed
16+
17+
- Updated the NuGet package README to consume C-ACI's published endorsement formats directly. (#98)
18+
19+
## [1.0.5]
20+
21+
[1.0.5]: https://github.com/microsoft/TEE-Attestation-Verification/releases/tag/tav-1.0.5
22+
23+
### Added
24+
25+
- Nuget packaging (#94)
26+
327
## [1.0.4]
428

529
[1.0.4]: https://github.com/microsoft/TEE-Attestation-Verification/releases/tag/tav-1.0.4

‎3rdparty/internal/tee-attestation-verification/Cargo.lock‎

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎3rdparty/internal/tee-attestation-verification/attestation/Cargo.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "tee-attestation-verification-lib"
3-
version = "1.0.4"
3+
version = "1.0.7"
44
edition = "2021"
55
rust-version = "1.77"
66
repository = "https://github.com/microsoft/TEE-Attestation-Verification"
@@ -45,7 +45,7 @@ env_logger = "0.11"
4545
tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
4646

4747
[dependencies]
48-
crypto = { package = "tee-attestation-verification-crypto", version = "1.0.4", path = "../crypto", default-features = false }
48+
crypto = { package = "tee-attestation-verification-crypto", version = "1.0.7", path = "../crypto", default-features = false }
4949
zerocopy = {version = "0.8.31", features = ["derive"]}
5050

5151
# KDS (online certificate fetching) dependencies

‎3rdparty/internal/tee-attestation-verification/caci/Cargo.toml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "tee-attestation-verification-caci"
3-
version = "1.0.4"
3+
version = "1.0.7"
44
edition = "2021"
55
rust-version = "1.77"
66
repository = "https://github.com/microsoft/TEE-Attestation-Verification"
@@ -32,9 +32,9 @@ crypto_webcrypto = [
3232
]
3333

3434
[dependencies]
35-
attestation = { package = "tee-attestation-verification-lib", version = "1.0.4", path = "../attestation", default-features = false }
36-
cose = { package = "tee-attestation-verification-cose", version = "1.0.4", path = "../cose", default-features = false }
37-
crypto = { package = "tee-attestation-verification-crypto", version = "1.0.4", path = "../crypto", default-features = false }
35+
attestation = { package = "tee-attestation-verification-lib", version = "1.0.7", path = "../attestation", default-features = false }
36+
cose = { package = "tee-attestation-verification-cose", version = "1.0.7", path = "../cose", default-features = false }
37+
crypto = { package = "tee-attestation-verification-crypto", version = "1.0.7", path = "../crypto", default-features = false }
3838
serde_json = "1"
3939

4040
[target.'cfg(not(target_family = "wasm"))'.dev-dependencies]

‎3rdparty/internal/tee-attestation-verification/cose/Cargo.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "tee-attestation-verification-cose"
3-
version = "1.0.4"
3+
version = "1.0.7"
44
edition = "2021"
55
rust-version = "1.77"
66
repository = "https://github.com/microsoft/TEE-Attestation-Verification"
@@ -16,7 +16,7 @@ crypto_pure_rust = ["crypto/crypto_pure_rust"]
1616
crypto_webcrypto = ["crypto/crypto_webcrypto"]
1717

1818
[dependencies]
19-
crypto = { package = "tee-attestation-verification-crypto", version = "1.0.4", path = "../crypto", default-features = false }
19+
crypto = { package = "tee-attestation-verification-crypto", version = "1.0.7", path = "../crypto", default-features = false }
2020
# project-everest/everparse tag v2026.07.02 resolves to this pinned commit.
2121
cborrs = { git = "https://github.com/project-everest/everparse.git", rev = "950bc93838ac2faae51126d8acd0637cf8c8a569" }
2222
cborrs-nondet = { git = "https://github.com/project-everest/everparse.git", rev = "950bc93838ac2faae51126d8acd0637cf8c8a569" }

‎3rdparty/internal/tee-attestation-verification/crypto/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "tee-attestation-verification-crypto"
3-
version = "1.0.4"
3+
version = "1.0.7"
44
edition = "2021"
55
rust-version = "1.77"
66
repository = "https://github.com/microsoft/TEE-Attestation-Verification"

‎3rdparty/internal/tee-attestation-verification/ffi/Cargo.toml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "tee-attestation-verification-ffi"
3-
version = "1.0.4"
3+
version = "1.0.7"
44
edition = "2021"
55
rust-version = "1.77"
66
repository = "https://github.com/microsoft/TEE-Attestation-Verification"
@@ -33,10 +33,10 @@ crypto_webcrypto = [
3333
]
3434

