analysis

type ActualBIOSInfo ¶

type ActualBIOSInfo struct {
	dmidecode.BIOSInfo
}

ActualBIOSInfo represents data stored in the SMBIOS of the actual image.

func NewActualBIOSInfo(biosInfo dmidecode.BIOSInfo) *ActualBIOSInfo

type ActualFirmware ¶

type ActualFirmware struct {
	Blob // contributes into cache key
	// contains filtered or unexported fields
}

ActualFirmware represents parsed actual firmware (the one we dump)

func NewActualFirmware(fw *uefi.UEFI, blob Blob) ActualFirmware

func (of ActualFirmware) UEFI() *uefi.UEFI

type ActualFirmwareBlob ¶

type ActualFirmwareBlob struct {
	Blob
}

ActualFirmwareBlob represents raw bytes of the actual firmware image (the one obtained from the host)

func NewActualFirmwareBlob(image Blob) ActualFirmwareBlob

type ActualPCR0 ¶

type ActualPCR0 []byte

ActualPCR0 represents an actual PCR0 value of the host

type ActualPSPFirmware ¶

type ActualPSPFirmware struct {
	Blob Blob // contributes to the cache key
	// contains filtered or unexported fields
}

ActualPSPFirmware represents parsed original AMD PSP firmware (the one we get from the orig firmware table and expect to be installed on the host)

func NewActualPSPFirmware(amdFW *amd_manifest.AMDFirmware, blob Blob) ActualPSPFirmware

func (af ActualPSPFirmware) AMDFirmware() *amd_manifest.AMDFirmware

type ActualRegisters ¶

type ActualRegisters struct {
	Regs registers.Registers
	// contains filtered or unexported fields
}

ActualRegisters represents the actual registers (the one obtained from the host)

func NewActualRegisters(regs registers.Registers) (ActualRegisters, error)

func (ar ActualRegisters) CacheWrite(b *objhash.Builder) error

func (ar ActualRegisters) GetRegisters() registers.Registers

type AlignedOriginalFirmware ¶

type AlignedOriginalFirmware struct {
	Blob        Blob
	ImageOffset uint64
	// contains filtered or unexported fields
}

AlignedOriginalFirmware represents a part of the original image which is aligned with the DumpedFirmware image.

Often the only region we can dump from the target is BIOS region, while the original image usually consists of multiple regions (and the BIOS region is the last one). So the aligned image is a such image that has an offset (to start with the same thing as the dumped firmware) and the same length as the dumped firmware.

func NewAlignedOriginalFirmware(fw *uefi.UEFI, offset uint64, blob Blob) AlignedOriginalFirmware

func (ao AlignedOriginalFirmware) UEFI() *uefi.UEFI

type Analyzer ¶

type Analyzer[inputType any] interface {
	ID() AnalyzerID
	Analyze(context.Context, inputType) (*Report, error)
}

Analyzer is an abstract interface that each analyzer should implement

type AnalyzerID ¶

type AnalyzerID string

AnalyzerID is a unique ID of every analyzer

TODO: consider replacing unique indexes with reflect.TypeOf(input) to have a single source of truth

type AssetID ¶

type AssetID int64

AssetID represents information about the asset id of the host that is being analyzed

type Blob ¶

type Blob interface {
	Bytes() []byte
}

Blob is an interface of a huge blob. Semantically in this package it is just `[]byte`. But:

1. Sometimes the consumers of this package may have constraints against passing large blobs directly as input. For example if we want analysis be storable and reproducible, in some infras it will store only an object ID in the input instead of the whole blob (and object itself will be stored in an object storage, like GitHub LFS or BlobStorage).
2. Another reason to pass objectIDs instead of images themselves is to make cache more efficient, because calculated hashes for large objects might be too expensive.

