verifier: Fetch VCEK cert from KDS instead of bailing

deps/verifier/Cargo.toml

@@ -49,6 +49,7 @@ strum.workspace = true
 veraison-apiclient = { git = "https://github.com/chendave/rust-apiclient", branch = "token", optional = true }
 ear = { git = "https://github.com/veraison/rust-ear", rev = "43f7f480d09ea2ebc03137af8fbcd70fe3df3468", optional = true }
 x509-parser = { version = "0.14.0", optional = true }
+reqwest.workspace = true
 
 [build-dependencies]
 shadow-rs.workspace = true

deps/verifier/src/snp/mod.rs

@@ -14,6 +14,7 @@ use openssl::{
     sha::sha384,
     x509::{self, X509},
 };
+use reqwest::{get, Response as ReqwestResponse, StatusCode};
 use serde_json::json;
 use sev::firmware::guest::AttestationReport;
 use sev::firmware::host::{CertTableEntry, CertType};
@@ -32,11 +33,18 @@ const SNP_SPL_OID: Oid<'static> = oid!(1.3.6 .1 .4 .1 .3704 .1 .3 .3);
 const TEE_SPL_OID: Oid<'static> = oid!(1.3.6 .1 .4 .1 .3704 .1 .3 .2);
 const LOADER_SPL_OID: Oid<'static> = oid!(1.3.6 .1 .4 .1 .3704 .1 .3 .1);
 
+// KDS URL parameters
+const KDS_CERT_SITE: &str = "https://kdsintf.amd.com";
+const KDS_VCEK: &str = "/vcek/v1";
+
 #[derive(Debug)]
 pub struct Snp {
     vendor_certs: VendorCertificates,
 }
 
+/// Loads the Milan certificate chain and returns a static reference to it.
+/// The chain is loaded lazily using `OnceLock` to ensure it's only initialized once.
+/// Certificates are loaded from a PEM file and must contain exactly three certificates (ASK, ARK, ASVK).
 pub(crate) fn load_milan_cert_chain() -> &'static Result<VendorCertificates> {
     static MILAN_CERT_CHAIN: OnceLock<Result<VendorCertificates>> = OnceLock::new();
     MILAN_CERT_CHAIN.get_or_init(|| {
@@ -55,6 +63,8 @@ pub(crate) fn load_milan_cert_chain() -> &'static Result<VendorCertificates> {
 }
 
 impl Snp {
+    /// Creates a new `Snp` instance by loading the Milan certificate chain.
+    /// Returns an error if the certificate chain can not be loaded.
     pub fn new() -> Result<Self> {
         let Result::Ok(vendor_certs) = load_milan_cert_chain() else {
             bail!("Failed to load Milan cert chain");
@@ -73,6 +83,9 @@ pub(crate) struct VendorCertificates {
 
 #[async_trait]
 impl Verifier for Snp {
+    /// Evaluates the provided evidence against the expected report data and initialize data hash.
+    /// Validates the report signature, version, VMPL, and other fields.
+    /// Returns parsed claims if the verification is successful.
     async fn evaluate(
         &self,
         evidence: &[u8],
@@ -84,8 +97,9 @@ impl Verifier for Snp {
             cert_chain,
         } = serde_json::from_slice(evidence).context("Deserialize Quote failed.")?;
 
-        let Some(cert_chain) = cert_chain else {
-            bail!("Cert chain is unset");
+        let cert_chain = match cert_chain {
+            Some(chain) if !chain.is_empty() => chain,
+            _ => fetch_vcek_from_kds(report).await?,
         };
 
         verify_report_signature(&report, &cert_chain, &self.vendor_certs)?;
@@ -128,6 +142,8 @@ impl Verifier for Snp {
     }
 }
 
+/// Retrieves the octet string value for a given OID from a certificate's extensions.
+/// Supports both raw and DER-encoded formats.
 fn get_oid_octets<const N: usize>(
     vcek: &x509_parser::certificate::TbsCertificate,
     oid: Oid,
@@ -152,6 +168,7 @@ fn get_oid_octets<const N: usize>(
         .context("Unexpected data size")
 }
 
