tdx_guest

type Ecdsa256BitQuoteV4AuthData struct {
	Signature      [64]byte
	AttestationKey [64]byte
	Type           uint16
	ParsedDataSize uint32
	Data           QeReportCertificationData
}

type EnclaveIdentity struct {
	ID                      string     `json:"id"`
	Version                 int        `json:"version"`
	IssueDate               time.Time  `json:"issueDate"`
	NextUpdate              time.Time  `json:"nextUpdate"`
	TcbEvaluationDataNumber int        `json:"tcbEvaluationDataNumber"`
	MiscSelect              HexUint32  `json:"miscselect"`
	MiscSelectMask          HexUint32  `json:"miscSelectMask"`
	Attributes              HexBytes   `json:"attributes"`
	AttributesMask          HexBytes   `json:"attributesMask"`
	MrSigner                HexBytes   `json:"mrsigner"`
	IsvProdID               uint16     `json:"isvprodid"`
	TcbLevels               []TcbLevel `json:"tcbLevels"`
}

type EnclaveReport struct {
	CpuSvn     [16]byte
	MiscSelect uint32
	Reserved1  [28]byte
	Attributes [16]byte
	MrEnclave  [32]byte
	Reserved2  [32]byte
	MrSigner   [32]byte
	Reserved3  [96]byte
	IsvProdID  uint16
	IsvSvn     uint16
	Reserved4  [60]byte
	ReportData [64]byte
}

type HexBytes []byte

type HexUint32 uint32

type PckConfiguration struct {
	DynamicPlatform bool
	CachedKeys      bool
	SmtEnabled      bool
}

type PckExtension struct {
	Ppid               [16]byte
	Tcb                PckTcb
	PceID              [2]byte
	Fmspc              [6]byte
	SgxType            int
	PlatformInstanceID [16]byte
	Configuration      PckConfiguration
}

type PckTcb struct {
	Components [16]byte // SGX TCB Comp01 SVN ... SGX TCB Comp16 SVN
	PceSvn     int
	CpuSvn     [16]byte
}

type PcsClient struct {
	// contains filtered or unexported fields
}

type QeAuthData struct {
	ParsedDataSize uint16
	Data           []byte
}

type QeReportCertificationData struct {
	QeReport EnclaveReport

	QeReportSignature [64]byte
	QeAuthData        QeAuthData
	Type              uint16
	ParsedDataSize    uint32
	Data              []byte
	// contains filtered or unexported fields
}

type QgsMsgGetQuoteReq struct {
	Header       QgsMsgHeader     // header.type = GET_QUOTE_REQ (0)
	ReportSize   uint32           // cannot be 0
	IdListSize   uint32           // length of id_list, in byte, can be 0
	ReportIdList [reportSize]byte // report followed by id list
}

type QgsMsgGetQuoteResp struct {
	Header         QgsMsgHeader // header.type = GET_QUOTE_RESP
	SelectedIdSize uint32       // can be 0 in case only one id is sent in request
	QuoteSize      uint32       // length of quote_data, in byte

}

type QgsMsgHeader struct {
	MajorVersion uint16
	MinorVersion uint16
	Type         uint32
	Size         uint32 // size of the whole message, include this header, in byte
	ErrorCode    uint32 // used in response only
}

type ReportBodyType uint16

type Request func(url string) ([]byte, http.Header, error)

type SgxQuote struct {
	Header     SgxQuoteHeader
	Type       ReportBodyType
	Size       uint32
	ReportBody SgxReport2BodyV15

	SignatureDataLen uint32
	SignatureData    Ecdsa256BitQuoteV4AuthData
	// contains filtered or unexported fields
}

type SgxQuoteHeader struct {
	Version    uint16   // < 0:  The version this quote structure.
	AttKeyType uint16   // < 2:  sgx_attestation_algorithm_id_t.  Describes the type of signature in the signature_data[] field.
	TeeType    TeeType  // < 4:  Type of Trusted Execution Environment for which the Quote has been generated. Supported values: 0 (SGX), 0x81(TDX)
	Reserved   uint32   // < 8:  Reserved field.
	VendorId   [16]byte // < 12: Unique identifier of QE Vendor.
	UserData   [20]byte // < 28: Custom attestation key owner data.
}

