ExternalVendorCode/go-attestation
1
0
Fork 0
mirror of https://github.com/google/go-attestation.git synced 2024-12-24 07:06:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix golangci-lint findings

Browse Source
This commit is contained in:
Brandon Weeks 2022-11-01 12:57:06 -07:00 committed by Brandon Weeks
parent 19d3c4de97
commit 0dc056af7d
15 changed files with 40 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@ -81,7 +81,7 @@ if err != nil {
// handle error // handle error
} }
if err := ioutil.WriteFile("encrypted_aik.json", akBytes, 0600); err != nil { if err := os.WriteFile("encrypted_aik.json", akBytes, 0600); err != nil {
// handle error // handle error
} }
@ -115,7 +115,7 @@ returning the same secret to the server.
```go ```go
// Client decrypts the credential // Client decrypts the credential
akBytes, err := ioutil.ReadFile("encrypted_aik.json") akBytes, err := os.ReadFile("encrypted_aik.json")
if err != nil { if err != nil {
// handle error // handle error
} }

12
attest/application_key_test.go
View File

@ -496,8 +496,7 @@ func testKeyOpts(t *testing.T, tpm *TPM) {
expected = defaultConfig expected = defaultConfig
} }
pub := sk.Public() switch pub := sk.Public().(type) {
switch pub.(type) {
case *ecdsa.PublicKey: case *ecdsa.PublicKey:
if expected.Algorithm != ECDSA { if expected.Algorithm != ECDSA {
t.Errorf("incorrect key type generated, expected %q, got EC", expected.Algorithm) t.Errorf("incorrect key type generated, expected %q, got EC", expected.Algorithm)
@ -511,16 +510,15 @@ func testKeyOpts(t *testing.T, tpm *TPM) {
if !ok { if !ok {
t.Fatalf("cannot match curve to key size %d", expected.Size) t.Fatalf("cannot match curve to key size %d", expected.Size)
} }
curve := pub.(*ecdsa.PublicKey).Curve if expectedCurve != pub.Curve {
if expectedCurve != curve { t.Errorf("incorrect curve, expected %v, got %v", expectedCurve, pub.Curve)
t.Errorf("incorrect curve, expected %v, got %v", expectedCurve, curve)
} }
case *rsa.PublicKey: case *rsa.PublicKey:
if expected.Algorithm != RSA { if expected.Algorithm != RSA {
t.Errorf("incorrect key type, expected %q, got RSA", expected.Algorithm) t.Errorf("incorrect key type, expected %q, got RSA", expected.Algorithm)
} }
if pub.(*rsa.PublicKey).Size()*8 != expected.Size { if pub.Size()*8 != expected.Size {
t.Errorf("incorrect key size, expected %d, got %d", expected.Size, pub.(*rsa.PublicKey).Size()*8) t.Errorf("incorrect key size, expected %d, got %d", expected.Size, pub.Size()*8)
} }
default: default:
t.Errorf("unsupported key type: %T", pub) t.Errorf("unsupported key type: %T", pub)

5
attest/attest-tool/attest-tool.go
View File

@ -13,7 +13,6 @@ import (
"errors" "errors"
"flag" "flag"
"fmt" "fmt"
"io/ioutil"
"os" "os"
"github.com/google/go-attestation/attest" "github.com/google/go-attestation/attest"
@ -153,10 +152,10 @@ func runCommand(tpm *attest.TPM) error {
if err != nil { if err != nil {
return err return err
} }
return ioutil.WriteFile(*keyPath, b, 0644) return os.WriteFile(*keyPath, b, 0644)
case "quote": case "quote":
b, err := ioutil.ReadFile(*keyPath) b, err := os.ReadFile(*keyPath)
if err != nil { if err != nil {
return err return err
} }

4
attest/attest-tool/internal/eventlog/secureboot_test.go
View File

@ -16,7 +16,7 @@ package eventlog
import ( import (
"encoding/json" "encoding/json"
"io/ioutil" "os"
"testing" "testing"
"github.com/google/go-attestation/attest" "github.com/google/go-attestation/attest"
@ -24,7 +24,7 @@ import (
) )
func parseEvents(t *testing.T, testdata string) []attest.Event { func parseEvents(t *testing.T, testdata string) []attest.Event {
data, err := ioutil.ReadFile(testdata) data, err := os.ReadFile(testdata)
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }

8
attest/eventlog.go
View File

@ -56,14 +56,6 @@ func (e ReplayError) Error() string {
return fmt.Sprintf("event log failed to verify: the following registers failed to replay: %v", e.InvalidPCRs) return fmt.Sprintf("event log failed to verify: the following registers failed to replay: %v", e.InvalidPCRs)
} }
// TPM algorithms. See the TPM 2.0 specification section 6.3.