WARNING! The object, implementing this interface should export enough data to uniquely identify the specific image. Internally package `analysis` hashes all the input to calculate the cache key. So if two different images exports exactly the same fields, then there will be INVALID DATA provided by the cache.

type BytesBlob ¶

type BytesBlob []byte

BytesBlob is a simple implementation of a Blob, based on a simple []byte.

func (s BytesBlob) Bytes() []byte

type CachedValue ¶

type CachedValue struct {
	// TODO: consider replacing "reflect.Value" with just "any"
	Val    reflect.Value
	Issues []Issue
	Err    error
}

CachedValue represents a value stored in DataCache

type DataCache ¶

type DataCache interface {
	// Get returns a cached object if found. inputHash could be nil, for cases when cache guarantees object uniqness for each type.
	// On of that cases is `uniqueTypeDataCache` that is used to store objects obtained for a single Analyser
	Get(t reflect.Type, inputHash *objhash.ObjHash) *CachedValue
	Set(t reflect.Type, inputHash objhash.ObjHash, val *CachedValue)
}

DataCache represents an interface for a cache used in analysis package

func NewDataCache() DataCache

type DataCalculator ¶

type DataCalculator struct {
	// contains filtered or unexported fields
}

DataCalculator is a handler which resolves missing values for the analyzers using the given values

func NewDataCalculator(cacheSize int) (*DataCalculator, error)

func (dc *DataCalculator) Calculate(
	ctx context.Context,
	t reflect.Type,
	in Input,
	cache DataCache,
) (reflect.Value, []Issue, error)

type DataCalculatorInterface ¶

type DataCalculatorInterface interface {
	Calculate(ctx context.Context, t reflect.Type, in Input, cache DataCache) (reflect.Value, []Issue, error)
}

DataCalculatorInterface calculates intermediate results that could be reused, like: measurements flow, fixed registers

type ErrAnalyze ¶

type ErrAnalyze struct {
	Err error
}

ErrAnalyze means got an error from calling Analyze().

func (e ErrAnalyze) Error() string

func (e ErrAnalyze) Unwrap() error

type ErrCalcNotSupported ¶

type ErrCalcNotSupported struct {
	// contains filtered or unexported fields
}

ErrCalcNotSupported determines a situation when input data calculator doesn't support the type

func (e ErrCalcNotSupported) Error() string

type ErrFailedCalcInput ¶

type ErrFailedCalcInput struct {
	Input string
	Err   error
}

ErrFailedCalcInput determines a situation when input value should be calculated and that calculation failed

func (e ErrFailedCalcInput) Error() string

func (e ErrFailedCalcInput) Unwrap() error

type ErrMissingInput ¶

type ErrMissingInput struct {
	// contains filtered or unexported fields
}

ErrMissingInput determines situation when input needed by analyzer is missing

func (e ErrMissingInput) Error() string

type ErrNotApplicable ¶

type ErrNotApplicable struct {
	Description string
}

ErrNotApplicable should be returned by analyzer to tell that it is not applicable for given input

func NewErrNotApplicable(description string) ErrNotApplicable

func (e ErrNotApplicable) Error() string

type ErrResolveInput ¶

type ErrResolveInput struct {
	Err error
}

ErrResolveInput means it was unable to resolve input, required by the analyzer.

func (e ErrResolveInput) Error() string

func (e ErrResolveInput) Unwrap() error

type ErrResolveValue ¶

type ErrResolveValue struct {
	FieldName string
	TypeName  string
	Err       error
}

ErrResolveValue means it was unable to resolve a value, required by the analyzer.

func (e ErrResolveValue) Error() string

func (e ErrResolveValue) Unwrap() error

type ErrTypeIDNotRegistered ¶

type ErrTypeIDNotRegistered struct {
	TypeID TypeID
}

ErrTypeIDNotRegistered means there was an attempt to serialize/deserialize a value of a type, not registered in the type register (see also function `RegisterType`).

func (e ErrTypeIDNotRegistered) Error() string

type FixedRegisters ¶

type FixedRegisters struct {
	Regs registers.Registers
	// contains filtered or unexported fields
}