3535
[dependencies]
36-
attestation = { package = "tee-attestation-verification-lib", version = "1.0.4", path = "../attestation", default-features = false }
37-
caci = { package = "tee-attestation-verification-caci", version = "1.0.4", path = "../caci", default-features = false }
38-
cose = { package = "tee-attestation-verification-cose", version = "1.0.4", path = "../cose", default-features = false }
39-
crypto = { package = "tee-attestation-verification-crypto", version = "1.0.4", path = "../crypto", default-features = false }
36+
attestation = { package = "tee-attestation-verification-lib", version = "1.0.7", path = "../attestation", default-features = false }
37+
caci = { package = "tee-attestation-verification-caci", version = "1.0.7", path = "../caci", default-features = false }
38+
cose = { package = "tee-attestation-verification-cose", version = "1.0.7", path = "../cose", default-features = false }
39+
crypto = { package = "tee-attestation-verification-crypto", version = "1.0.7", path = "../crypto", default-features = false }
4040
serde_json = "1"
4141
zerocopy = { version = "0.8.31", features = ["derive"] }
4242

‎3rdparty/internal/tee-attestation-verification/ffi/include/tav/caci.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,10 @@ TAV_CACI_API TavError *tav_verify_caci_uvm_endorsement(
5757
/*
5858
* Verify the relying-party CACI policy over staged verified artifacts.
5959
*
60+
* attestation must be a report returned by tav_verify_snp_attestation. The
61+
* caller is responsible for not passing a report created by
62+
* tav_snp_attestation_report_from_unverified_bytes.
63+
*
6064
* The minimum TCB policy is passed as two parallel arrays of minimum_tcb_count
6165
* entries: minimum_tcb_cpuids holds one uint32_t CPUID per entry, and
6266
* minimum_tcb_values holds minimum_tcb_count contiguous 8-byte TCB values (the

‎3rdparty/internal/tee-attestation-verification/ffi/include/tav/snp.h‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,19 @@ extern "C" {
2020
*
2121
* Usage summary:
2222
* - Call tav_verify_snp_attestation with the raw attestation report and the
23-
* ARK, ASK, and VCEK certificates in PEM format.
24-
* - On success, verification writes a TavSnpAttestationReport* to out_report.
23+
* ARK, ASK, and VCEK certificates in PEM format, or call
24+
* tav_snp_attestation_report_from_unverified_bytes for fixed-size decoding
25+
* without authentication or semantic validation.
26+
* - On success, either function writes a TavSnpAttestationReport* to out_report.
2527
* Pass that report handle to the tav_snp_attestation_report_* accessors.
2628
* - Free the report handle with tav_snp_attestation_report_free when finished.
2729
*
2830
* Error behavior:
29-
* - tav_verify_snp_attestation returns NULL on success, or an owned TavError*
30-
* on failure. Inspect failures with tav_error_code and tav_error_message,
31-
* then free them with tav_error_free.
32-
* - tav_verify_snp_attestation reports invalid verification inputs and invalid
33-
* out_report state as TavError failures. Each input buffer is capped at
34-
* 1 GiB.
31+
* - Both report constructors return NULL on success, or an owned TavError* on
32+
* failure. Inspect failures with tav_error_code and tav_error_message, then
33+
* free them with tav_error_free.
34+
* - Both constructors report invalid inputs and invalid out_report state as
35+
* TavError failures. Each input buffer is capped at 1 GiB.
3536
* - Error accessors are defensive for NULL TavError pointers: tav_error_code
3637
* returns TAV_ERROR_IS_NULL and tav_error_message returns a static
3738
* diagnostic string.
@@ -63,7 +64,22 @@ TAV_API TavError *tav_verify_snp_attestation(
6364
size_t vcek_pem_len,
6465
TavSnpAttestationReport **out_report);
6566

66-
/* Scalar report accessors. Invalid report pointers are undefined behavior. */
67+
/*
68+
* Parse an SNP attestation report without cryptographic verification.
69+
*
70+
* This checks only that the input has the fixed SNP report size. It does not
71+
* validate field values, reserved bytes, signatures, certificates, or TCBs.
72+
* Do not make trust decisions from the returned report.
73+
*
74+
* out_report must point to a writable report-handle slot. The slot is set to
75+
* NULL before any fallible work and set to an owned handle only on success.
76+
*/
77+
TAV_API TavError *tav_snp_attestation_report_from_unverified_bytes(
78+
const uint8_t *report_bytes,
79+
size_t report_len,
80+
TavSnpAttestationReport **out_report);
81+
82+
/* Report accessors. Invalid report pointers are undefined behavior. */
6783
TAV_API uint32_t tav_snp_attestation_report_version(
6884
const TavSnpAttestationReport *report);
6985
TAV_API uint32_t tav_snp_attestation_report_guest_svn(
@@ -196,7 +212,7 @@ TAV_API void tav_snp_attestation_report_signature_s(
196212
const uint8_t **data,
197213
size_t *len);
198214