//
// https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf#page=42
const (
algSHA1 uint16 = 0x0004
algSHA256 uint16 = 0x000B
)
// EventType indicates what kind of data an event is reporting. // EventType indicates what kind of data an event is reporting.
// //
// https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf#page=103 // https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientSpecPlat_TPM_2p0_1p04_pub.pdf#page=103

14
attest/eventlog_test.go
View File

@ -18,7 +18,7 @@ import (
"bytes" "bytes"
"encoding/base64" "encoding/base64"
"encoding/json" "encoding/json"
"io/ioutil" "os"
"testing" "testing"
"github.com/google/go-tpm/tpm2" "github.com/google/go-tpm/tpm2"
@ -56,7 +56,7 @@ func TestParseEventLogLinux(t *testing.T) {
} }
func testParseEventLog(t *testing.T, testdata string) { func testParseEventLog(t *testing.T, testdata string) {
data, err := ioutil.ReadFile(testdata) data, err := os.ReadFile(testdata)
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }
@ -70,7 +70,7 @@ func testParseEventLog(t *testing.T, testdata string) {
} }
func TestParseCryptoAgileEventLog(t *testing.T) { func TestParseCryptoAgileEventLog(t *testing.T) {
data, err := ioutil.ReadFile("testdata/crypto_agile_eventlog") data, err := os.ReadFile("testdata/crypto_agile_eventlog")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }
@ -88,7 +88,7 @@ func TestEventLog(t *testing.T) {
} }
func testEventLog(t *testing.T, testdata string) { func testEventLog(t *testing.T, testdata string) {
data, err := ioutil.ReadFile(testdata) data, err := os.ReadFile(testdata)
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }
@ -183,7 +183,7 @@ func TestParseShortNoAction(t *testing.T) {
// Currently we just assume that such events will have Data shorter than // Currently we just assume that such events will have Data shorter than
// "EFI Specification ID" field. // "EFI Specification ID" field.
data, err := ioutil.ReadFile("testdata/short_no_action_eventlog") data, err := os.ReadFile("testdata/short_no_action_eventlog")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }
@ -326,7 +326,7 @@ func TestEBSVerifyWorkaround(t *testing.T) {
}, },
} }
elr, err := ioutil.ReadFile("testdata/ebs_event_missing_eventlog") elr, err := os.ReadFile("testdata/ebs_event_missing_eventlog")
if err != nil { if err != nil {
t.Fatal(err) t.Fatal(err)
} }
@ -340,7 +340,7 @@ func TestEBSVerifyWorkaround(t *testing.T) {
} }
func TestAppendEvents(t *testing.T) { func TestAppendEvents(t *testing.T) {
base, err := ioutil.ReadFile("testdata/ubuntu_2104_shielded_vm_no_secure_boot_eventlog") base, err := os.ReadFile("testdata/ubuntu_2104_shielded_vm_no_secure_boot_eventlog")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }

2
attest/internal/events.go
View File

@ -188,7 +188,7 @@ func (e EventType) String() string {
func UntrustedParseEventType(et uint32) (EventType, error) { func UntrustedParseEventType(et uint32) (EventType, error) {
// "The value associated with a UEFI specific platform event type MUST be in // "The value associated with a UEFI specific platform event type MUST be in
// the range between 0x80000000 and 0x800000FF, inclusive." // the range between 0x80000000 and 0x800000FF, inclusive."
