/***********************************************************
 * tls.Dial Wrapper -> attestedtls.Dial
 * Additionally requests and then verifies the obtained Attestation Report
 * before returning the established connection.
 */
tls.Dial Wrapper -> attestedtls.Dial
Additionally requests and then verifies the obtained Attestation Report
before returning the established connection.
/ *********************************************************** * tls . Dial Wrapper - > attestedtls . Dial * Additionally requests and then verifies the obtained Attestation Report * before returning the established connection . * /
func Dial(network, addr string, config *tls.Config) (*tls.Conn, error) {
	var nonce []byte
	var err error
	var conn *tls.Conn
	conn, err = tls.Dial(network, addr, config)
	if err != nil {
		log.Error(err)
		return nil, errors.New("[Dialer] TLS establishment failed.")
	}
	log.Trace("[Dialer] TLS established. Obtaining attestation report.....")
	nonce = make([]byte, noncelen)
	_, err = rand.Read(nonce)
	if err != nil {
		log.Error(err)
		conn.Close()
		return nil, errors.New("[Dialer] Failed to generate nonce.")
	}
	req := &ci.AttestationRequest{
		Nonce : nonce,
	}
	data, err := proto.Marshal(req)
	if err != nil {
		log.Error(err)
		conn.Close()
		return nil, errors.New("[Dialer] Failed to generate request.")
	}
	log.Trace("[Dialer] writing: ", hex.EncodeToString(data))
	err = Write(data, conn)
	if err != nil {
		log.Error(err)
		conn.Close()
		return nil, errors.New("[Dialer] Failed to write request.")
	}
	log.Trace("[Dialer] Waiting for AR.....")
	data, err = Read(conn)
	if err != nil {
		log.Error(err)
		conn.Close()
		return nil, errors.New("[Dialer] Failed to read response.")
	}
	resp := &ci.AttestationResponse{}
	err = proto.Unmarshal(data, resp)
	if err != nil {
		log.Error(err)
		conn.Close()
		return nil, errors.New("[Dialer] Failed to parse response.")
	}
	if resp.Status != ci.Status_OK || len(resp.AttestationReport) == 0 {
		conn.Close()
		return nil, errors.New("[Dialer] Did not receive attestation report.")
	}
	log.Trace("[Dialer] Verifying attestation report.....")
	err = verifyAR(nonce, resp.AttestationReport)
	if err != nil {
		log.Error(err)
		conn.Close()
		return nil, errors.New("[Dialer] Attestation report verification failed.")
	}
	log.Info("[Dialer] Attestation successful. Connection Establishment complete.")
	return conn, nil
}
func Dial ( network , addr string , config * tls . Config ) ( * tls . Conn , error ) { var nonce [ ] byte var err error var conn * tls . Conn conn , err = tls . Dial ( network , addr , config ) if err != nil { log . Error ( err ) return nil , errors . New ( " " ) } log . Trace ( " " ) nonce = make ( [ ] byte , noncelen ) _ , err = rand . Read ( nonce ) if err != nil { log . Error ( err ) conn . Close ( ) return nil , errors . New ( " " ) } req := & ci . AttestationRequest { Nonce : nonce , } data , err := proto . Marshal ( req ) if err != nil { log . Error ( err ) conn . Close ( ) return nil , errors . New ( " " ) } log . Trace ( " " , hex . EncodeToString ( data ) ) err = Write ( data , conn ) if err != nil { log . Error ( err ) conn . Close ( ) return nil , errors . New ( " " ) } log . Trace ( " " ) data , err = Read ( conn ) if err != nil { log . Error ( err ) conn . Close ( ) return nil , errors . New ( " " ) } resp := & ci . AttestationResponse { } err = proto . Unmarshal ( data , resp ) if err != nil { log . Error ( err ) conn . Close ( ) return nil , errors . New ( " " ) } if resp . Status != ci . Status_OK || len ( resp . AttestationReport ) == 0 { conn . Close ( ) return nil , errors . New ( " " ) } log . Trace ( " " ) err = verifyAR ( nonce , resp . AttestationReport ) if err != nil { log . Error ( err ) conn . Close ( ) return nil , errors . New ( " " ) } log . Info ( " " ) return conn , nil }
tls.Dial Wrapper -> attestedtls.Dial
Additionally requests and then verifies the obtained Attestation Report
before returning the established connection.
tls . Dial Wrapper - > attestedtls . Dial Additionally requests and then verifies the obtained Attestation Report before returning the established connection .
// Create TLS connection // Create nonce // Create AR request with nonce // Send Request msg // Receive response // Parse response msg // Check response status // Verify AR // FUTURE: check for mTLS here and then receive nonce, obtain local AR and send to other connector // FUTURE: Send some sort of Ack (or receive if mTLS) // finished