+/// Retrieves an integer value for a given OID from a certificate's extensions.
 fn get_oid_int(cert: &x509_parser::certificate::TbsCertificate, oid: Oid) -> Result<u8> {
     let val = cert
         .get_extension_unique(&oid)?
@@ -162,6 +179,7 @@ fn get_oid_int(cert: &x509_parser::certificate::TbsCertificate, oid: Oid) -> Res
     val_int.as_u8().context("Unexpected data size")
 }
 
+/// Verifies the signature of the attestation report using the provided certificate chain and vendor certificates.
 pub(crate) fn verify_report_signature(
     report: &AttestationReport,
     cert_chain: &[CertTableEntry],
@@ -223,12 +241,15 @@ pub(crate) fn verify_report_signature(
     Ok(())
 }
 
+/// Verifies the signature of a certificate against its issuer's public key.
 fn verify_signature(cert: &X509, issuer: &X509, name: &str) -> Result<()> {
     cert.verify(&(issuer.public_key()? as PKey<Public>))?
         .then_some(())
         .ok_or_else(|| anyhow!("Invalid {name} signature"))
 }
 
+/// Verifies the certificate chain based on the provided VCEK or VLEK.
+/// Ensures the chain is valid by verifying signatures and relationships between certificates.
 fn verify_cert_chain(
     cert_chain: &[CertTableEntry],
     ask: &X509,
@@ -267,6 +288,8 @@ fn verify_cert_chain(
     Ok(decoded_key)
 }
 
+/// Parses the attestation report and extracts the TEE evidence claims.
+/// Returns a JSON-formatted map of parsed claims.
 pub(crate) fn parse_tee_evidence(report: &AttestationReport) -> TeeEvidenceParsedClaim {
     let claims_map = json!({
         // policy fields
@@ -294,6 +317,7 @@ pub(crate) fn parse_tee_evidence(report: &AttestationReport) -> TeeEvidenceParse
     claims_map as TeeEvidenceParsedClaim
 }
 
+/// Extracts the common name (CN) from the subject name of a certificate.
 fn get_common_name(cert: &x509::X509) -> Result<String> {
     let mut entries = cert.subject_name().entries_by_nid(Nid::COMMONNAME);
     let Some(e) = entries.next() else {
@@ -307,6 +331,42 @@ fn get_common_name(cert: &x509::X509) -> Result<String> {
     Ok(e.data().as_utf8()?.to_string())
 }
 
+/// Asynchronously fetches the VCEK from the Key Distribution Service (KDS) using the provided attestation report.
+/// Returns the VCEK in DER format as part of a certificate table entry.
+async fn fetch_vcek_from_kds(att_report: AttestationReport) -> Result<Vec<CertTableEntry>> {
+    // Use attestation report to get data for URL
+    let hw_id: String = hex::encode(att_report.chip_id);
+
+    let vcek_url: String = format!(
+        "{KDS_CERT_SITE}{KDS_VCEK}/Milan/\
+        {hw_id}?blSPL={:02}&teeSPL={:02}&snpSPL={:02}&ucodeSPL={:02}",
+        att_report.reported_tcb.bootloader,
+        att_report.reported_tcb.tee,
+        att_report.reported_tcb.snp,
+        att_report.reported_tcb.microcode
+    );
+    // VCEK in DER format
+    let vcek_rsp: ReqwestResponse = get(vcek_url)
+        .await
+        .context("Unable to send request for VCEK")?;
+
+    match vcek_rsp.status() {
+        StatusCode::OK => {
+            let vcek_rsp_bytes: Vec<u8> = vcek_rsp
+                .bytes()
+                .await
+                .context("Unable to parse VCEK")?
+                .to_vec();
+            let key = CertTableEntry {
+                cert_type: CertType::VCEK,
+                data: vcek_rsp_bytes,
+            };
+            Ok(vec![key])
+        }
+        status => Err(anyhow!("Unable to fetch VCEK from URL: {status:?}")),
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;