if (et < 0x80000000 && et > 0x800000FF) || (et < 0x0 && et > 0x12) { if (et < 0x80000000 && et > 0x800000FF) || (et <= 0x0 && et > 0x12) {
return EventType(0), fmt.Errorf("event type not between [0x0, 0x12] or [0x80000000, 0x800000FF]: got %#x", et) return EventType(0), fmt.Errorf("event type not between [0x0, 0x12] or [0x80000000, 0x800000FF]: got %#x", et)
} }
if _, ok := eventTypeNames[EventType(et)]; !ok { if _, ok := eventTypeNames[EventType(et)]; !ok {

12
attest/secureboot_test.go
View File

@ -17,12 +17,12 @@ package attest
import ( import (
"encoding/base64" "encoding/base64"
"encoding/json" "encoding/json"
"io/ioutil" "os"
"testing" "testing"
) )
func TestSecureBoot(t *testing.T) { func TestSecureBoot(t *testing.T) {
data, err := ioutil.ReadFile("testdata/windows_gcp_shielded_vm.json") data, err := os.ReadFile("testdata/windows_gcp_shielded_vm.json")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }
@ -52,7 +52,7 @@ func TestSecureBoot(t *testing.T) {
// See: https://github.com/google/go-attestation/issues/157 // See: https://github.com/google/go-attestation/issues/157
func TestSecureBootBug157(t *testing.T) { func TestSecureBootBug157(t *testing.T) {
raw, err := ioutil.ReadFile("testdata/sb_cert_eventlog") raw, err := os.ReadFile("testdata/sb_cert_eventlog")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }
@ -135,7 +135,7 @@ func b64MustDecode(input string) []byte {
} }
func TestSecureBootOptionRom(t *testing.T) { func TestSecureBootOptionRom(t *testing.T) {
raw, err := ioutil.ReadFile("testdata/option_rom_eventlog") raw, err := os.ReadFile("testdata/option_rom_eventlog")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }
@ -177,7 +177,7 @@ func TestSecureBootOptionRom(t *testing.T) {
} }
func TestSecureBootEventLogUbuntu(t *testing.T) { func TestSecureBootEventLogUbuntu(t *testing.T) {
data, err := ioutil.ReadFile("testdata/ubuntu_2104_shielded_vm_no_secure_boot_eventlog") data, err := os.ReadFile("testdata/ubuntu_2104_shielded_vm_no_secure_boot_eventlog")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }
@ -196,7 +196,7 @@ func TestSecureBootEventLogUbuntu(t *testing.T) {
} }
func TestSecureBootEventLogFedora36(t *testing.T) { func TestSecureBootEventLogFedora36(t *testing.T) {
data, err := ioutil.ReadFile("testdata/coreos_36_shielded_vm_no_secure_boot_eventlog") data, err := os.ReadFile("testdata/coreos_36_shielded_vm_no_secure_boot_eventlog")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }

4
attest/tpm12_linux.go
View File

@ -22,7 +22,7 @@ import (
"crypto/x509" "crypto/x509"
"encoding/binary" "encoding/binary"
"fmt" "fmt"
"io/ioutil" "os"
"github.com/google/go-tspi/attestation" "github.com/google/go-tspi/attestation"
"github.com/google/go-tspi/tspi" "github.com/google/go-tspi/tspi"
@ -169,5 +169,5 @@ func (t *trousersTPM) pcrs(alg HashAlg) ([]PCR, error) {
} }
func (t *trousersTPM) measurementLog() ([]byte, error) { func (t *trousersTPM) measurementLog() ([]byte, error) {
return ioutil.ReadFile("/sys/kernel/security/tpm0/binary_bios_measurements") return os.ReadFile("/sys/kernel/security/tpm0/binary_bios_measurements")
} }

7
attest/tpm_linux.go
View File

@ -21,7 +21,6 @@ import (
"errors" "errors"
"fmt" "fmt"
"io" "io"
"io/ioutil"
"os" "os"
"path" "path"
"strings" "strings"
@ -49,7 +48,7 @@ func InjectSimulatedTPMForTest(rwc io.ReadWriteCloser) *TPM {
func probeSystemTPMs() ([]probedTPM, error) { func probeSystemTPMs() ([]probedTPM, error) {
var tpms []probedTPM var tpms []probedTPM
tpmDevs, err := ioutil.ReadDir(tpmRoot) tpmDevs, err := os.ReadDir(tpmRoot)
if err != nil && !os.IsNotExist(err) { if err != nil && !os.IsNotExist(err) {
return nil, err return nil, err
} }
@ -82,7 +81,7 @@ type linuxCmdChannel struct {
// MeasurementLog implements CommandChannelTPM20. // MeasurementLog implements CommandChannelTPM20.