type SgxReport2Body struct {
	TeeTcbSvn      TeeTcbSvn         // <  0:  TEE_TCB_SVN Array
	MrSeam         TeeMeasurement    // < 16:  Measurement of the SEAM module
	MrSignerSeam   TeeMeasurement    // < 64:  Measurement of a 3rd party SEAM module’s signer (SHA384 hash). The value is 0’ed for Intel SEAM module
	SeamAttributes TeeAttributes     // < 112: MBZ: TDX 1.0
	TdAttributes   TeeAttributes     // < 120: TD's attributes
	XFam           TeeAttributes     // < 128: TD's XFAM
	MrTd           TeeMeasurement    // < 136: Measurement of the initial contents of the TD
	MrConfigId     TeeMeasurement    // < 184: Software defined ID for non-owner-defined configuration on the guest TD. e.g., runtime or OS configuration
	MrOwner        TeeMeasurement    // < 232: Software defined ID for the guest TD's owner
	MrOwnerConfig  TeeMeasurement    // < 280: Software defined ID for owner-defined configuration of the guest TD, e.g., specific to the workload rather than the runtime or OS
	RtMr           [4]TeeMeasurement // < 328: Array of 4(TDX1: NUM_RTMRS is 4) runtime extendable measurement registers
	ReportData     TeeReportData     // < 520: Additional report data
}

type SgxReport2BodyV15 struct {
	SgxReport2Body
	TeeTcbSvn2  TeeTcbSvn      // < 584: Array of TEE TCB SVNs (for TD preserving).
	MrServiceTd TeeMeasurement // < 600: If is one or more bound or pre-bound service TDs, SERVTD_HASH is the SHA384 hash of the TDINFO_STRUCTs of those service TDs bound. Else, SERVTD_HASH is 0..
}

type Tcb struct {
	IsvSvn           uint16           `json:"isvsvn"` // TDX SEAM module's ISV SVN, Wrong "isvnsvn" in document
	SgxTcbComponents [16]TcbComponent `json:"sgxtcbcomponents"`
	PceSvn           int              `json:"pcesvn"`
	TdxTcbComponents [16]TcbComponent `json:"tdxtcbcomponents"`
}

type TcbComponent struct {
	Svn      uint8  `json:"svn"`
	Category string `json:"category"`
	Type     string `json:"type"`
}

type TcbInfo struct {
	ID                      string              `json:"id"`
	Version                 int                 `json:"version"`
	IssueDate               time.Time           `json:"issueDate"`
	NextUpdate              time.Time           `json:"nextUpdate"`
	Fmspc                   HexBytes            `json:"fmspc"`
	PceID                   HexBytes            `json:"pceId"`
	TcbType                 int                 `json:"tcbType"`
	TcbEvaluationDataNumber int                 `json:"tcbEvaluationDataNumber"`
	TdxModule               TdxModule           `json:"tdxModule"`
	TdxModuleIdentities     []TdxModuleIdentity `json:"tdxModuleIdentities"`
	TcbLevels               []TcbLevel          `json:"tcbLevels"`
}

type TcbLevel struct {
	Tcb         Tcb       `json:"tcb"`
	TcbDate     time.Time `json:"tcbDate"`
	TcbStatus   TcbStatus `json:"tcbStatus"`
	AdvisoryIDs []string  `json:"advisoryIDs"`
}

type TcbStatus string

type TdxModule struct {
	MrSigner       HexBytes `json:"mrsigner"`
	Attributes     HexBytes `json:"attributes"`
	AttributesMask HexBytes `json:"attributesMask"`
}

type TdxModuleIdentity struct {
	TdxModule
	ID        string     `json:"id"`
	TcbLevels []TcbLevel `json:"tcbLevels"`
}

type TdxQuoteHdr struct {
	Version uint64           // Quote version, filled by TD
	Status  uint64           // Status code of Quote request, filled by VMM
	InLen   uint32           // Length of TDREPORT, filled by TD
	OutLen  uint32           // Length of Quote, filled by VMM
	Data    [reqBufSize]byte // Actual Quote data or TDREPORT on input
}

type TdxQuoteReq struct {
	Buf uint64
	Len uint64
}

type TdxReportReq struct {
	ReportData [reportDataSize]byte
	TdReport   [reportSize]byte
}

type TeeAttributes = [8]byte

type TeeMeasurement = [48]byte

type TeeReportData = [64]byte

type TeeTcbSvn [16]byte // https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/DCAP_1.22/QuoteGeneration/quote_wrapper/common/inc/sgx_quote_4.h#L63-L67

type TeeType uint32

type VerifyOptions struct {
	GetCollateral bool // download the collateral from intel pcs and check.
	CheckCrl      bool // download the crl (certificate revocation list) and check if quote pck cert is revoked.
	PcsClient     PcsClient
}