biz

type DefaultTpmCertVerifier struct{}

type EnrollControlCardReq struct {
	// Selection of a specific switch control card.
	ControlCardSelection *cpb.ControlCardSelection
	// Infra-specific wired dependencies.
	Deps EnrollzInfraDeps
	// Verification options for IAK and IDevID certs.
	CertVerificationOpts x509.VerifyOptions
	// SSL profile ID to which newly-issued Owner IDevID cert should be applied.
	SSLProfileID string
}

type EnrollzDeviceClient interface {
	// Returns `TpmEnrollzServiceClient.GetIakCert()` response.
	//
	// During initial device install scenario, for an active control card IDevID cert *must* come from
	// the TLS handshake. Even though the device may optionally also specify active card's IDevID cert
	// in the response payload, as part of this EnrollzDeviceClient.GetIakCert() implementation it is
	// expected that the caller will overwrite/set this response payload `idevid_cert` field with the
	// IDevID cert from the TLS handshake.
	//
	// As specified in https://github.com/openconfig/attestz README, it is impossible to talk directly to the
	// standby control card (so all calls to standby card are relayed by the active card), and it is a
	// responsibility of the active control card to authenticate standby card using IDevID handshake.
	// Thus, for standby card the best we can do in this case is fetch it's IDevID cert from the response
	// payload (as opposed to TLS handshake - what we do for an active card enrollment) which active card
	// is responsible to populate.
	GetIakCert(ctx context.Context, req *epb.GetIakCertRequest) (*epb.GetIakCertResponse, error)

	// Returns `TpmEnrollzServiceClient.RotateOIakCert()` response.
	RotateOIakCert(ctx context.Context, req *epb.RotateOIakCertRequest) (*epb.RotateOIakCertResponse, error)
}

type EnrollzInfraDeps interface {
	// Client to communicate with Switch Owner CA to issue oIAK and oIDevID certs.
	SwitchOwnerCaClient

	// Client to communicate with the switch's enrollz endpoints.
	EnrollzDeviceClient

	// Parser and verifier of IAK and IDevID certs.
	TpmCertVerifier
}

type IssueOwnerIDevIDCertReq struct {
	// Identity fields of a given switch control card.
	CardID *cpb.ControlCardVendorId
	// PEM-encoded IDevID public key.
	IDevIDPubPem string
}

type IssueOwnerIDevIDCertResp struct {
	// PEM-encoded owner IDevID cert (signed by the switch owner CA).
	OwnerIDevIDCertPem string
}

type IssueOwnerIakCertReq struct {
	// Identity fields of a given switch control card.
	CardID *cpb.ControlCardVendorId
	// PEM-encoded IAK public key.
	IakPubPem string
}

type IssueOwnerIakCertResp struct {
	// PEM-encoded owner IAK cert (signed by the switch owner CA).
	OwnerIakCertPem string
}

type RotateOwnerIakCertReq struct {
	// Selection of a specific switch control card.
	ControlCardSelection *cpb.ControlCardSelection
	// Infra-specific wired dependencies.
	Deps EnrollzInfraDeps
	// Verification options for IAK cert.
	CertVerificationOpts x509.VerifyOptions
}

type SwitchOwnerCaClient interface {
	// For a given switch control card ID, issue an oIAK PEM cert based on IAK public key PEM.
	IssueOwnerIakCert(ctx context.Context, req *IssueOwnerIakCertReq) (*IssueOwnerIakCertResp, error)

	// For a given switch control card ID, issue an oIDevID PEM cert based on IDevID public key PEM.
	IssueOwnerIDevIDCert(ctx context.Context, req *IssueOwnerIDevIDCertReq) (*IssueOwnerIDevIDCertResp, error)
}

type TpmCertVerifier interface {
	// Performs the following:
	// 1. Validate (signature and expiration) IDevID TLS cert.
	// 2. Validate (signature and expiration) IAK cert.
	// 3. Make sure IAK and IDevID cert subject serials match.
	// 4. Parse IAK pub from IAK cert and validate it (accepted crypto algo and key length).
	// 5. Parse IDevID pub from IDevID cert and validate it (accepted crypto algo and key length).
	VerifyIakAndIDevIDCerts(ctx context.Context, req *VerifyIakAndIDevIDCertsReq) (*VerifyIakAndIDevIDCertsResp, error)

	// Performs the following:
	// 1. Validate (signature and expiration) a TPM-based cert such as IAK or IDevID.
	// 2. Parse pub key from the cert and validate it (accepted crypto algo and key length).
	VerifyTpmCert(ctx context.Context, req *VerifyTpmCertReq) (*VerifyTpmCertResp, error)
}

type VerifyIakAndIDevIDCertsReq struct {
	// Identity fields of a given switch control card.
	ControlCardID *cpb.ControlCardVendorId
	// Verification options for IAK and IDevID certs.
	CertVerificationOpts x509.VerifyOptions
	// PEM-encoded IAK x509 attestation cert.
	IakCertPem string
	// PEM-encoded IDevID x509 TLS cert.
	IDevIDCertPem string
}

type VerifyIakAndIDevIDCertsResp struct {
	// PEM-encoded IAK public key.
	IakPubPem string
	// PEM-encoded IDevID public key.
	IDevIDPubPem string
}

type VerifyTpmCertReq struct {
	// Identity fields of a given switch control card.
	ControlCardID *cpb.ControlCardVendorId
	// Verification options for a TPM-based cert such as IAK or IDevID.
	CertVerificationOpts x509.VerifyOptions
	// PEM-encoded x509 attestation IAK or TLS IDevID cert.
	CertPem string
}

type VerifyTpmCertResp struct {
	// PEM-encoded public key from x509 attestation IAK or TLS IDevID cert.
	PubPem string
}