func (cc *linuxCmdChannel) MeasurementLog() ([]byte, error) { func (cc *linuxCmdChannel) MeasurementLog() ([]byte, error) {
return ioutil.ReadFile("/sys/kernel/security/tpm0/binary_bios_measurements") return os.ReadFile("/sys/kernel/security/tpm0/binary_bios_measurements")
} }
func openTPM(tpm probedTPM) (*TPM, error) { func openTPM(tpm probedTPM) (*TPM, error) {
@ -98,7 +97,7 @@ func openTPM(tpm probedTPM) (*TPM, error) {
// If the TPM has a kernel-provided resource manager, we should // If the TPM has a kernel-provided resource manager, we should
// use that instead of communicating directly. // use that instead of communicating directly.
devPath := path.Join("/dev", path.Base(tpm.Path)) devPath := path.Join("/dev", path.Base(tpm.Path))
f, err := ioutil.ReadDir(path.Join(tpm.Path, "device", "tpmrm")) f, err := os.ReadDir(path.Join(tpm.Path, "device", "tpmrm"))
if err != nil { if err != nil {
if !os.IsNotExist(err) { if !os.IsNotExist(err) {
return nil, err return nil, err

2
attest/win_events.go
View File

@ -600,7 +600,7 @@ func (w *WinEvents) readLoadedModuleAggregation(rdr *bytes.Reader, header micros
return err return err
} }
case imageValidated: case imageValidated:
if imgValidated == true { if imgValidated {
return errors.New("duplicate image validated field in LMA event") return errors.New("duplicate image validated field in LMA event")
} }
if imgValidated, err = w.parseImageValidated(h, r); err != nil { if imgValidated, err = w.parseImageValidated(h, r); err != nil {

4
attest/win_events_test.go
View File

@ -16,7 +16,7 @@ package attest
import ( import (
"encoding/json" "encoding/json"
"io/ioutil" "os"
"testing" "testing"
"github.com/google/go-cmp/cmp" "github.com/google/go-cmp/cmp"
@ -91,7 +91,7 @@ func TestParseWinEvents(t *testing.T) {
}, },
} }
data, err := ioutil.ReadFile("testdata/windows_gcp_shielded_vm.json") data, err := os.ReadFile("testdata/windows_gcp_shielded_vm.json")
if err != nil { if err != nil {
t.Fatalf("reading test data: %v", err) t.Fatalf("reading test data: %v", err)
} }

4
attest/wrapped_tpm20.go
View File

@ -53,8 +53,6 @@ func (t *wrappedTPM20) ekTemplate() (tpm2.Public, error) {
return *t.tpmEkTemplate, nil return *t.tpmEkTemplate, nil
} }
func (*wrappedTPM20) isTPMBase() {}
func (t *wrappedTPM20) tpmVersion() TPMVersion { func (t *wrappedTPM20) tpmVersion() TPMVersion {
return TPMVersion20 return TPMVersion20
} }
@ -175,7 +173,7 @@ func (t *wrappedTPM20) newAK(opts *AKConfig) (*AK, error) {
}() }()
// We can only certify the creation immediately afterwards, so we cache the result. // We can only certify the creation immediately afterwards, so we cache the result.