FixedRegisters represents registers that have been fixed in accordance with other information obtained from the host

func NewFixedRegisters(regs registers.Registers) (FixedRegisters, error)

func (fr FixedRegisters) CacheWrite(b *objhash.Builder) error

func (fr FixedRegisters) GetRegisters() registers.Registers

type Input ¶

type Input map[TypeID]any

Input specifies input data for analysis

func NewInput() Input

func (in Input) AddActualBIOSInfo(biosInfo ActualBIOSInfo) Input

func (in Input) AddActualFirmware(image Blob) Input

func (in Input) AddActualPCR0(pcr []byte) Input

func (in Input) AddActualRegisters(regs ActualRegisters) Input

func (in Input) AddAssetID(assetID int64) Input

func (in Input) AddCustomValue(v any) Input

deserializable.

func (in Input) AddOriginalBIOSInfo(biosInfo OriginalBIOSInfo) Input

func (in Input) AddOriginalFirmware(image Blob) Input

func (in Input) AddTPMDevice(tpm tpmdetection.Type) Input

func (in Input) AddTPMEventLog(eventLog *tpmeventlog.TPMEventLog) Input

func (in Input) ForceBootFlow(_flow bootflowtypes.Flow) Input

func (in Input) GoString() string

func (in Input) MarshalJSON() ([]byte, error)

func (in *Input) Scan(src any) error

func (in *Input) UnmarshalJSON(b []byte) error

func (in Input) Value() (driver.Value, error)

type Issue ¶

type Issue struct {
	// Custom is a custom information provided for issue description. Should be serialisable
	Custom any

	// Severity tells how important is found issue
	Severity Severity

	// Description is a text description of a found problem
	Description string
}

Issue describes a single found problem in firmware

type OriginalBIOSInfo ¶

type OriginalBIOSInfo struct {
	dmidecode.BIOSInfo
}

OriginalBIOSInfo represents data stored in the SMBIOS of the original image.

func NewOriginalBIOSInfo(biosInfo dmidecode.BIOSInfo) *OriginalBIOSInfo

type OriginalFirmware ¶

type OriginalFirmware struct {
	Blob // contributes into cache key
	// contains filtered or unexported fields
}

OriginalFirmware represents parsed original firmware (the one we get from the orig firmware table and expect to be installed on the host)

func NewOriginalFirmware(fw *uefi.UEFI, blob Blob) OriginalFirmware

func (of OriginalFirmware) UEFI() *uefi.UEFI

type OriginalFirmwareBlob ¶

type OriginalFirmwareBlob struct {
	Blob
}

OriginalFirmwareBlob represents raw bytes of the original firmware image

func NewOriginalFirmwareBlob(image Blob) OriginalFirmwareBlob

type ReferenceFirmware ¶

type ReferenceFirmware struct {
	Blob        Blob
	ImageOffset uint64
	// contains filtered or unexported fields
}

ReferenceFirmware is a firmware used as the reference. It is the aligned original firmware if it is available, or just the actual firmware otherwise.

func NewReferenceFirmware(ctx context.Context, alignedOriginalFirmware *AlignedOriginalFirmware, actualFirmware *ActualFirmware) (*ReferenceFirmware, error)

func (rf ReferenceFirmware) UEFI() *uefi.UEFI

type Report ¶

type Report struct {
	// Custom is a custom information provided for report description. Should be serialisable
	Custom any

	// Errors is the list of errors.
	Issues []Issue

	// Comments is the list of additional messages, which are not considered errors.
	Comments []string
}

Report is an outcome of every firmware analysis algorithm

TODO: consider using Go generics to specify the `Custom` field.

func ExecuteAnalyzer[analyzerInputType any](
	ctx context.Context,
	dataCalculator DataCalculatorInterface,
	analyzer Analyzer[analyzerInputType],
	in Input,
	cache DataCache,
) (retReport *Report, retErr error)

func (r Report) MarshalJSON() ([]byte, error)

func (r *Report) Scan(src any) error

func (r *Report) UnmarshalJSON(b []byte) error

func (r *Report) Value() (driver.Value, error)

type Severity ¶

type Severity uint32

Severity represents severity of an issue

const (
	// SeverityInfo tells that the issue is not important
	SeverityInfo Severity = iota

	// SeverityWarning tells that the issue has a medium priority
	SeverityWarning

	// SeverityCritical tells that the issue has a high priority
	SeverityCritical
)

type TypeID ¶

type TypeID = xjson.TypeID

TypeID as an unique string of a named type.