199-
/* Frees a report handle returned by tav_verify_snp_attestation. NULL is a no-op. */
215+
/* Frees a report handle returned by either report constructor. NULL is a no-op. */
200216
TAV_API void tav_snp_attestation_report_free(TavSnpAttestationReport *report);
201217

202218
#ifdef __cplusplus

‎3rdparty/internal/tee-attestation-verification/ffi/src/c_ffi/snp.rs‎

Lines changed: 42 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,12 @@
55
//!
66
//! This module exports the symbols declared in `ffi/include/tav/snp.h`.
77
//!
8-
//! [`tav_verify_snp_attestation`] returns a null [`TavError`] pointer on
9-
//! success and an owned [`TavError`] pointer on failure. On success it
10-
//! writes an owned [`TavSnpAttestationReport`] handle to `out_report`.
8+
//! [`tav_verify_snp_attestation`] and
9+
//! [`tav_snp_attestation_report_from_unverified_bytes`] return a null
10+
//! [`TavError`] pointer on success and an owned [`TavError`] pointer on failure.
11+
//! On success they write an owned [`TavSnpAttestationReport`] handle to
12+
//! `out_report`. The latter performs fixed-size decoding only; its handle must
13+
//! not be used where a cryptographically verified report is required.
1114
//! Callers release these handles with [`crate::c_ffi::utils::tav_error_free`] and
1215
//! [`tav_snp_attestation_report_free`].
1316
//!
@@ -39,11 +42,20 @@ fn tav_error_from_verification_error(error: VerificationError) -> TavError {
3942
TavError::new(code, error.to_string())
4043
}
4144

45+
fn parse_report(report_bytes: &[u8]) -> Result<&AttestationReport, TavError> {
46+
AttestationReport::ref_from_bytes(report_bytes).map_err(|_| {
47+
TavError::invalid_argument(format!(
48+
"Invalid attestation report: expected {} bytes, got {}",
49+
std::mem::size_of::<AttestationReport>(),
50+
report_bytes.len()
51+
))
52+
})
53+
}
54+
4255
impl TavSnpAttestationReport {
4356
pub fn report(&self) -> &AttestationReport {
44-
AttestationReport::ref_from_bytes(&self.bytes).expect(
45-
"TavSnpAttestationReport is only constructed from verified bytes so parsing should not fail",
46-
)
57+
AttestationReport::ref_from_bytes(&self.bytes)
58+
.expect("TavSnpAttestationReport is only constructed from exact-size bytes")
4759
}
4860
}
4961

@@ -94,13 +106,7 @@ pub unsafe extern "C" fn tav_verify_snp_attestation(
94106

95107
let report_bytes =
96108
unsafe { input_bytes(report_bytes, report_len, "attestation report", false) }?;
97-
let report = AttestationReport::ref_from_bytes(report_bytes).map_err(|_| {
98-
TavError::invalid_argument(format!(
99-
"Invalid attestation report: expected {} bytes, got {}",
100-
std::mem::size_of::<AttestationReport>(),
101-
report_len
102-
))
103-
})?;
109+
let report = parse_report(report_bytes)?;
104110

105111
let ark_pem = unsafe { input_bytes(ark_pem, ark_pem_len, "ARK", false) }?;
106112
let ark = certificate_from_pem(ark_pem).map_err(|error| {
@@ -137,6 +143,29 @@ pub unsafe extern "C" fn tav_verify_snp_attestation(
137143
})
138144
}
139145

146+
#[no_mangle]
147+
pub unsafe extern "C" fn tav_snp_attestation_report_from_unverified_bytes(
148+
report_bytes: *const u8,
149+
report_len: usize,
150+
out_report: *mut *mut TavSnpAttestationReport,
151+
) -> *mut TavError {
152+
into_result(|| {
153+
unsafe { owned_out_ptr(out_report, "out_report") }?;
154+
155+
let report_bytes =
156+
unsafe { input_bytes(report_bytes, report_len, "attestation report", false) }?;
157+
parse_report(report_bytes)?;
158+
159+
let report = TavSnpAttestationReport {
160+
bytes: report_bytes.to_vec(),
161+
};
162+
unsafe {
163+
*out_report = Box::into_raw(Box::new(report));
164+
}
165+
Ok(())
166+
})
167+
}
168+
140169
scalar_accessor!(tav_snp_attestation_report_version, u32, |report| report
141170
.version
142171
.get());

0 commit comments

Comments
 (0)