attestation, sig, err := tpm2.CertifyCreation(t.rwc, "", keyHandle, keyHandle, nil, creationHash, tpm2.SigScheme{tpm2.AlgRSASSA, tpm2.AlgSHA256, 0}, tix) attestation, sig, err := tpm2.CertifyCreation(t.rwc, "", keyHandle, keyHandle, nil, creationHash, tpm2.SigScheme{Alg: tpm2.AlgRSASSA, Hash: tpm2.AlgSHA256, Count: 0}, tix)
if err != nil { if err != nil {
return nil, fmt.Errorf("CertifyCreation failed: %v", err) return nil, fmt.Errorf("CertifyCreation failed: %v", err)
} }

12
attributecert/attributecert_test.go
View File

@ -17,7 +17,7 @@ package attributecert
import ( import (
"crypto/x509" "crypto/x509"
"encoding/json" "encoding/json"
"io/ioutil" "os"
"reflect" "reflect"
"strings" "strings"
"testing" "testing"
@ -29,7 +29,7 @@ func TestVerifyAttributeCert(t *testing.T) {
"testdata/Intel_pc2.cer", "testdata/Intel_pc2.cer",
"testdata/Intel_pc3.cer", "testdata/Intel_pc3.cer",
} }
data, err := ioutil.ReadFile("testdata/IntelSigningKey_20April2017.cer") data, err := os.ReadFile("testdata/IntelSigningKey_20April2017.cer")
if err != nil { if err != nil {
t.Fatalf("failed to read Intel intermediate certificate: %v", err) t.Fatalf("failed to read Intel intermediate certificate: %v", err)
} }
@ -39,7 +39,7 @@ func TestVerifyAttributeCert(t *testing.T) {
} }
for _, filename := range testfiles { for _, filename := range testfiles {
data, err = ioutil.ReadFile(filename) data, err = os.ReadFile(filename)
if err != nil { if err != nil {
t.Fatalf("failed to read %s: %v", filename, err) t.Fatalf("failed to read %s: %v", filename, err)
} }
@ -57,7 +57,7 @@ func TestVerifyAttributeCert(t *testing.T) {
} }
func TestParseAttributeCerts(t *testing.T) { func TestParseAttributeCerts(t *testing.T) {
files, err := ioutil.ReadDir("testdata") files, err := os.ReadDir("testdata")
if err != nil { if err != nil {
t.Fatalf("failed to read test dir: %v", err) t.Fatalf("failed to read test dir: %v", err)
} }
@ -70,7 +70,7 @@ func TestParseAttributeCerts(t *testing.T) {
} }
filename := "testdata/" + file.Name() filename := "testdata/" + file.Name()
jsonfile := filename + ".json" jsonfile := filename + ".json"
data, err := ioutil.ReadFile(filename) data, err := os.ReadFile(filename)
if err != nil { if err != nil {
t.Fatalf("failed to read test data %s: %v", filename, err) t.Fatalf("failed to read test data %s: %v", filename, err)
} }
@ -78,7 +78,7 @@ func TestParseAttributeCerts(t *testing.T) {
if err != nil { if err != nil {
t.Fatalf("failed to parse test data %s: %v", filename, err) t.Fatalf("failed to parse test data %s: %v", filename, err)
} }
jsondata, err := ioutil.ReadFile(jsonfile) jsondata, err := os.ReadFile(jsonfile)
if err != nil { if err != nil {
t.Fatalf("failed to read json test data %s: %v", jsonfile, err) t.Fatalf("failed to read json test data %s: %v", jsonfile, err)
} }

2
ci/gen_ekcert.go
View File

@ -16,8 +16,6 @@ import (
"time" "time"
) )
var simulatorStatePath = flag.String("state_path", "/tmp/sim/NVRAM/00.permall", "Path to ibmswtpm state file")
func ekPub() *rsa.PublicKey { func ekPub() *rsa.PublicKey {
out, err := exec.Command("tpm_getpubek", "-z").Output() out, err := exec.Command("tpm_getpubek", "-z").Output()
if err != nil { if err != nil {